Privacy policy

Who we are

This policy covers https://webecomewhatwebehold.xyz, an independent guide to the game We Become What We Behold. The operator is the editor of this guide. Email [email protected]. Nicky Case made the game and does not operate this site. See about.

What loads on a first visit

This is a static guide served through Cloudflare. No account is required, there is no newsletter form, and the site keeps no server-side profile of visitors.

Three third parties load by default, before you click anything: Google Analytics 4 (measurement ID G-VW0X9HM80Q) from googletagmanager.com and google-analytics.com, which records page views, sessions and basic device data; Microsoft Clarity (project z9u36gdovi) from clarity.ms and scripts.clarity.ms, which records session replay and heat maps and can contact Microsoft Bing delivery domains; and Adsterra, which serves a Native Banner (unit 32138943) inside the article flow and a Social Bar (unit 32138944) as a fixed bar, both from bicea.org. Ad creatives can request images, fonts and beacons from rotating delivery domains including cdn.show-creative1.com, cdn.show-sb.com, cdn.cloudpiko.com and static.nresystems.com, and some use Google Fonts. Adult ads are switched off for this website in the Adsterra panel.

The cookie banner is notice plus withdrawal, not a gate. On a first view with no stored choice, the site loads analytics, replay and advertising by default and shows the banner with Accept and Reject. Google Consent Mode is initialised before configuration with ad_storage, ad_user_data and ad_personalization denied, analytics_storage granted, and ads_data_redaction enabled. Accept keeps everything on and enables the Google advertising signals. Reject writes a denied record for 180 days, updates Google and Clarity, then reloads the document so the running third-party scripts and timers are unloaded. Later views with that record load none of the GA4, Clarity or Adsterra scripts.

YouTube is not loaded on its own. Video frames are created only after you press their play buttons; the video host is youtube.com or youtube-nocookie.com. The game frame also waits for a click, but is hosted on this site and contains no separate analytics tag. Google's own policy governs the video frame after the click.

Cloudflare processes ordinary connection logs (IP address, user agent, requested URL, timestamp) to serve and protect the site. That processing is described in Cloudflare's privacy policy.

Cookies and localStorage keys

The keys this site writes itself are listed first; the rest are set by the third parties above, either on their own domains or as first-party cookies on this domain depending on the script. Retention is the lifetime the provider documents; a browser may cap it sooner.

• wbwwb_consent (localStorage, this site): the Accept or Reject choice, a timestamp and the 180-day lifetime. Purpose: remember the banner decision. Basis: your action on the banner and a legitimate interest in not asking on every page view.
• wbwwb_consent_ad_closed (localStorage, this site): that you closed the floating Social Bar, so it stays closed for 180 days instead of returning on the next page. Basis: your preference.
• _ga (cookie, Google Analytics 4): distinguishes browsers for aggregate reports. 2 years.
• _ga_VW0X9HM80Q (cookie, Google Analytics 4): keeps session state for this measurement ID. 2 years.
• _clck (cookie, Microsoft Clarity): persists the Clarity user ID and preferences. 1 year.
• _clsk (cookie, Microsoft Clarity): joins page views into one session recording. 1 day.
• CLID and MUID (cookies, Microsoft): Microsoft user and advertising identifiers. 1 year.
• Adsterra and bicea.org advertising cookies: frequency capping, fraud prevention and click attribution. Names and lifetimes are assigned at delivery time and vary by campaign; Adsterra's policy governs them.
• YouTube player storage (cookies or localStorage, Google): player preferences and bandwidth estimate, created only if you start the player. Google's policy governs it.

Advertising, personalisation and opt-out

Adsterra is the only advertising network on this site. There is no AdSense, Popunder, Banner or Smartlink code here. The Adsterra units are contextual placements: this site does not ask for personalised advertising, and adult ads are disabled for the website in the Adsterra panel. Adsterra may still use cookies or device identifiers to cap repeated impressions, prevent fraud and attribute clicks.

You can limit personalised advertising from many networks through the industry pages below. Opting out does not remove ads; it makes them less personalised. Blocking third-party cookies in your browser has a similar effect.

• Google Ads Settings
• Digital Advertising Alliance opt-out
• Your Online Choices (EU)
• Network Advertising Initiative opt-out
• Microsoft privacy dashboard
• Adsterra privacy policy

Legal basis and withdrawal

The site uses measurement and replay to understand visits and identify usability problems, and advertising to fund the guide. These services load by default; the banner records an explicit Accept or Reject choice when you make one. An absent record is a default loading preference, not evidence of affirmative consent. Reject is available on the first view and stops subsequent loading after the page reloads.

Withdraw or change the choice at any time with Cookie settings in the footer, or by deleting wbwwb_consent and wbwwb_consent_ad_closed in your browser. Deleting wbwwb_consent makes the next view a first view again, so the scripts load once more until you press Reject.

If the browser sends Global Privacy Control, the site writes a denied record, disables the loaders and does not wait for a click. Do Not Track is not a single reliable signal, so it is not used as the switch; Global Privacy Control is.

Retention, your rights and changes

The site keeps no account database. The only records it controls are the two localStorage keys, and they stay in your browser. Aggregate GA4 reports are retained for the period set in the GA4 property; Clarity recordings follow Microsoft's retention setting for the project (30 days by default); Adsterra retains delivery logs under its own policy.

You can ask what this policy covers, request deletion of a record you sent us, or object to processing by writing to [email protected]. Because there is no account, we cannot export a profile that does not exist; we can confirm what the public pages load and point you to the provider's request form. If you are in the EEA or UK, you can complain to your supervisory authority.

Material changes to this page get a new checked date. The current date is 7 November 2026. Terms are on terms; the editorial rules are on editorial policy.

FAQ