Privacy Policy

Official Costcodle game screen showing a price guess and higher-or-lower arrows

This policy matches the scripts, frames, and image hosts this website actually loads, reviewed 2026-09-30. The partners are Google Analytics 4 (measurement id G-1FN39BTQP0), Microsoft Clarity (project yqbh8sga0y), and Adsterra (native banner ad unit 31485885 and social bar ad unit 31485886). I do not run a comment system or a self-hosted post box. The contact address is contact@costcodle.net.

Consent and when each script starts

This site uses Google Consent Mode v2. On every page the tag sets a consent default of denied for ad_storage, ad_user_data, ad_personalization, and analytics_storage, with ads_data_redaction and url_passthrough. The Google tag file (gtag.js) is fetched, but while consent stays denied it does not set advertising or analytics cookies. The Adsterra ad scripts and the Microsoft Clarity recording script are not in the page HTML at all — they are injected only after you allow analytics on the banner. If you reject, or if navigator.globalPrivacyControl is true, they never load. You can change the stored choice any time with the Cookie settings button in the footer.

What this site stores

Key costcodle_consent in localStorage. Value is a JSON object with your choice (granted or denied) and a timestamp. Purpose: remember the cookie decision. Retention: 180 days, then the banner can return. Legal basis: storing your preference so we do not ask on every page. You can delete it in your browser or open Cookie settings in the footer and choose again.

If you allow analytics, Google Analytics sets its own cookies (_ga, _ga_*) whose retention is set in Google's console, and Microsoft Clarity sets its cookies (_clck, _clsk, _cltk, CLID) and reads the page's DOM for its session replay. Adsterra may use cookies or comparable browser storage to serve and bill its ads once its scripts load. All of those storages live on Google's, Microsoft's, and Adsterra's systems under their policies, and the legal basis is your consent.

Closing the floating social bar writes key costcodle_socialbar_dismissed in localStorage (value 1, kept until you clear it) so the bar does not reappear on later visits. That is a UI preference stored locally on your device and read only on this domain.

What loads only after a click

Play inserts an iframe to https://costcodle.com/. That is the developer's site. On 2026-09-30 its HTML loaded Google Analytics measurement id G-J8Q97VV1GQ from googletagmanager.com, Google Fonts (VT323) from fonts.googleapis.com, and jQuery 3.6.4 from ajax.googleapis.com. Inside that origin the game writes localStorage keys state (today's guesses) and stats (played, win percent, streaks). Those keys are not on costcodle.net. Their cookies follow Google's and the developer's pages. We do not control them.

The video button inserts an iframe to https://www.youtube.com/embed/d3vcpI_SIAw. YouTube may set its own cookies once that frame loads. The still image is hosted on our domain, so the thumbnail itself is not a YouTube request.

Answer pages load product images from costcofdb.com and, for some products, images.costco-static.com because those are the image URLs in the official games.json file. These hosts receive the normal image request and may log it under their own policies. We do not send them an account id or a price guess.

Advertising and opting out of personalization

Ads are served by Adsterra (publisher 3403020) in two placements: a native banner (ad unit 31485885) and a fixed social bar (ad unit 31485886). Both load from the bicea.org script domain only after you allow analytics. ads.txt declares adsterra.com, 3403020, DIRECT as the only authorized seller. Consent Mode keeps ad_storage denied until you allow, so no personalized ad profile is built before consent. Google's personalized-ad controls are at https://adssettings.google.com/ and the industry opt-out list is at https://optout.aboutads.info/. The Analytics opt-out add-on is documented at https://tools.google.com/dlpage/gaoptout.

What we do not load

No AdSense, no other ad network, no Twikoo, and no comment backend. ads.txt lists only Adsterra because only Adsterra sells ads on this site today. If that changes, this page and ads.txt change with it.

Rights and changes

You can ask what we hold (the consent value is in your browser, not on our server), ask us to explain this policy, or object to a future tracking tag before we add one. Email contact@costcodle.net. We have no account database to export. Do Not Track is not a reliable browser signal; Global Privacy Control is the signal we honor. When this policy changes, the date on this page changes with it.