Legal
Privacy Policy
The Cookie Book is a free, independent Cookie Run: Kingdom companion site run by one person. This page explains exactly what the site collects, why it collects it, and how to switch it off.
Effective: 12 August 2026 Last updated: 14 September 2026
The short version
- You can browse the entire site without an account and without telling me who you are.
- Three measurement systems run on the site. Mine sets one cookie that forgets you after 30 minutes and never identifies you. Google Analytics and Grow by Mediavine both set longer-lived storage of their own, and both are here because advertising partners require them.
- The site carries advertising, and ads come with their own cookies. Google — through Google AdSense — and other third-party ad vendors set cookies and similar identifiers in your browser, and use them, along with your visits to this site and to other sites across the internet, to choose which ads you see, to limit how often you see the same one, and to measure whether ads worked. Advertising and ad cookies sets all of this out, and lists every way to switch personalised ads off.
- An account is entirely optional, and only needed to save builds, favourites, or publish guides.
- Anything you publish — guides, team builds, your public profile — is public on purpose.
- I never sell your data myself and I gain nothing from it being sold. But Grow by Mediavine, which the site now runs as part of applying to their ad network, is a third party that does build a cross-site advertising profile and does share it with advertisers on its own terms, and the same is true of the ad vendors above. Under laws such as California's, that counts as “selling” or “sharing” your personal information even though no money reaches me for it. That is a real change from how this site used to work, and Your choices is where you turn each part of it off.
- You can turn off all analytics in one click, in the Your choices section below. That switch covers measurement only — ads are turned off separately, and the same section says how.
Who runs this site
The Cookie Book (www.cookiebook.app) is an independent project built and operated by Ayden Beasley. For data protection purposes, I am the data controller. You can reach me at ab.web.designs.co@gmail.com.
The Cookie Book is a fan-made project. It is not affiliated with, endorsed by, or associated with Devsisters Corp., and Cookie Run: Kingdom and all related names and imagery belong to their respective owners.
What is collected automatically
This happens on every page, whether or not you have an account. Several separate systems run side by side, and they do not share data with one another. Advertising runs on every page too, and because it is the part of the site that collects the most, it has a section of its own below.
1. First-party analytics (my own)
Built and hosted by me, and deliberately minimal. It records, in full:
- The page path and page title you viewed
- The hostname of the site that referred you — never the referring page's full address
- A coarse device class (phone, tablet, desktop) and your browser window width
- How long the page was actively engaged, and how far down it you scrolled
It stores no persistent identifier. There is one cookie: a random session id that expires 30 minutes after your last page view, so the pages you read in one sitting count as one visit even if you open them in several tabs. Nothing else reads it, it is not sent anywhere but this site, and once it expires there is no way to recognise you again — coming back tomorrow is a completely fresh number.
To count daily visitors without tracking anyone, the server derives a one-way hash from a secret salt that rotates every day, your IP address, and your browser's user-agent string. Your IP address is used only to compute that hash and is never written to the database. Because the salt rotates daily, yesterday's hash cannot be linked to today's — so these are daily counts, and the same person returning tomorrow is a new, unlinkable number.
2. Google Analytics 4
Google Analytics 4 (measurement ID G-54RBGSWP6P) is a
third-party service operated by Google. Unlike the system above, it
does set cookies and it does build a persistent,
pseudonymous record of return visits — unless you are in a region where
it has to ask first, in which case
your answer to the consent message decides,
and declining means no Google Analytics cookies at all.
It collects the standard GA4 set, which includes:
- Pages viewed, and the order and timing of those views
- Approximate location — usually country and region, derived from your IP address
- Device, operating system, browser, and screen size
- How you arrived at the site (search engine, social link, direct)
- Engagement signals such as scrolls, outbound clicks and file downloads
Why it is here, honestly: advertising networks such as Mediavine and Raptive require applicants to run Google Analytics 4 and to grant them view-only access to it so they can verify traffic. It is here to be audited by them, not because I find it useful — the first-party system above remains what I actually read day to day.
Google processes this data on its own terms. See Google's Privacy Policy and how Google uses Analytics data. IP addresses are handled by Google and are not made available to me in any identifiable form.
3. Grow by Mediavine
Grow (loaded from faves.grow.me) is a third-party service
operated by Mediavine. It powers reader features such as favourites and
follows, and it is a mandatory part of the Mediavine advertising
application — a site cannot apply without running it on every page.
This is the most invasive thing on the site, and I would rather be blunt about it than bury it. Unlike the two systems above, Grow is an advertising-industry service. It does not wait for you to log in before it starts collecting, and Mediavine states that it may share, license or sell the data it gathers to its partners, including advertisers. Mediavine describes collecting:
- Your IP address, and an approximate location derived from it
- Device, operating system, browser and language
- Advertising identifiers, set in cookies and browser storage of its own
- What you read here and how you engage with it
- Your email address and profile, only if you choose to sign in to Grow itself — which is entirely optional and separate from a Cookie Book account
Grow builds this into a profile that follows you across every site running it, which is exactly the cross-site tracking this policy used to be able to say the site was free of. It is disabled by the same one-click switch as everything else, and content blockers stop it too.
Mediavine processes this data on its own terms and as its own data controller. See Mediavine's Legal and Privacy Center. Requests about data Mediavine holds go to them directly, at privacy@mediavine.com — I cannot see, retrieve or delete it for you.
4. Hosting and performance
The site is hosted by Vercel, which processes requests and keeps short-lived server logs including IP addresses for delivery, abuse prevention and security. Vercel Web Analytics and Speed Insights run on some pages to measure page performance; Vercel Web Analytics is cookieless. See Vercel's Privacy Policy.
Advertising and ad cookies
The Cookie Book is free to use, and advertising is what pays for the hosting, the database and the domain. The ads are served by third-party advertising companies rather than by me, and those companies set cookies and similar identifiers of their own in your browser. This section is the full account of that, and of every way to turn the personalised part of it off.
Google AdSense, and third-party vendors generally
The site uses Google AdSense, Google's advertising service, to display ads. Google is a third-party vendor, and it in turn works with other third-party vendors and ad networks. In plain terms:
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and to other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet.
-
Those cookies and identifiers are set and read from Google's own
domains, such as
doubleclick.netandgoogle.com, as well as from this one, which is what lets them recognise the same browser across different websites. - Ad vendors may also collect your IP address and an approximate location derived from it, your device, browser, operating system and language, and which pages here you looked at, for how long, and which ads you saw or clicked.
- I do not give advertisers your email address, your account, your saved builds or anything else you store on the site. What they collect, they collect themselves, through the ad code running in the page.
What Google does with that data is governed by Google's own terms rather than by this policy. See How Google uses information from sites or apps that use our services, Google's advertising and cookie notice, and Google's Privacy Policy. Requests about data Google holds go to Google directly — I cannot see, retrieve or delete it for you.
Turning personalised ads off
You can stop ads being personalised without losing anything on the site. It does not mean no ads: you will still see advertising, chosen from the page you are reading rather than from a profile built out of your browsing, and cookies are still used for the basics — counting impressions, stopping the same ad repeating at you, and detecting click fraud.
- Google My Ad Center, previously Google Ads Settings — turn off ad personalisation for everything Google serves you, here and everywhere else.
- YourAdChoices (DAA) and the NAI opt-out — opt out of a long list of third-party vendors at once. The industry's own directory of these tools is at www.aboutads.info.
- Your Online Choices — the same thing for the UK and Europe.
-
Block or clear cookies for this site and for
doubleclick.netin your browser settings, or use a content blocker. The site works perfectly well with one running.
Two things worth knowing. These opt-outs are themselves stored as cookies, so clearing your browser's cookies clears them too and you will need to set them again. And the analytics switch further down this page turns off measurement — it does not stop ads being served, because the ad code is not mine to switch off; the controls above are how you change what the ads do.
If you are in the UK, the EU or Switzerland
Advertising cookies are not strictly necessary, so in those regions they need your consent before they are set. You will be asked, once, through a Google-certified consent management platform — the consent message Google provides to publishers running AdSense — and your answer is remembered in this browser. You can change it at any time from the privacy or “Manage options” link that message leaves on the page, or by clearing this site's cookies, which resets the question. Declining does not lock you out of anything here.
That one answer also governs Google Analytics. The consent message runs in Google's consent mode with analytics storage included, so declining means the Google Analytics cookies described above are not set either, and nothing about your visit is tied to a returning browser. Google may still receive a basic, cookieless record of the page view, which it uses only for aggregate estimates and which cannot identify you or recognise you next time.
The message is on every page of the site, not only the ones carrying ads. It would be easier to load it with the ad code, but then a reader on a page with no ads would have had analytics cookies set and nothing to decline — so consent is collected everywhere, and ads are switched on a section at a time behind it.
Selling and sharing
I am paid for advertising space — for ads being shown on the page — and not for data about you. I hand no personal information to anyone in exchange for money, and I receive nothing when an ad vendor shares what it collected. That said, cross-context behavioural advertising — which is what personalised ads are — counts as “selling” or “sharing” personal information under California law and under several other US state privacy laws, and honesty is worth more here than a technicality. If you are covered by one of those, treat the personalisation opt-outs above as your do-not-sell-or-share request, and email me if you would like it confirmed or recorded.
Global Privacy Control: if your browser or extension sends a GPC signal, Google and the other ad vendors receive it and honour it as an opt-out where the law requires them to.
Where this stands today: the site is applying to Google AdSense, and the ad code is being added as part of that. Until Google approves the application you may not see ads on every page, or on any — but everything above applies from the moment the ad code loads, which is why it is written down before you meet it rather than after.
Cookies and local storage
Three cookies are set in the site's own name: two belonging to Google
Analytics, and one short-lived session marker of mine. Advertising adds
more. Google AdSense sets cookies here and, together with the other ad
vendors it works with, sets further cookies on its own domains such as
doubleclick.net — those are described in
Advertising and ad cookies above and are
governed by
Google's advertising and cookie notice.
Grow by Mediavine sets further cookies and browser storage of its own —
see
Mediavine's Legal and Privacy Center
for those. Because those two are third parties free to change their own
storage at any time, the rows below name what they use today rather than
promising a complete list. Everything else in the table is browser storage
that stays on your device and is never transmitted anywhere.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
_ga |
Cookie | Google Analytics — distinguishes one browser from another | 2 years |
_ga_54RBGSWP6P |
Cookie | Google Analytics — keeps session state | 2 years |
__gads, __gpi |
Cookie | Google AdSense — selects ads, measures whether they were seen or clicked, limits how often the same ad repeats, and detects ad fraud | Set by Google; typically up to 13 months |
IDE, NID, test_cookie and similar, set on doubleclick.net and google.com |
Cookie | Google and its advertising partners — recognises your browser across websites in order to personalise ads, cap frequency and report on campaigns. Not set by me and not readable by me | Set by Google; typically up to 13 months, some up to 24 |
| Consent record set by Google's consent message | Cookie and local storage | Remembers your answer to the UK/EU/Swiss consent prompt — which covers both advertising and Google Analytics — so you are not asked on every page | Set by Google; typically up to 13 months |
_grow_* and similar |
Cookie and local storage | Grow by Mediavine — advertising and audience identifiers. Names and lifetimes are set by Mediavine, not by me | Set by Mediavine; typically long-lived |
cb-analytics-session |
Cookie | Groups your page views into one visit for first-party analytics | 30 minutes after your last page view |
cb-analytics-opt-out |
Local storage | Remembers that you opted out of all analytics, including Grow | Until you clear it |
crk-cookie-dex-filter-state |
Local storage | Remembers your Cookie-Dex filters between visits | Until you clear it |
| Supabase auth token | Local storage | Keeps you signed in. Only present if you have an account | Until you sign out |
The site also registers a service worker, which caches pages and images on your device so it loads quickly and works offline. That cache holds site content only — no personal data.
If you create an account
Accounts are optional and exist only to save your work. You can use almost the entire site without one.
You can sign up with an email address and password, or with Google sign-in. If you use Google sign-in, Google shares your email address and basic profile details with the site; I never see your Google password. Accounts, passwords and sessions are handled by Supabase — passwords are hashed by Supabase and are never visible to me.
Depending on what you use, an account may store:
- Your email address, and a username and display name you choose
- An optional avatar image and bio
- Your favourite cookies, and which cookies you own in-game
- Team builds and topping builds you create
- Community guides you write, including any images or video you upload
What is public: published guides, published community team builds, and public profiles are visible to anyone, including search engines. Guides saved as private stay private. Media you upload to a guide is stored in a public-read bucket, meaning anyone with the direct file link can open it — please do not upload anything you would not want to be public.
Why I am allowed to process this
If you are in the UK, EU or another region with similar law, my lawful bases are:
- Legitimate interests — running, securing and understanding the use of a free site, using analytics that identify no one individually.
- Contract — providing the account features you signed up for.
- Consent — where required for non-essential cookies, and for anything you choose to publish.
Neither analytics system is strictly necessary to run the site — not Google's cookies, and not my own 30-minute session cookie. The switch in Your choices turns both off and clears any cookies either has already set. Advertising cookies are not strictly necessary either: where the law requires it, they — and the Google Analytics cookies alongside them — are set on the basis of your consent, collected before they are set through the Google-certified consent message described in Advertising and ad cookies, and you can change that answer at any time. Google, Mediavine and the other ad vendors also act as data controllers in their own right for what they collect, on their own lawful bases rather than mine.
Who else touches your data
I do not sell your personal information, and the money the site earns is for advertising space rather than for data about you — see Selling and sharing for what that does and does not cover. Mediavine and Google, however, are advertising companies rather than plain service providers: each acts as its own data controller and their policies permit them to share or sell what they collect for cross-context behavioural advertising. Data is handled by:
- Vercel — hosting and content delivery
- Supabase — database, sign-in, and file storage for accounts and community content
- Google — Google Analytics, Google AdSense and its advertising partners, and Google sign-in if you choose it
- Mediavine — Grow, for advertising audience data
- Other third-party ad vendors — the advertising networks and demand partners Google works with to fill the ad slots. The set changes, and Google rather than I decide who is in it
The advertising entries are the ones to watch. Google and Mediavine act as their own data controllers for advertising, not as my service providers, and their terms permit them to share or sell what they collect for cross-context behavioural advertising. Advertising and ad cookies covers this in full, including how to opt out.
These providers operate globally, so your data may be processed outside your country, including in the United States. Each maintains its own safeguards for international transfers, such as the EU Standard Contractual Clauses.
I may also disclose information where I am legally required to, or where it is necessary to investigate abuse of the site.
Your choices
Turn off all analytics
One switch disables all three measurement systems on this device — the first-party analytics, Google Analytics, and Grow by Mediavine. It takes effect immediately: nothing further is sent, Grow is no longer loaded at all on your next page view, and any Google Analytics cookies already on this device are cleared.
It does not switch off advertising. Ads are served by Google rather than by me, so the controls for them are Google's and the industry's — they are listed under Turning personalised ads off above, and take about a minute. If you are in the UK, the EU or Switzerland you have already been asked once, by the consent message, and that answer covers both the ads and Google Analytics; this switch is a second, stricter control that also stops my own first-party analytics, which the consent message does not cover.
The setting lives in this browser's storage, so it applies per browser and per device, and clearing site data resets it.
Prefer to do it by hand?
The switch above just writes one value. You can set it yourself from the browser's developer console on this site (F12, then Console):
localStorage.setItem("cb-analytics-opt-out", "1")
Reload the page and nothing further is collected. To opt back in, run
localStorage.removeItem("cb-analytics-opt-out").
Other options
- Install Google's Analytics opt-out browser add-on to block Google Analytics everywhere, not just here.
- Turn off personalised advertising at Google My Ad Center, and across the wider industry at DAA, NAI or Your Online Choices. Advertising and ad cookies explains what each of these does.
- Use Mediavine's own Legal and Privacy Center to exercise your rights over data Grow has already collected.
- Block or clear cookies for this site in your browser settings.
- Most content-blocking extensions already stop Google Analytics, Grow and the ad code, and the site works perfectly with them enabled.
Your rights over your data
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, export it, object to or restrict processing, and withdraw consent. To exercise any of these, email ab.web.designs.co@gmail.com and I will respond within 30 days. Deleting your account removes your profile, saved builds, favourites and collection. Guides you published may be retained in anonymised form if others depend on them, and you can ask for those to be removed too.
If you are in the UK or EU and believe I have handled your data badly, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.
How long data is kept
- First-party analytics — pruned on a rolling 180-day window.
- Google Analytics — retained for 14 months, then deleted by Google.
- Google AdSense and other ad vendors — retained by Google and its partners on their own schedules, which I do not set and cannot shorten. Their ad cookies typically expire within 13 months.
- Grow by Mediavine — retained by Mediavine on its own schedule, which I do not set and cannot shorten.
- Account data — kept until you delete your account.
- Published community content — kept while it is published.
- Server logs — kept briefly by the hosting provider for security and diagnostics.
Children
Cookie Run: Kingdom is played by people of all ages, and the guide content here is open to everyone. Accounts are a different matter: you must be at least 13 years old to create one, or older if your country sets a higher age for consenting to data processing — 16 in parts of the EU.
The site is not directed at children under 13 and I do not knowingly collect personal information from them. If you believe a child under 13 has created an account, email me and I will delete it promptly.
Changes, and how to reach me
If this policy changes materially — a new advertising partner, say, or a change in what the current ones collect — I will update the date at the top of this page and note it on the roadmap. Continuing to use the site after a change means you accept the updated policy.
Questions, data requests, or anything that looks wrong on this page: ab.web.designs.co@gmail.com.