Legal
Privacy Policy
The Cookie Book is a free, independent Cookie Run: Kingdom companion site run by one person. This page explains exactly what the site collects, why it collects it, and how to switch it off.
Effective: 12 August 2026 Last updated: 13 August 2026
The short version
- You can browse the entire site without an account and without telling me who you are.
- Two analytics systems run on the site. Mine sets one cookie that forgets you after 30 minutes and never identifies you. Google Analytics sets cookies that last two years, and it is here because advertising partners require it.
- An account is entirely optional, and only needed to save builds, favourites, or publish guides.
- Anything you publish — guides, team builds, your public profile — is public on purpose.
- I do not sell your data, and there is nothing to sell: there is no advertising ID, no cross-site tracking, and no data broker in the stack.
- You can turn off all analytics in one click, in the Your choices section below.
Who runs this site
The Cookie Book (www.cookiebook.app) is an independent project built and operated by Ayden Beasley. For data protection purposes, I am the data controller. You can reach me at ab.web.designs.co@gmail.com.
The Cookie Book is a fan-made project. It is not affiliated with, endorsed by, or associated with Devsisters Corp., and Cookie Run: Kingdom and all related names and imagery belong to their respective owners.
What is collected automatically
This happens on every page, whether or not you have an account. Two separate systems run side by side, and they do not share data with each other.
1. First-party analytics (my own)
Built and hosted by me, and deliberately minimal. It records, in full:
- The page path and page title you viewed
- The hostname of the site that referred you — never the referring page's full address
- A coarse device class (phone, tablet, desktop) and your browser window width
- How long the page was actively engaged, and how far down it you scrolled
It stores no persistent identifier. There is one cookie: a random session id that expires 30 minutes after your last page view, so the pages you read in one sitting count as one visit even if you open them in several tabs. Nothing else reads it, it is not sent anywhere but this site, and once it expires there is no way to recognise you again — coming back tomorrow is a completely fresh number.
To count daily visitors without tracking anyone, the server derives a one-way hash from a secret salt that rotates every day, your IP address, and your browser's user-agent string. Your IP address is used only to compute that hash and is never written to the database. Because the salt rotates daily, yesterday's hash cannot be linked to today's — so these are daily counts, and the same person returning tomorrow is a new, unlinkable number.
2. Google Analytics 4
Google Analytics 4 (measurement ID G-54RBGSWP6P) is a
third-party service operated by Google. Unlike the system above, it
does set cookies and it does build a persistent,
pseudonymous record of return visits.
It collects the standard GA4 set, which includes:
- Pages viewed, and the order and timing of those views
- Approximate location — usually country and region, derived from your IP address
- Device, operating system, browser, and screen size
- How you arrived at the site (search engine, social link, direct)
- Engagement signals such as scrolls, outbound clicks and file downloads
Why it is here, honestly: advertising networks such as Mediavine and Raptive require applicants to run Google Analytics 4 and to grant them view-only access to it so they can verify traffic. The site does not currently show ads, but that is the direction this is pointing. The first-party system above remains what I actually use day to day.
Google processes this data on its own terms. See Google's Privacy Policy and how Google uses Analytics data. IP addresses are handled by Google and are not made available to me in any identifiable form.
3. Hosting and performance
The site is hosted by Vercel, which processes requests and keeps short-lived server logs including IP addresses for delivery, abuse prevention and security. Vercel Web Analytics and Speed Insights run on some pages to measure page performance; Vercel Web Analytics is cookieless. See Vercel's Privacy Policy.
Cookies and local storage
This site sets three cookies: two belonging to Google Analytics, and one short-lived session marker of my own. Everything else in the table below is browser storage that stays on your device and is never transmitted anywhere.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
_ga |
Cookie | Google Analytics — distinguishes one browser from another | 2 years |
_ga_54RBGSWP6P |
Cookie | Google Analytics — keeps session state | 2 years |
cb-analytics-session |
Cookie | Groups your page views into one visit for first-party analytics | 30 minutes after your last page view |
cb-analytics-opt-out |
Local storage | Remembers that you opted out of all analytics | Until you clear it |
crk-cookie-dex-filter-state |
Local storage | Remembers your Cookie-Dex filters between visits | Until you clear it |
| Supabase auth token | Local storage | Keeps you signed in. Only present if you have an account | Until you sign out |
The site also registers a service worker, which caches pages and images on your device so it loads quickly and works offline. That cache holds site content only — no personal data.
If you create an account
Accounts are optional and exist only to save your work. You can use almost the entire site without one.
You can sign up with an email address and password, or with Google sign-in. If you use Google sign-in, Google shares your email address and basic profile details with the site; I never see your Google password. Accounts, passwords and sessions are handled by Supabase — passwords are hashed by Supabase and are never visible to me.
Depending on what you use, an account may store:
- Your email address, and a username and display name you choose
- An optional avatar image and bio
- Your favourite cookies, and which cookies you own in-game
- Team builds and topping builds you create
- Community guides you write, including any images or video you upload
What is public: published guides, published community team builds, and public profiles are visible to anyone, including search engines. Guides saved as private stay private. Media you upload to a guide is stored in a public-read bucket, meaning anyone with the direct file link can open it — please do not upload anything you would not want to be public.
Why I am allowed to process this
If you are in the UK, EU or another region with similar law, my lawful bases are:
- Legitimate interests — running, securing and understanding the use of a free site, using analytics that identify no one individually.
- Contract — providing the account features you signed up for.
- Consent — where required for non-essential cookies, and for anything you choose to publish.
Neither analytics system is strictly necessary to run the site — not Google's cookies, and not my own 30-minute session cookie. The switch in Your choices turns both off and clears any cookies either has already set. If the site later joins an advertising network, that network's consent management tool will take over this decision and you will see a consent banner.
Who else touches your data
I do not sell your personal information, and I do not share it for cross-context behavioural advertising. Data is handled by these service providers, each for a single purpose:
- Vercel — hosting and content delivery
- Supabase — database, sign-in, and file storage for accounts and community content
- Google — Google Analytics, and Google sign-in if you choose it
These providers operate globally, so your data may be processed outside your country, including in the United States. Each maintains its own safeguards for international transfers, such as the EU Standard Contractual Clauses.
I may also disclose information where I am legally required to, or where it is necessary to investigate abuse of the site.
Your choices
Turn off all analytics
One switch disables both the first-party analytics and Google Analytics on this device. It takes effect immediately — nothing further is sent, and any Google Analytics cookies already on this device are cleared.
The setting lives in this browser's storage, so it applies per browser and per device, and clearing site data resets it.
Prefer to do it by hand?
The switch above just writes one value. You can set it yourself from the browser's developer console on this site (F12, then Console):
localStorage.setItem("cb-analytics-opt-out", "1")
Reload the page and nothing further is collected. To opt back in, run
localStorage.removeItem("cb-analytics-opt-out").
Other options
- Install Google's Analytics opt-out browser add-on to block Google Analytics everywhere, not just here.
- Block or clear cookies for this site in your browser settings.
- Most content-blocking extensions already stop Google Analytics, and the site works perfectly with them enabled.
Your rights over your data
Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, export it, object to or restrict processing, and withdraw consent. To exercise any of these, email ab.web.designs.co@gmail.com and I will respond within 30 days. Deleting your account removes your profile, saved builds, favourites and collection. Guides you published may be retained in anonymised form if others depend on them, and you can ask for those to be removed too.
If you are in the UK or EU and believe I have handled your data badly, you can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.
How long data is kept
- First-party analytics — pruned on a rolling 180-day window.
- Google Analytics — retained for 14 months, then deleted by Google.
- Account data — kept until you delete your account.
- Published community content — kept while it is published.
- Server logs — kept briefly by the hosting provider for security and diagnostics.
Children
Cookie Run: Kingdom is played by people of all ages, and the guide content here is open to everyone. Accounts are a different matter: you must be at least 13 years old to create one, or older if your country sets a higher age for consenting to data processing — 16 in parts of the EU.
The site is not directed at children under 13 and I do not knowingly collect personal information from them. If you believe a child under 13 has created an account, email me and I will delete it promptly.
Changes, and how to reach me
If this policy changes materially — for example when the site starts showing advertising — I will update the date at the top of this page and note it on the roadmap. Continuing to use the site after a change means you accept the updated policy.
Questions, data requests, or anything that looks wrong on this page: ab.web.designs.co@gmail.com.