Privacy policy
This policy matches the scripts on the site as of 14 Nov 2026. Google Analytics 4, Microsoft Clarity and Adsterra load by default; the banner lets you reject them, and Reject is remembered for 180 days.
Who is responsible
The publisher is the Christmas Mystery desk, [email protected], domain christmasmystery.xyz. Write to that address to access, correct, or delete a note you sent us, or to object to how a correction email is kept.
Default loading and your choice
Google Analytics 4, Microsoft Clarity and Adsterra ads are requested when a page opens, before you click anything. The banner is a notice with Accept and Reject, not a gate in front of the scripts. If you press Reject, the page updates Google consent signals to denied, removes the Clarity and Adsterra scripts, stores the refusal in local storage under cm_consent, and reloads. On that new document and later visits the loader does not create Clarity or Adsterra, and Google Analytics storage is denied. The choice lasts 180 days. Cookie settings in the footer brings the banner back so you can change it. Global Privacy Control, or Do Not Track set to 1, is treated as Reject.
Cookies and local storage
The only keys this site writes itself are cm_consent and cm_ad_closed. They live in browser local storage, not in a cookie, and are not sent to our server. Providers may also set their own first-party or third-party cookies through the scripts described below.
| Name | Set by | Purpose | Retention |
|---|---|---|---|
cm_consent | This site (local storage) | Stores Accept or Reject plus an expiry, so the banner and the loader agree. | 180 days |
cm_ad_closed | This site (local storage) | Remembers that you closed the floating Social Bar. | 30 days |
_ga, _ga_<container> | Google Analytics 4 | Distinguishes a browser and keeps a session together for aggregate reports. | Up to 2 years |
_clck | Microsoft Clarity | Persists the Clarity user ID and preferences for this site. | Up to 1 year |
_clsk | Microsoft Clarity | Connects page views into one Clarity session recording. | 1 day |
CLID, MUID, ANONCHK, MR, SM | Microsoft Clarity | Cross-site identifier and advertising-sync flags used by Microsoft Clarity; SM is session-scoped. | Provider-controlled; see Microsoft’s cookie policy |
| Advertising and partner cookies | Adsterra, served from bicea.org, and its demand partners | Frequency capping, fraud checks, and creative selection. Adult ads are switched off for this site. | Provider- and creative-dependent; see the network and partner policies |
__cf_bm | Cloudflare | Bot management and security at the hosting edge. | 30 minutes |
YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA | YouTube | Set only if you press play on a video; the thumbnail is hosted on this site and creates no YouTube request. | YSC: session; VISITOR_INFO1_LIVE: 180 days; other preferences: provider-controlled |
Analytics: Google Analytics 4 and Microsoft Clarity
Google Analytics 4 receives page views, approximate location derived from the request, device and browser information, and interaction events. It is operated by Google. GA4 does not log IP addresses, but the request still reaches Google. Reports are aggregate; we do not join them to a name. Event-level data is kept for the retention period configured in the property, up to 14 months. Google may process the data outside your country under its own safeguards. The measurement ID is G-537WRDWZXE.
Microsoft Clarity records pseudonymous sessions and heat maps: clicks, scrolling, and a replay of the page with text inputs masked by default. It sets the Clarity cookies in the table and sends the recording to Microsoft. We use it to see which guide sections are hard to use, not to identify a person. Clarity keeps playback data for 30 days; labeled or favorited sessions and heatmap data for 9 months.
Advertising: Adsterra
Adsterra supplies the in-page Native Banner and the floating Social Bar. Its script is served from bicea.org. Its demand partners may set creative-dependent cookies, read the page address and device information, and choose a creative. Adult ads are switched off for this site, so the network is not asked to serve adult creatives. We do not run Popunder, Banner or Smartlink units here.
Adsterra and its demand partners may use cookies or similar identifiers to limit repetition and, where permitted, to personalise a creative. You can object to personalised advertising at Google ad settings, the Network Advertising Initiative opt-out, and, in Europe, Your Online Choices. The Adsterra privacy policy is at adsterra.com/privacy-policy and its cookie policy at adsterra.com/cookies. Reject reloads this page and prevents Adsterra from being created on that document and later visits until you Accept again.
The seller declaration is in /ads.txt as adsterra.com, 3403020, DIRECT. It names only the network this site actually loads.
Other third parties
YouTube: the page shows a picture we host until you press play. That click creates a privacy-enhanced frame on www.youtube-nocookie.com, which can set YouTube cookies and receive your IP address and viewing request. We do not receive a copy of your YouTube account. If you never press play, no YouTube frame is created.
Cloudflare serves and protects the site at the hosting edge and may set the __cf_bm cookie shown above. Fonts and images are files on this site; we do not call a third-party font CDN. There is no traffic-mesh banner SDK, no Google AdSense tag, no Meta pixel, and no other advertising network on these pages.
Legal bases and your rights
The loader starts analytics, recording and advertising on a first visit, except when Global Privacy Control or Do Not Track is enabled. Accept records an explicit choice; Reject stops future script loading after the page reloads. It does not undo data already sent to a provider. Hosting and security processing is necessary to deliver and protect the page and is our legitimate interest. Mail you send is kept long enough to answer and to fix a page. We do not sell information you send us by email. Advertising partners process requests under their own policies.
Depending on where you live you may have rights to access, correct, delete, and export personal data you sent us, and to complain to a supervisory authority. Email [email protected]. We will say if we need more detail to find a message. You can clear cm_consent and cm_ad_closed yourself in the browser, and use the opt-out links above for advertising cookies. This policy is updated by editing this page and its date. Old versions are not hosted.
Questions
Do you run ads and analytics?
Yes. Google Analytics 4, Microsoft Clarity and Adsterra load when a page opens, which is how the guide is measured and kept free. Reject in the banner stops Clarity and Adsterra, denies Google Analytics storage, and is remembered for 180 days under cm_consent.
What are cm_consent and cm_ad_closed?
cm_consent stores Accept or Reject plus an expiry for 180 days. cm_ad_closed stores the fact that you closed the floating Social Bar for 30 days. Both are local storage keys, not cookies, and are not sent to our server.
How do I opt out of personalised advertising?
Use Google ad settings, the Network Advertising Initiative opt-out, or Your Online Choices in Europe. You can also press Reject in the banner; the page reloads and stops creating the advertising scripts. This does not undo information already sent.
Does YouTube load before I press play?
No. The thumbnail is stored on this site. The privacy-enhanced YouTube frame is created only when you press play, and that is when YouTube can set its cookies.