mandato.run
Privacy policy
This page lists every third party the site can actually load. If a script is not named here, it is not in the build.
What I checked
The layout sets a consent default of denied before loading Google Analytics 4, which stays cookieless and identifier-free until a visitor accepts it. Nothing else is requested on page load: the Microsoft Clarity session-replay tag and the two Adsterra ad units are injected by the site’s own script only after that accept. Videos use YouTube’s privacy-enhanced player only after a play button click. All images and styles are served locally. Contact email is forwarded by Cloudflare Email Routing to a Gmail inbox.
Who is responsible
The site operator of mandato.run can be reached at contact@mandato.run. Nest Games and SolitaryStudios are not the controller for this website.
What loads, and what does not
Three third parties can load, and all three wait for the banner. Google Analytics 4, measurement ID G-1R02GDNJDV, loads from www.googletagmanager.com and stays cookieless until you accept the banner. Microsoft Clarity, project ID ytblv4ajvk, loads from www.clarity.ms and records masked session replays and heatmaps; Clarity masks input content by default. Adsterra serves the site’s advertising: two units, Native Banner (ad unit NativeBanner_1, ID 31582989) in an in-page slot and Social Bar (ad unit SocialBar_1, ID 31582990) as the fixed bar at the bottom of the screen, with their scripts served from bicea.org. There is no AdSense unit, no comment system, and no font host. ads.txt is not published: Adsterra issues no ads.txt record for publishers ("we do not provide ads.txt files, as our advertisers do not require them", in its publisher help), so there is no seller line to declare and nothing to guess.
The head of each page runs a first-party inline snippet that calls gtag("consent","default") with ad_storage, ad_user_data, ad_personalization, and analytics_storage set to denied, and sets ads_data_redaction and url_passthrough. It then loads gtag.js from googletagmanager.com and calls gtag("config") for that ID. Until you accept, the only request Google gets is a cookieless ping that carries no identifier; accepting sends gtag("consent","update") with all four signals granted and starts normal measurement, and the Reject button sets them back to denied. Microsoft Clarity and the Adsterra units are separate tags, not part of gtag: the site injects them from its own script only after an accepted choice, so a visitor who rejects — or whose browser sends Global Privacy Control — never requests clarity.ms or bicea.org at all. The ad network’s own privacy and cookie policies, linked below, describe the cookies it sets for the ads it serves and how to reach it about them.
Hosting and contact email
Cloudflare processes network requests when this site is served through its hosting and network services. Technical request data can include your IP address, requested URL, browser information, and timestamps for delivery and security. Cloudflare does not feed a visitor analytics or session-replay product; the only visitor measurement products on the site are the Google Analytics 4 property and the Microsoft Clarity project described above.
If you email contact@mandato.run, Cloudflare Email Routing forwards the message to our Gmail inbox, operated by Google. These providers process the sender address, message content, and mail headers to deliver your request. We use the message only to handle corrections, enquiries, or privacy requests, and retain it only as long as needed to resolve the request or meet legal obligations. Do not send passwords or other sensitive account data.
localStorage
Key name: mandato-consent. Value: a JSON object with choice ("granted" or "denied") and expires. Retention: 180 days from the moment you choose. Purpose: remember the cookie banner choice. Legal basis: consent. You can delete it in your browser or open Cookie settings in the footer and choose again. We do not receive a copy of this value. There is no cookie with that name.
Key name: mandato-adbar-hidden. Value: "true" or "false". Retention: until you clear site data. Purpose: remember that you used the "Hide ad bar" button in the footer, so the fixed Adsterra Social Bar stays hidden on your later visits instead of returning on the next page load. Legal basis: your request. It affects only that bar; the rest of the site is unchanged.
If navigator.globalPrivacyControl is true, the site stores denied without showing the banner and sends the denied consent update, which keeps Google Analytics 4, Microsoft Clarity, and the Adsterra ad units off. A Do Not Track signal is treated as a wish to keep non-essential tags off, and every non-essential tag on this site follows it. Open Cookie settings in the footer any time you want to change the choice.
YouTube, only after you press play
Gameplay pages show a picture hosted on mandato.run. The browser does not contact YouTube until you activate the play button. The iframe then uses https://www.youtube-nocookie.com/embed/VIDEO_ID. Google may set cookies after that iframe loads, for playback and for its own policies. Purpose: play the video you asked for. Legal basis: the click is your request. Sandbox on that frame allows scripts and same-origin so the player can run, and it does not allow top navigation.
After activation, the player may contact www.youtube-nocookie.com, www.youtube.com, i.ytimg.com and yt3.ggpht.com (images), googlevideo.com (video delivery), fonts.gstatic.com and www.gstatic.com (player fonts and assets), and Google service domains such as jnn-pa.googleapis.com and www.google.com. These are YouTube/Google services, not separately installed analytics or advertising tags. The player receives your IP address, browser information, and the requested video. Rejecting the site banner does not load a player; pressing Play separately requests that video. Leave or reload the page to remove the loaded player.
YouTube’s own cookie information is at Google cookie policy. Personalized advertising controls are at Google ad settings.
Rights and changes
You can ask for access, correction, deletion, or a restriction by emailing the address above. The site keeps no account and no server-side visitor profile: the consent choice sits in your browser, Google Analytics cookies are written only after you accept, Microsoft Clarity sets its own _clck and _clsk cookies once it loads, and Adsterra sets its own cookies for the ad units it serves. Clearing site data for mandato.run removes the first-party keys; cookies set by those third-party domains are removed with those domains. We do not sell personal information.
Changes to this policy are posted on this URL. The date in the page metadata is the revision date. /privacy-policy/, /cookie-policy/, and /cookies/ redirect here.
Keep reading
Sources
- YouTube cookie information — Applies only after a video iframe loads.
- Google ad settings — Personalized advertising controls.
- Microsoft privacy statement — Covers the Microsoft Clarity session-replay tag.
- Clarity FAQ — What Clarity records and how it masks content.
- Adsterra privacy policy — Covers the two ad units the site loads after consent.
- Adsterra cookies policy — What the ad network stores and how to contact it.
- Adsterra publisher help: no ads.txt — Why /ads.txt is not published for these units.
Checked 2026-10-06.