Cookie Policy
1. A cookie and localStorage are not the same thing
A cookie is a small file your browser sends back to a server with every single request, which is what makes it useful for tracking. localStorage is a note your browser keeps to itself: it stays on your device, it is never attached to a request, and no server ever receives it unless a script reads it and deliberately sends it somewhere. The sites' own entries are never sent anywhere; after you press Accept, Zaraz sends its one entry (section 3) with each measurement.
So why does the banner say "cookie"? Because that is the word everyone knows, and because the law that matters here does not care about the difference: the EU ePrivacy rules, and Germany's TDDDG, cover any storage of or access to information on your device, cookie or not. The same consent is required either way, and it is asked for either way. This page uses the accurate word for each thing so you can check the claim yourself in your browser's developer tools.
2. What these sites store on your device
This is the complete list of what the thirteen sites write themselves, checked against the files on 17 September 2026. Every entry is localStorage, not a cookie. None of it contains personal data: a consent record is a choice, a timestamp and the version of the policy it answered, and a theme key is a display preference. The cookies that Cloudflare Zaraz sets after Accept are listed in section 3.
| Site | Key | Type | What it holds | How long |
|---|---|---|---|---|
| vikataylor.com, steamquest.vikataylor.com, claude-design-vs-lovable-vs-v0.vikataylor.com | vt_consent |
localStorage | Your banner choice, when you made it and the policy version: {choice:'granted'|'denied', ts:<epoch ms>, v:'2026-09-17'} |
180 days, or until the policy changes in a way that needs a new answer, then you are asked again |
| claude-design-vs-lovable-vs-v0.vikataylor.com | vt-theme |
localStorage | 'light' or 'dark': which theme you picked with the toggle |
Until you clear it |
| mood-palette-generator.vikataylor.com, moodpalette-prompts.vikataylor.com | mp_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| fable-vs-opus.vikataylor.com | fvo_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| 3d-scroll-prompts.vikataylor.com | p3d_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| opal.vikataylor.com | opal_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| kurogane.vikataylor.com | ku_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| prompt-kurogane.vikataylor.com | pk_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| skystreets.vikataylor.com | ss_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| globe.vikataylor.com | gl_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
| fatcat.vikataylor.com | fc_consent |
localStorage | Same: choice, timestamp and policy version | 180 days, or until the policy changes |
Until 12 September 2026 this page said that globe and fatcat store nothing and carry no banner. That was true of their earlier builds. Both now carry the same banner, the same key and the same analytics as the rest of the network, so the two keys are listed above rather than the change being made quietly.
That is the entire list. There is no advertising storage, no retargeting pixel, no affiliate tracking, no A/B testing, no session recording, no heatmap, no chat widget and no CAPTCHA on any of these sites. If JavaScript is switched off in your browser, the banner never appears, nothing is stored and no analytics can load.
One thing that is not device storage but should be said anyway: these pages are served through Cloudflare, which receives your IP address and request metadata and keeps them in server logs. That happens before and regardless of consent, because it is how the connection is made at all. It is a server-side log, not something written to your device. The Privacy Policy covers it.
3. What can be set once you agree
Two services can place storage in your browser, and only after a deliberate act by you. For Zaraz the names and lifetimes are listed, because they were read in a browser; for YouTube they are described by purpose, because YouTube sets and changes them on its own.
| Set by | Only after | Purpose | What we can honestly say |
|---|---|---|---|
| Cloudflare Zaraz (Cloudflare, Inc.), for Google Analytics 4 (Google LLC) | You press Accept on the banner | Counting visits: telling one browser apart from another and one session from another, so page views and traffic sources can be measured without counting the same visit twice | Three cookies, set for vikataylor.com and marked HttpOnly:
cfz_google-analytics_v4 (the random analytics ID with a session number and
engagement counters, one year), cfzs_google-analytics_v4 (page views in the
current session, until you close the browser) and cf_zaraz_client (Zaraz's own
working cookie, empty each time it was checked, one year), plus one localStorage entry on
the site where you accepted, _zaraz_google_consent_update (analytics allowed,
advertising not, no identifier). Names and lifetimes were read in a browser on 17 September 2026;
Cloudflare can change them, and this table will follow. Before you press Accept, Zaraz
does not run on the page and none of this exists. Zaraz sends the measurements to Google
from Cloudflare's servers, for our measurement ID G-VFPV5MZNL2, so your
browser makes no request to Google. Google states that in Analytics 4 “IP masking
is not necessary since IP addresses are not logged or stored”
(Google
Analytics Help, IP masking in Google Analytics).
Policies: cloudflare.com/privacypolicy, policies.google.com/privacy. |
| YouTube (Google LLC) | You press play on an embedded video | Playing the video, remembering playback settings, and measuring viewing on Google's side | Eleven sites embed a video: the Claude Design comparison, Fable vs Opus, 3D Scroll Prompts, the Kurogane prompt pack, the Kurogane demo, OPAL, Steam Quest, Moodpalette, the Moodpalette build prompts, the Fat Cat Dumplings demo and the Sky Streets demo. Until you press play there is no player on the page, only a local thumbnail, and nothing is requested from any Google host. The player then loads from youtube-nocookie.com, which limits storage until playback begins, but once it begins YouTube receives your IP address and may store data in your browser under its own rules. Every one of those pages also offers a plain link to youtube.com instead, which keeps the embed off the page entirely. |
Note the asymmetry, because it is deliberate: pressing Accept does not load the video, and pressing play does not turn on analytics. They are two separate decisions and you can make them differently.
4. Giving, refusing and withdrawing consent
A banner appears shortly after the page has loaded, on your first visit to each site. It has two buttons and neither is pre-selected:
- Accept starts Cloudflare Zaraz, which runs Google Analytics and sets the storage listed in section 3.
- Decline starts nothing. Zaraz does not run, so there is nothing to switch off afterwards.
Ignoring the banner has the same practical effect as declining: nothing loads until you press Accept. Your answer is written to localStorage under the key listed in section 2, so you are not asked on every page. You are asked again after 180 days, and also when this policy changes in a way that needs a new answer, as it did in September 2026, when the analytics moved to Zaraz.
Changing your mind is as easy as the first choice. Every page on every one of these sites has a Cookie settings button in its footer, including this one. It reopens the same banner with the same two buttons, and the choice you make replaces the stored one. Withdrawing is exactly as easy as giving consent, which is what the GDPR requires and not merely what it recommends.
What Decline actually does, so that sentence is checkable rather than
decorative. If analytics was never switched on, nothing runs and there is nothing to stop. If
you had pressed Accept earlier, then the moment you press Decline, on that page and without a
reload, the site stops sending anything to Zaraz, including its own events and the timing Zaraz
reports when a page is hidden, and deletes the _zaraz_ entry. From the next page on,
Zaraz does not start at all. The cookies _ga, _ga_*, _gid
and _gat* and the storage entry _gcl_ls, left by the earlier set-up,
are deleted too.
Two limits that remain, stated rather than papered over. Measurements already sent before you changed your mind are in Google's systems and cannot be recalled from here. And the Zaraz cookies are HttpOnly, so no page can delete them: they stay until they expire or until you clear them (section 6), but a site where your choice is Decline does not run Zaraz, so nothing there reads them.
5. Your choice is stored per site, the analytics cookies are shared
Browsers keep localStorage separately for every origin, and these thirteen sites are thirteen origins. So the record of your choice lives on the subdomain where you made it, and it is not shared with the others. In practice: if you decline on vikataylor.com and then open 3d-scroll-prompts.vikataylor.com, the banner asks you again there.
That is deliberate. Accepting on one site should not switch analytics on for twelve others, and remembering a refusal does not need a cookie across the whole network. Being asked on each site is the price of that.
The analytics cookies work the other way. Zaraz sets them for vikataylor.com, so all thirteen sites share them, and if you have pressed Accept on several of the sites, Google Analytics sees the same random ID on each of them. On a site where you have not pressed Accept, Zaraz does not run, so nothing is counted there, whatever you chose elsewhere.
6. Clearing it yourself in the browser
Everything described here can be removed by you at any time, without asking us, and nothing here can stop you.
- For one site: open the padlock or the icon next to the address bar while you are on the page, and use the option to clear cookies and site data for that site. That removes our localStorage entry for that site. The analytics cookies belong to vikataylor.com, so to remove them, do the same on vikataylor.com, or clear everything stored for that domain.
- For everything: in your browser's settings, under privacy, there is a section for cookies and site data with a clear-all option and per-site controls. The exact wording differs between Chrome, Safari, Firefox and Edge, and it moves between versions, so use the search box in settings for "cookies" rather than trusting a menu path printed here.
- Block it in advance: browsers can refuse third-party cookies outright, and a private or incognito window discards all of it when you close the window.
What clearing does on the next visit: the consent record is gone, so the banner will ask you again. On the Claude Design comparison, the theme you picked goes with it and the page returns to its default. Nothing else is lost, because nothing else is stored.
7. What you give up by declining: nothing
Declining costs you no functionality whatsoever. Every page reads the same, every prompt is fully visible and copyable, Moodpalette generates palettes exactly as before, because its colour engine is rule-based and runs entirely in your browser with no server call. No content is behind the banner, no feature is degraded, and there is no second banner nagging you later in the session.
The one difference is that visits are not counted in analytics, which affects only what we can see about traffic, not what you can do. Videos still work too: press play, or use the plain YouTube link if you would rather not load an embed at all.
8. Changes, and who to ask
If a site starts using something that stores data on your device, this page and the tables above are updated before it ships, and the date at the top changes. There is no mailing list to announce it, so this page is the record.
Questions about anything on this page, including a request to see exactly what a site writes to your browser: vika.taylor.one@gmail.com. That address is the only channel that exists. The wider picture, including legal bases, transfers outside the EEA and your rights, is in the Privacy Policy; the terms on which all this is published are in the Terms of Use.