COOKIES
The castle needs nothing of yours to run. It is ten rooms of ASCII and a canvas, and it works exactly the same whether you answer yes or no to everything on this page. What follows is the whole of what is stored, what would be sent, and who would get it.
The short version
There is one optional thing here: Google Analytics, which counts how far up the castle people get. It is off until you accept it. Not loaded-and-told-to-be-quiet — not loaded: while the answer is no or unanswered, no script is fetched from Google, no analytics cookie is written, and no request goes anywhere. That is the whole of what the banner is asking.
Everything else the game remembers — your best room, your retry count, whether you muted it — is kept in your own browser, is never sent anywhere, and is not a cookie. It is there because a game that forgets your best room every time you open it is a worse game.
What is stored either way
Four keys in localStorage, on your machine, in this browser.
They are never transmitted, they are not readable by any other site, and
clearing your site data removes them.
castleOfRage.best | the highest room you have reached |
|---|---|
castleOfRage.retries | how many runs this browser has lost |
castleOfRage.muted | whether you turned the sound off |
castleOfRage.consent | your answer to the question on this page: accepted or declined |
The consent key is the odd one out only in what it is for. It is the record of what you told us, it is what stops you being asked again, and it is what every analytics call checks before it is allowed to go anywhere. If your browser will not give the game storage at all — private mode, or storage switched off — nothing is remembered and the question is simply asked again, which is the safe way round.
Nothing about how you actually play is stored. Which traps you have sprung, what the chests gave you and what the banners said all live in the tab for the length of the run and are then gone.
What analytics adds, if you accept it
Google Analytics 4, property G-HH7JCYTV12,
loaded from googletagmanager.com. Google is the processor
for it and their own terms and privacy policy apply to what they hold;
see Google's privacy policy.
It sets its own cookies on this site:
_ga | Google's own randomly generated visitor id, so a second visit is not counted as a second person. Two years. |
|---|---|
_ga_HH7JCYTV12 | the session state for this property — whether this is a new visit or a continuing one. Two years. |
Alongside those, Google receives what any web request tells it: your IP address (which GA4 shortens and does not store), your browser and operating system, and the page you were on. Those are Google's doing and not ours — ours is the list below.
The events the game itself sends
Six. Five of them are off the game's own lifecycle and the sixth is a
press of one of the share buttons under the game. This is the entire
list; the code that sends them is js/analytics.d9e9de82.js and it
is a short, readable file.
run_start | a run began |
|---|---|
level_start | a room was reached, with the room number and how the run was going when you got there |
level_death | one death, and which trap did it |
level_end | a room was left — by its door, by the last heart, or by a chest sending you back to room 1 |
run_end | the run ended, in defeat or in victory |
share | one of the share buttons under the game was pressed, and which platform it was — never a word of what was actually posted |
Every value carried by those is a room number, a count of deaths, a duration in seconds, or one word out of a fixed list — the same shape of thing the HUD already shows you while you play. There are no identifiers of ours, no key presses, no free text, no account, no sign-in, and nothing that describes you rather than the run. The question it exists to answer is which room a run usually ends in, and that is the only question it can answer.
The share buttons themselves are worth being plain about, because they are the kind of thing that usually is not. They are ordinary links to each platform's own compose page: no buttons loaded from Facebook or X, no scripts from any of them, no cookies of theirs, and nothing at all contacted until you press one — at which point you have chosen to open that platform, and what you write there is between you and them. The line the button puts in the box for you says how far up the castle you have got, which is read out of this browser and sent nowhere but the window you are posting from.
You can read the exact list of what the game decided to send, at any
time and whatever you answered, by opening the browser console on the
game and typing game.analytics.log. That log stays in the
tab. When the answer is no it is the only place the events go.
What there is none of
No advertising, no ad network, no remarketing, no profiling, no fingerprinting, no social buttons, no embeds, no A/B tooling, no session recording, no heatmaps, and nothing sold or shared with anyone. The game makes no money and there is nothing here trying to. The only third party named on this page is Google, and only if you accept the box below.
Your choice
It takes effect immediately, in both directions. Declining after having
accepted also expires the _ga cookies on this site and
switches the tag off for the rest of the page, so the change is not
waiting on a reload. The same two buttons are in the game, under the
ⓘ beside the controls line, so you never have to come back here to
change your mind.
With JavaScript switched off, nothing on this page works — and neither does the analytics, or the game.
Castle of Rage is a free browser game with no accounts and no money in it.
The source is at
github.com/haghdk/ragegame,
including every line described above — js/consent.c6224f03.js is
the gate and js/analytics.d9e9de82.js is everything that would be sent.