Updated: 6 November 2026
Google Analytics analyses how visitors use this website. Google Ads measures advertising performance and attributes website actions, such as registrations and purchases, to ads. Meta is a separate choice for advertising measurement and personalisation. Each optional purpose starts only after a valid choice and the applicable eligibility checks. Google ad personalisation remains off.
Selected providers may receive page addresses, activity events, browser and device information, IP addresses, and Cookie or other identifiers. Processing may take place outside your country, including in the United States. The applicable purposes, provider terms and transfer arrangements described in this Policy still apply.
Where the relevant Google features are configured, the required provider terms have been accepted and applicable permissions obtained, the Google tag may automatically identify email addresses, telephone numbers, names or postal addresses you submit on this website. These data may be normalised and hashed before being sent to Google for matching and enhanced conversion measurement. Hashing does not make data anonymous. Our custom website event parameters do not explicitly include contact details; this is separate from automatic processing by the Google tag.
You can accept, reject or select optional purposes separately and change or withdraw your choice in Cookie Preferences in the footer. Withdrawal stops future optional collection for the withdrawn purposes; it does not recall information already transmitted or automatically delete a provider’s existing records. Those records remain subject to the Privacy Policy and applicable rights.
Optional Google Analytics, Google Ads measurement and Meta tools use prior consent across supported locations. On a new visit, none of these tools starts before you choose it. Accept all selects the available tools and starts them immediately where available, without another confirmation. This choice authorises the processing described here, including sending visit data to your selected providers outside your country, including the United States. Google provides contractual safeguards under its accepted Data Processing Terms. Meta incorporates applicable regional processing and transfer terms, including its Global Data Transfer Addendum. These safeguards apply within their contractual scope. Some locations remain restricted while we complete specific representative, guardian-consent, transfer-assessment, notification or localisation requirements. These locations currently include the EEA and United Kingdom, Brazil, Canada, mainland China, Indonesia, Israel, Kazakhstan, Macao, Malaysia, Mauritius, New Zealand, Nigeria, the Philippines, Russia, Saudi Arabia, South Africa, South Korea, Thailand, Türkiye, Uzbekistan and Vietnam. These are our current operational restrictions, rather than a restriction on visiting the website or playing the game. An unresolved IP location does not enable external tracking. We do not infer adulthood from a Cookie choice, and known-minor restrictions continue. Global Privacy Control blocks Google Ads and Meta advertising sharing. India remains subject to a review deadline of 1 May 2027 (India time); Christmas Island, the Cocos (Keeling) Islands and Norfolk Island remain subject to a review deadline of 30 November 2026 (00:00 UTC). Each choice can be withdrawn in Cookie Preferences.
With your advertising permission, our pages use Meta Pixel. Meta may receive activity from this site and elsewhere online, match it to a Meta account and combine it with other information to measure, target and deliver ads. You can prevent further sharing through this Pixel by turning off Meta in Cookie Preferences. This choice is independent of Google Analytics.
This Policy applies to https://cnc.skyvanillagames.com and related webpages operated by Sky Vanilla Pte. Ltd., incorporated in Singapore (“we”, “us” or “our”), that link to it. It explains the purposes, choices and management of cookies and similar technologies. Processing of personal information is also governed by the Privacy Policy. Mobile-game SDK processing is addressed separately in that Policy and relevant SDK notices.
1 Cookies and Similar Technologies
1. Cookies are small text records stored by a browser when you visit a website. They can maintain sessions, remember choices or recognise visits. Similar technologies include local storage, session storage, pixels, web beacons and identifiers. Device-access and data-protection rules may apply even where a technology is not called a Cookie.
2. First-party Cookies are set under our website domain; third-party Cookies are set under another service's domain. Session Cookies ordinarily expire with a session; persistent Cookies remain for their configured period unless deleted sooner.
3. Cookies may contain random identifiers and preferences that, together with IP addresses, activity and other information, can identify individuals. Absence of a name does not make every Cookie anonymous.
Technology and Retention Differences
1. Cookies follow domain and path rules and may accompany requests. localStorage can ordinarily be read on later visits to the same origin; sessionStorage is ordinarily associated with a browser-tab session. Pixels, tags and code may transmit events and personal data without traditional Cookies.
2. Ending a session, closing a page and closing a browser are not always the same event. Session restoration may preserve some session information. Persistent Cookies have expiry settings, while local storage ordinarily has no browser-managed expiry field. An application-level 180-day consent validity period does not guarantee physical deletion by the browser on day 180.
3. First-party and third-party describe setting and access relationships, not whether consent is necessary. First-party attribution may be optional tracking; third-party payment or security technology still requires a purpose-specific necessity assessment rather than classification by supplier name alone.
2 Categories and Purposes
1. Strictly necessary technologies are limited to purposes genuinely necessary for requested communications, session security, authentication, fraud prevention or privacy-choice storage. Consent exemptions apply only where legal conditions are met. Labelling a technology necessary does not exempt additional advertising or profiling purposes.
2. Preferences and functionality may remember language, territory, interface or selected features. Where not strictly necessary for an expressly requested service, they require the consent applicable law prescribes.
3. Analytics and performance technologies measure visits, interactions, errors and performance to improve the website. Obtain prior consent for device access where required. Any legally available exemption requires its actual scope, transparency and opt-out conditions and does not authorise advertising tracking.
4. Advertising and attribution technologies identify campaign sources, measure conversions, control frequency or personalise advertising. Obtain required consent and provide applicable sale, sharing and targeted-advertising opt-outs.
5. Embedded video, social features and external login may use similar technologies. A mere outbound link does not mean the platform's tracking loads on arrival at our website. Consent-dependent embeds should load after consent or a clearly explained activation choice.
6. These categories explain possible purposes, not deployment of every technology. The accompanying inventory must disclose actual names, providers, purposes and duration.
3 Technology Inventory
The records below identify website storage and measurement purposes. Provider-managed storage may vary with browser restrictions and provider configuration. Website choices do not automatically apply to the mobile game or an external checkout.
Google Analytics, Google Ads measurement and Meta are separate optional purposes. Google Tag Manager delivers the corresponding tags only after a valid eligible external-purpose choice; loading it sends a technical request to Google. Permission for one purpose does not grant another. See the purpose, data and choice explanations above and in the Privacy Policy.
Mobile SDK processing and website technologies are disclosed separately. Actual website use follows its own inventory.
4 Consent and Changing Choices
1. We do not set or read consent-dependent non-essential technologies before a valid choice. Consent must be specific, informed and freely given; preselected boxes, continued browsing, closing a notice or acceptance of service terms do not replace it.
2. You can accept all eligible options, reject optional processing, or select site counts, Google Analytics, Google Ads measurement and Meta separately. Opening settings or a displayed selection does not by itself activate optional tracking. Rejecting does not prevent ordinary browsing, registration or payment.
3. Reopen “Cookie Settings” in the footer to change or withdraw optional choices. Withdrawal must be as easy as consent. Contact cinderandcrowns@skyvanillagames.com if assistance is needed; an email address does not replace legally required immediate controls.
4. Withdrawal stops corresponding new non-essential access and processing. We expire or delete related storage where within our control and legally required. Further processing of previously collected information still needs a lawful basis; prior collection is not unlimited permission.
5. Material changes to technologies, purposes or recipients requiring renewed consent will be explained and, where applicable, consent obtained again.
How Website Controls Operate
1. Google Analytics, Google Ads measurement and Meta each require permission for their respective purpose. Eligible visitors may select Accept all once or choose purposes separately. Known minors remain excluded from external measurement. Regional restrictions apply independently of consent, and Global Privacy Control blocks Google Ads and Meta advertising sharing.
2. When choices are enabled, analytics and advertising attribution are recorded separately. Saving a new acceptance or refusal updates time and version; merely reopening settings does not renew consent. Missing, expired, malformed or incompatible-version records do not authorise tracking.
3. The current code checks choice changes across relevant tabs and when focus returns. If the browser blocks local storage, a temporary state may persist only on the current page. Later visits may require a new choice. Storage failure is not acceptance.
4. Withdrawal clears known optional records we can manage. If tracking was already loaded, the page refreshes to stop that code continuing. We cannot delete every independent third-party-domain record or recall transmitted data merely by clearing Cookies. Third-party settings and data-rights requests are separate processes.
5. Browser preferences do not automatically synchronise across all devices, the mobile game, email or third-party checkout. One browser's consent cannot be expanded to all products. Legally required account-associated opt-outs are implemented according to applicable law.
5 Browser and Device Controls
1. Browser settings ordinarily allow viewing or deleting Cookies, blocking third-party Cookies, restricting site storage and clearing browsing data. Disabling necessary session technology may impair login, payment or security functions.
2. Choices ordinarily relate to a browser and device. Switching devices or browsers, clearing storage or using private browsing may require new choices. Deleting a privacy preference is not consent to optional tracking.
3. Cookie blocking may not prevent pixels, server events, app SDKs or all other processing. Where law requires recognition of universal privacy controls or other opt-out signals, we implement them within their scope and consistently with website choices.
4. Rejecting our Cookies does not automatically delete data independently and lawfully held by third parties. Use their settings or privacy-rights routes for that information.
Available Control Steps
1. Locate our domain in browser privacy or site-data settings to delete Cookies and local storage or restrict third-party Cookies. Deleting necessary sessions may sign you out, require character reselection or reset functional state. Deleting consent records does not authorise optional tracking.
2. Operating-system advertising identifiers, app tracking permissions, browser blockers and extensions may reduce some processing but do not necessarily cover server logs, transactions or all mobile SDKs. Private browsing does not mean complete anonymity to websites or payment platforms.
3. Email subscriptions and application-level permissions have separate controls. Blocking remote images or browser cookies is not a substitute for unsubscribing from promotional email or exercising app privacy rights.
6 Retention Sharing and Transfers
1. Browser storage periods follow the inventory. Cookie expiry or deletion does not mean related server data immediately disappears. Server data follows Privacy Policy purposes and retention rules.
2. Necessary consent, refusal, withdrawal times and policy versions may be retained to prove and respect choices, not repurposed for advertising profiles.
3. Third-party receipt and international processing must be explained in the Privacy Policy and inventory and supported by applicable grounds and safeguards. Rejecting optional technologies does not prevent lawful processing genuinely necessary for a transaction you request.
7 Children and Policy Updates
1. Processing concerning known children follows the Privacy Policy's guardian requirements and age protections. Cookies or similar technologies are not used for behavioural or cross-context advertising tracking of known children.
The Cookie banner asks for tracking preferences. Selecting Accept all does not declare an age or give guardian permission. We use IP location to determine the applicable regional settings. Where we know a visitor is a minor, we do not enable Google Analytics, Google Ads or Meta measurement for that visitor.
2. We update this Policy and inventory with actual technical changes, version and effective dates and legally required notices of material changes. Updating text does not replace technical controls or consent.
3. Contact cinderandcrowns@skyvanillagames.com about Cookies, choices or data rights, using “Cookie or Privacy Request”.
Appendix 1 Storage Types and Data Flows
1. Session credentials. Where login is actually provided, random tokens may maintain requested authenticated sessions, validate requests and prevent hijacking. Limit validity, access and transmission. Tokens must not support unrelated advertising profiles and should expire on logout or revocation under actual security mechanisms.
2. Privacy choices. Version, categories, acceptance or refusal, time and necessary identifiers may be retained to honour choices and demonstrate compliance. Storage necessary solely for choice management may qualify for an exemption, but its duration and scope still require disclosure and it must not become an advertising identifier.
3. Language and territory. Language pages may use URL paths without setting preference Cookies. Additional remembered choices must be classified by necessity and local law; not every convenience feature is strictly necessary.
4. Security and load balancing. Malicious-traffic prevention, necessary connectivity, anti-fraud and balancing must stay within actual necessity. A security provider's own marketing, cross-site tracking or independent purposes do not automatically share the security exemption.
5. Analytics. First-party, third-party, aggregated or nameless processing does not alone establish an exemption. Check actual device access, identifier duration, cross-service linkage and statutory conditions.
6. Advertising and conversion. Pixels may send events at load, click, submission or purchase. Server-side conversions may disclose personal data without third-party Cookies. Applicable choices should cover device and server events for the same purpose.
7. Video and social embeds. A local preview with a clear activation control may be shown before external loading, explaining recipients and data where required. Outbound navigation and an embedded component have different flows that need distinct explanations.
8. Local and session storage may retain function state, preferences or consent. Include keys, purposes and retention behaviour in the same inventory. Absence of a Cookie expiry field does not permit indefinite retention or remove consent requirements.
9. Caches and service workers. Where used for offline access or performance, explain relevant content and personal data. Necessary caching and advertising tracking are not equivalent because they share a script. Technical communications mechanisms need not be mislabelled as marketing Cookies, but actual purpose must be checked.
10. Fingerprinting and link identifiers. Combined browser features, advertising URL parameters, hashed emails and substitute identifiers may still involve device access, identification or sharing. Removing Cookies does not remove applicable law or user choices.
Appendix 2 Specific Technology Records
The following inventory describes the website deployment. Provider privacy information: Google — https://policies.google.com/privacy; Meta — https://www.facebook.com/privacy/policy/. External checkout and mobile-app providers have separate notices.
Record 1 Website Login Session
Name: cnc_store. Type: first-party Cookie. Host: cnc.skyvanillagames.com, without a cross-subdomain Domain attribute. Provider: Sky Vanilla Pte. Ltd. Purpose: maintain website top-up login and the selected game character. Content: random session token, with account and character information linked server-side. Browser duration: seven days; deleted on logout. Production configuration uses HttpOnly, Secure and SameSite=Lax. Limited to requested login functionality.
Record 2 Cookie Choice
Name: cc_consent:<policy version> (earlier versions used cc_consent). Type: same-origin localStorage. Provider: Sky Vanilla Pte. Ltd. Stores purpose choices, policy version, country-policy context and timestamp. Valid for up to 180 days; the browser record itself has no automatic expiry. Invalid, expired or incompatible choices cannot authorise external tracking.
Record 3 Campaign Attribution
Name: cnc_attr. Type: first-party Cookie. Provider: Sky Vanilla Pte. Ltd. Maximum browser duration: 90 days. Where the corresponding consented attribution feature is active, it retains campaign-source information from permitted landing parameters for attribution. Refusal or withdrawal clears the controllable attribution Cookie. This is not necessary login storage.
Record 4 Guide Likes
Name: cnc-guide-liked. Type: same-origin localStorage. Provider: Sky Vanilla Pte. Ltd. Content: identifiers of liked guides. Purpose: show liked status. The current code sets no automatic expiry; the record remains until site-data deletion or application modification. Separate server-side deduplication exists; clearing local identifiers does not delete server records.
Record 5 Google Analytics, Google Ads and Tag Management
Google Analytics 4 (G-50JSN5J0H0), Google Ads (AW-18344217213) and Google Tag Manager (GTM-KL9DNNZL) support the separately selected website analysis, advertising measurement and tag delivery purposes. Google Analytics may set _ga and _ga_<identifier> first-party Cookies to distinguish browsers and sessions; Google defaults can retain these for up to two years, subject to configured shorter periods and browser limits. Website permission expires earlier after 180 days and is checked separately. Google Signals and Google ad personalisation remain off. Google Ads measurement requires its separate eligible purpose; its configuration and available conversion actions determine attribution. Listing it here does not mean that every registration or purchase conversion is configured or attributed. Loading GTM sends a technical request to Google and is gated behind an eligible external-purpose choice. Analytics permission does not grant Google Ads or Meta permission.
Record 6 Other Embeds and Checkout Technologies
Meta Pixel (1039949628510357) is used only with eligible Meta permission. It can set _fbp and _fbc first-party Cookies, ordinarily for up to 90 days, subject to browser limits and provider configuration. It processes permitted views and action/conversion events, browser and device information, and page addresses. The Meta account enables automatic advanced matching and additional page and product details. Our website requests that the Pixel disable automatic configuration and does not explicitly pass registration email addresses or telephone numbers to the Pixel. The same-origin localStorage keys cnc_meta_purchases and cnc_meta_receipts retain at most 500 event references each to prevent duplicate measurement; they have no browser-managed expiry and are cleared when Meta permission is withdrawn. Global Privacy Control blocks Meta advertising sharing.
Further Inventory Details
1. cnc-guide-liked stores the guide identifiers you have chosen to like, to remember that requested action. It is not an advertising identifier. It remains until site-data deletion or application removal; it has no automatic browser expiry.
2. cnc_store browser duration is distinct from server-session and accounting retention. Consent validity does not guarantee physical browser deletion at day 180. Cookie expiry does not automatically delete server records.
3. Pending consented registration events may use sessionStorage for a short handoff between website pages; the application accepts them for no more than two minutes and consumes or discards them when read. Closing the tab normally clears sessionStorage. A restored browser session can preserve it, but cannot extend event validity.
4. Tools absent from the actual inventory are not represented as deployed or consented to. New tools require actual modules, domains, purposes, recipients and durations to be disclosed; similar supplier names or analytics functions do not justify reusing old permission.
5. Site improvement counts use no measurement Cookie or cross-page visitor identifier. Daily aggregate counts and limited action categories are retained for 90 days and can be disabled in Cookie Preferences. They do not store IP, account, email, complete URL or advertising identifiers in the count table. Necessary request/security processing remains separate.
Appendix 3 Consent Management and Withdrawal
1. Consent-dependent optional technologies remain off until a valid initial choice. Users must be able to reject non-essential items or choose by category. Acceptance and refusal should be clear and usable, without misleading buttons, obstruction or repeated pressure.
2. Show names, categories, providers and durations according to actual purposes. A generic “partners” label without required details is insufficient. Choices must be sufficiently purpose-specific.
3. Record choices, time, applicable policy and inventory versions and only necessary device or session association. Limit access and retention and use these records solely to demonstrate and implement choices.
4. Do not immediately and repeatedly prompt after rejection unless validity expires, important purposes change or another lawful reason applies. Clearing storage, logging in again or introducing a version does not automatically convert refusal to consent.
5. Footer withdrawal stops corresponding new reads and writes, updates controlled provider settings and deletes or expires controllable identifiers as legally required. Historic data deletion, restriction or retention on another basis follows its purpose and privacy rights.
6. Browser deletion and restrictions remain available. If old choices become unrecognisable, consent-dependent items remain unconsented by default. Missing refusal records are not acceptance.
7. If choices can lawfully be linked to an account, explain their browser, device and account scope. Do not promise cross-device synchronisation without implementation. Logged-out choices operate within actual identifiable scope.
8. Where we cannot directly erase independent third-party storage, explain our control limits and relevant settings or rights routes. We must still stop further disclosure that an effective refusal prohibits.
Consent Evidence and Tag Changes
1. We use the saved choice and policy version to respect browser choices. Contact the privacy address for questions about records of a choice. The browser preference does not establish consent for another device, mobile application or independent provider.
2. Reassess new tags, server forwarding, advertising links, audiences or purposes against existing choices. Analytics-only consent cannot permit advertising data through a container. Server-side event replay must not bypass expiry or withdrawal.
3. Document actual purposes and conditions for necessity or other lawful exemptions. Extra marketing purposes do not inherit the exemption. Separate mixed necessary and optional processing or obtain the required consent.
Appendix 4 Regional Requirements and Exceptions
1. EEA, UK and other consent-dependent device access follows effective local rules. Assess strict necessity and other explicit exceptions individually. Legitimate interests, analytics or anonymisation are not universal device-access exemptions.
2. US state sale, sharing and targeted-advertising opt-outs differ from Cookie consent. Recognise valid GPC and other required signals for websites and identifiable accounts where applicable. Do not require purchase, account creation or unlawful verification burdens first.
3. Known children receive stricter tracking and advertising protection under the Privacy Policy. Guardian acceptance of service terms does not enable every advertising partner's child tracking.
4. “Cookieless” or server-only analytics can still process personal data. Technologies exempt from consent may still require transparency, purpose limits, retention controls and security.
5. Before adding purposes, recipients or linkages beyond an exemption, reassess the basis and obtain effective consent where necessary.
Appendix 5 Changes and Contact
1. Keep the inventory aligned with actual configuration, versions and effective dates; remove discontinued technologies and explain identifier expiry. Shorter retention, discontinued purposes and new providers must be reflected in actual records, not just page text.
2. Clearly notify users and obtain necessary consent before material changes requiring a new choice. Adding a name to the policy does not substitute for that choice.
3. Contact cinderandcrowns@skyvanillagames.com for explanations, withdrawal or rights requests. Email does not replace legally required real-time settings or automatic signal handling.
Website measurement choices and game access
The game permits minors where local law and game ratings allow, with guardian authorisation where required. Website measurement choices apply only to optional tracking on this website.
For eligible visitors, Accept all permits the available Google Analytics usage analysis, Google Ads measurement and Meta advertising purposes. Each purpose starts only with a valid choice and the applicable regional eligibility. Known minors remain excluded from external measurement, and Global Privacy Control blocks Google Ads and Meta advertising sharing. You can reject optional tracking, select purposes separately, or withdraw your choice in Cookie Preferences.
Game registration, purchases and legally required guardian verification follow their own procedures. A Cookie choice does not establish age, contractual capacity or guardian permission. Where required protections are unavailable, the affected registration, purchase or processing must remain restricted.
Purpose choices are valid for up to 180 days and may be changed or withdrawn in Cookie Preferences. Missing, expired, malformed or incompatible records do not authorise external measurement. This choice does not require a birth date or guardian details.