Cookie Notice

The EveryLaunch and Orbitburn websites use Google Analytics 4, which sets two first-party cookies, and Google AdSense, which sets advertising cookies from Google’s own domains. They also keep a few small values in your browser’s own storage: your consent choice, whether your account is ad-free, your cart, your sign-in session if you created one, and the browser game’s save if you opened it. Each domain keeps its own, so a choice made on one doesn’t carry to the other. Where we estimate you are in the EEA, the UK or Switzerland you are asked before the first ad or analytics request and neither loads until you answer; everywhere else they start with the page and the cookie settings control switches them off the moment you use it. Either way, answering Reject all switches advertising to non-personalised rather than switching the site off, and it takes one press, the same as accepting. Images served directly by other hosts, and Shopify’s checkout, can set their own cookies. Last updated 10 November 2026.

What this notice covers

A cookie is a small file a site asks your browser to keep and hand back on every later request. Related technologies do a similar job by other means: local storage, session storage, IndexedDB, and pixels. This notice covers all of them.

It applies to both websites: www.everylaunch.space, which is EveryLaunch, and www.orbitburn.space, which is the Orbitburn home page and browser game. Other domains we own only redirect to one of those two. The Orbitburn Android app does not use cookies at all. It uses device identifiers, which are described in the Privacy Policy.

One distinction runs through everything below. Local storage is not a cookie. A cookie is attached to every request your browser makes to the domain that set it, which is what makes cookies useful for tracking. A local-storage value sits on your device, can be read only by pages on the domain that wrote it, and is never attached to anything by itself. Code has to read it and send it on purpose. Where these sites do that, the section below says so. It is also why www.everylaunch.space and www.orbitburn.space can’t see each other’s storage, even though one service runs both.

Strictly necessary cookies

None for visitors. Pages are delivered without session state, so there is no login cookie, no CSRF cookie and no cart cookie to set. The one cookie this site’s own server can set is the session for its private owner console, which is behind a password and is not set for anyone else.

Your consent choice

When the site needs your answer about advertising and analytics, it asks once and then records what you chose, so it does not ask again on every page. That record is a single value in your browser’s local storage (deltav.consent.v1) holding the answer you gave and when you gave it. It is essential in the strict sense, because without it the only way to honour your choice would be to ask again constantly. It is stored on your device rather than as a cookie.

Each domain keeps its own record. A choice made on www.everylaunch.space doesn’t carry to www.orbitburn.space, or the other way round, so you may be asked on each. Changing your answer on one leaves the other as it was.

The record is treated as expired twelve months after you made it. When that happens the request comes back and you answer again, because a consent given a year ago is not evidence of a preference held today. Clearing site data has the same effect immediately.

Your answer is passed to Google using its consent signals, so Google is told what you allowed rather than being left to assume. Every page starts with those signals set to denied, before any advertising or analytics code is allowed to run. They are raised by a stored answer, by a choice you have just made, or, outside the EEA, the UK and Switzerland as we estimate them, by default on arrival if you have not answered.

The ad-free entitlement cache

Owners of Comms Silence in the Orbitburn Android app can sign in to remove ads from the websites as well, as described on the ad-free page. A sign-in counts on the domain where you made it. Signing in on www.everylaunch.space removes ads there. To remove them on www.orbitburn.space, including around the browser game, sign in on that domain’s ad-free page too. The Android app is separate and isn’t affected by either. A Velocity Pass removes ads in the app only, because the app keeps subscription status out of the cloud save the websites read. Two things are stored in your browser, on the domain where you sign in:

• The sign-in session. Firebase Authentication keeps your Google sign-in token in that domain’s local storage or IndexedDB so you are not asked to sign in on every visit. It is sent to Google’s Firebase servers when the page reads your save. Google also sets its own cookies on its own sign-in domain during the sign-in itself, which is Google’s processing rather than ours.
• The entitlement cache (dv.entitlement.v1). Your account identifier, email address and display name, whether the account is ad-free, and the time that was last checked. The site re-checks no more often than every 12 hours. This exists for speed: it means a returning ad-free visitor gets an ad-free page without the sign-in code being loaded at all. A short-lived marker (dv.account.redirect.v1) is also kept while a sign-in redirect is in progress.

Both are removed when you sign out, and both go when you clear site data for that domain. Neither is a cookie, and the cache is not sent to our servers. What the sign-in reads, and what it does not, is set out in full on the ad-free page.

The cart and the browser game

The cart. Once you add something to the cart, its Shopify identifier is kept in local storage (deltav.cart.v1) so the cart survives a reload. On later page loads our server sends that identifier to Shopify to read the cart back. It is not sent to Google.

The browser game. Pressing LAUNCH or FULLSCREEN on the play page stores more, on www.orbitburn.space. That domain keeps its own consent choice and its own storage, separate from www.everylaunch.space. The game keeps its save (astrodrift.save.v2) and its render settings in local storage, its files in a service-worker cache so it can start quickly, and an anonymous Firebase session with its random ID in IndexedDB. That session is used to back the save and your leaderboard scores up online, as the Privacy Policy describes. Clearing site data for www.orbitburn.space deletes the local copy of your browser save.

Analytics

Both websites use Google Analytics 4. It records which pages you visit and where you came from, which products you view, add to a cart or begin checking out with, and that you started the browser game. It does not receive your name, your email address or your payment details from this site. Those exist only at Shopify’s checkout, which is a separate company and a separate page.

• _ga: a random identifier that tells one browser from another, so visits can be counted. Lasts up to two years by default.
• _ga_<id>: keeps the state of your current session. Lasts up to two years by default.

Where we estimate you are in the EEA, the UK or Switzerland, or your device’s time zone tells us nothing about your location, it loads only after you have accepted. Elsewhere it loads on arrival, because the site treats that as implied consent. We estimate your region from your device's time zone, with no IP lookup, so the estimate can be wrong for a traveller or a VPN user. The cookie settings control works everywhere.

If you reject, no measurement script is requested on any later page, and _ga and _ga_<id> are removed. If the script had already loaded on the page you are on, it is told to stop sending. A reject does not stop everything reaching Google, because non-personalised ad requests continue, as described below.

The Orbitburn app is a separate matter: it uses Firebase Analytics, which works from device identifiers rather than cookies.

Advertising cookies

Advertising on both websites is served by Google AdSense. It sets its cookies on Google’s domains, and it is, along with analytics, the reason the site asks you anything. Partner links wait for the same answer, though they load nothing from the partner until you click one.

Where we estimate you are in the EEA, the UK or Switzerland, no ad loads before you answer. The AdSense script is not requested and no advertising cookie is set until a consent choice exists. The same applies when your device’s time zone tells us nothing about your location. The request appears on your first visit, as Google’s EU user consent policy requires, and every consent signal stays at denied until you answer it. Accept and reject sit side by side, the same size, one press each. Dismissing the request without choosing records nothing at all. Because nothing was recorded, no advertising loads on that visit and the request returns on the next one. This is an estimate from your time zone, not a check of where you are.

Everywhere else, advertising starts with the page. Outside those countries the site treats personalised advertising as permitted until you say otherwise, so Google may set its advertising cookies on your first visit without asking first. The control is still yours and it is not buried: open cookie settings from the site footer, choose Reject all, and personalisation stops immediately and stays off across visits. Nothing about switching it off is slower or harder than leaving it on.

If you accept, Google may set cookies from its own domains to select an ad, cap how often you see it, measure whether it worked, and detect click fraud, and it may use them to personalise what you are shown. Those cookies are set and read by Google, not by us, and their contents are not available to this site. What Google does with them is described in Google’s advertising technologies notice.

If you reject, advertising runs in non-personalised mode. Ads are chosen from the page you are on rather than from any profile of you, and no profile is built from your visit. Google may still store a limited amount of information for frequency capping, aggregated reporting and fraud prevention, because a non-personalised ad is still an ad request. Cookies of its own, such as IDE and test_cookie, can be set or remain on Google’s domains. This site cannot delete those. You can clear them in your browser settings.

Ads are removed entirely for anyone signed in with an account whose Orbitburn cloud save carries Comms Silence, on the domain where they signed in. There, no AdSense script is loaded and the question of advertising cookies does not arise. See the ad-free page. Advertising is also covered from the data-protection side in the Privacy Policy.

Paid links and images from other hosts

Amazon and CJ links are ordinary outbound links. Nothing from Amazon, CJ or an advertiser loads on our pages before you click, so they set no cookies here. After a click you are on their site, or passing through their tracking host, where they and the advertiser may set or read cookies under their own policies. See the Privacy Policy for what they receive and how to opt out.

Some images are fetched directly from the host that publishes them, and that host can set a cookie of its own on its own domain when it serves one. These requests are not held back by the consent request, so they can happen before you answer it. Blocking third-party cookies in your browser stops those cookies without affecting anything on this site.

Shopify checkout

Depot product pages are served by us and set no cookies of ours. Pressing checkout sends you to Shopify’s hosted checkout on a Shopify domain, where Shopify sets the cookies it needs to hold your cart, run fraud checks and complete the payment. Those cookies belong to that site and are governed by Shopify’s cookie policy. Refusing them means checkout cannot function, which is a Shopify matter rather than one this notice can resolve.

Changing or withdrawing your choice

Your consent choice is not final and withdrawing it is meant to be as easy as giving it. Nothing on either website depends on an optional cookie, so you can refuse them all without losing a feature. Each domain has its own choice, so use the controls below on each one.

• Use the cookie settings control in the footer. Both domains have one. It reopens the same two choices with the same weight, and the new answer takes effect immediately, including switching personalised advertising back off and telling Google so.
• Clear site data for a domain. That removes what the domain stored: the consent choice, the entitlement cache and the sign-in session, plus the cart on www.everylaunch.space or the local copy of your browser game save on www.orbitburn.space. The consent request appears again on your next visit if your region calls for it. Clearing one domain leaves the other as it was.
• Turn off ad personalisation at Google Ad Settings, which applies across every site you visit rather than this one alone.
• Opt out of Google Analytics everywhere with Google’s opt-out browser add-on.
• Block third-party cookies in your browser settings. Every major browser has this control, usually under Privacy or Site settings, and it can be applied to these sites alone.
• Use a content blocker, which prevents the advertising script loading in the first place.
• Use the industry opt-out tools: YourAdChoices in the United States, or Your Online Choices in Europe.

On Android, you can also reset or delete your advertising identifier under Settings → Google → Ads, which breaks the link between your device and any advertising profile built from it. The in-app consent answer is changed separately, under Settings → AD PRIVACY SETTINGS inside Orbitburn.

Common questions

Changes to this notice

This notice is updated whenever the inventory above changes, such as a new cookie, a new stored value or a new category. The revision date in the rail at the top of the page is the version you are reading. For anything broader about how data is handled, see the Privacy Policy; for the rules of using the service, see the Terms of Use.