Privacy Policy

Last Updated: August 25, 2026

Effective Date: August 25, 2026

Version: 2.1

# Privacy Policy (Short Version)

     The summed up, short version first (for those that just want to get to the point)

     Due to the nature of some of the poems / content such as abuse, suicide and trauma, much focus on user privacy and security has been implemented throughout this site’s design. If a user decides to share their story or give appreciation regarding a sensitive poem that impacted them, then they should feel safe in doing so.

     The site collects as little information as possible to keep itself running. For example, the hosting provider requires certain data for their system to properly run. The site, GhostAgent.net itself though, does not intentionally collect personally identifiable information beyond what visitors voluntarily submit through contact forms. Standard technical server logs generated by the hosting provider (DreamHost) may include IP addresses and related information as part of ordinary website operations. This is perfectly normal and standard procedure for a website—nothing to cause concern.  For analytics, we use Plausible, which shows us only anonymized, aggregated data—never your identity or personal details. This means that when you view the site, the pages and poems you are viewing are your business. For our primary contact form, we use Palform, which is an end-to-end encrypted service. That means that your message is encrypted in your browser prior to being sent when you submit it.  Only the site owner can read and decrypt the submission—no other 3rd party can (including Palform themselves).  Even for our backup form, submissions are sent via secure HTTPS and stored on Proton Mail's servers with zero-access encryption at rest. It isn't as secure as Palform since the message isn't encrypted in your browser before sending, but in a situation where Palform is down, we still utilize a secure method for your privacy.

     Great care has been taken to respect the privacy of this site’s viewers and their stories.
     Your information is never sold to third parties and never shared for advertising or profiling purposes.
     (Certain information passes through trusted service providers where necessary to operate this site—as described in the Full Version below).

     As for partner services, such as payment processors for donations, merchandise and memberships (FourthWall), Palform for encryption, DreamHost for hosting, etc., we do not have control of their privacy policies but have been very selective in partnering with businesses that align with our ethos (protecting visitor information).

   When you click external links to art sites, music recommendations, or other creative spaces, you'll enter websites with their own privacy practices. We encourage you to review their policies as well.

# Privacy Policy (Full Version)

     This Privacy Policy describes how GhostAgent™, LLC ("we," “us,” “our" or "the site") collects, uses, and protects information when you visit our website at GhostAgent.net. This site is a personal creative project focused on poetry and written expression. It includes content covering mature and potentially distressing themes. Please review our Content Consent page before browsing further.

  We are committed to protecting your privacy. This policy explains, in plain language, what data is collected, why, and what your rights are.

## 1. Information We Collect

### 1.1 Analytics Data (via Plausible)

  We use Plausible Analytics (https://plausible.io), a privacy-focused, cookieless web analytics service. Plausible does not use cookies or track individuals across websites. The data collected is aggregated and anonymized, and includes:

- Pages visited
- General geographic location (country-level only)
- Device type (e.g., desktop, mobile)
- Referring source (e.g., how you arrived at the site)

  Plausible does not collect personally identifiable information (PII), does not track you across other sites, and does not build user profiles. You can review Plausible's privacy practices at https://plausible.io/privacy.

### 1.2 Primary Contact Form (via Palform)

  We provide a contact form powered by Palform (https://palform.app), which uses end-to-end encryption. When you submit this form, the following may apply:

   Name (optional): You may choose to provide your name, or skip it.
   Email address (optional): You may choose to provide your email, or skip it.
   Message content: Whatever you choose to share in the message field.

  All submissions are end-to-end encrypted on Palform's platform. This means your message is encrypted in your browser before it reaches Palform's servers, and can only be decrypted by the site owner using a locally stored private key. Even Palform cannot read the content of your submission. Palform's servers are hosted in the European Union. You can review Palform's privacy and security practices at https://palform.app/legal/privacy.

  Submissions are read only by the site owner and are never published, shared, or posted on the site or anywhere else.

### 1.3 Backup Contact Form (via Proton Mail)

   In the event that the encrypted form (Palform) is unavailable, a standard web-based contact form is offered as an alternative. This form sends your submission via email to the site owner's Proton Mail (https://www.protonmail.com) account.

   Important: This backup form uses standard HTTPS/TLS encryption during transmission. While Proton Mail provides zero-access encryption at rest (meaning even Proton cannot read stored content), this method is not end-to-end encrypted in the browser like Palform. The message passes through Proton's servers in a decryptable state briefly before being stored.

   We strongly recommend using the Palform encrypted form whenever possible. For details on our primary email channels and encryption levels, please see Section 1.9 (Email Communications). If you use the backup form, any information you submit is received by the site owner only and treated with the same confidentiality. It is never published or shared.

### 1.4 Donations / Purchases / Memberships (via FourthWall)

   Donations, memberships, and merchandise purchases are processed through FourthWall. FourthWall.com serves as the Merchant of Record for all transactions. As the Merchant of Record, FourthWall handles payment processing, tax collection, returns, and customer service inquiries.  Payment card information is handled exclusively by FourthWall and is not directly accessed by GhostAgent™, LLC.

   Depending on the type of transaction, FourthWall shares certain information with us so we can fulfill orders and manage memberships:

For donations, GhostAgent™, LLC may receive:

Customer name and email
Donation amount
Any message included with donation

For merchandise orders, GhostAgent™, LLC may receive:

Name, email, and phone number
Shipping address (street, city, state, ZIP, country)
Billing address and name
Any message left at checkout

For memberships/subscriptions, GhostAgent™, LLC may receive:

Name and email
Subscription status (Active, Expiring, Past Due, Free Trial, Former)
Membership tier and billing cycle (monthly or yearly)
Shipping address — if enabled for that tier
Activity and join date
Exit survey responses — if members cancel (reasons selected)

   We use this information solely for fulfilling orders, processing donations, and managing memberships. We do not use it for marketing or any purpose other than completing your transaction. We retain this information only for as long as necessary to complete the order and resolve any potential issues.

   Important: Additionally, FourthWall logs visitor IP addresses on their platform for security, fraud prevention, and regional tax/shipping calculations. This logging occurs on FourthWall's servers and is governed by their privacy policy.

   For complete details about how your data is handled during transactions, please review the FourthWall Shop Privacy Policy and FourthWall's Corporate Privacy Policy.

### 1.5 Audio Player

  Some pages on this site include an HTML audio player for ambient music. Audio files are hosted on GhostAgent.net's own infrastructure (provided by DreamHost). Standard server access logs (e.g., IP address, request time, requested file) may be generated by the web server as part of normal operations, but are not actively monitored or used for tracking purposes. No personal data is intentionally collected through the audio player.

### 1.6 Web Hosting (via DreamHost)

  This website and its content are hosted on DreamHost (https://www.dreamhost.com), a US-based web hosting provider with datacenters available in the EU.  This website is hosted on their EU servers. As part of standard web hosting operations, DreamHost's servers may generate automated logs (IP addresses, request timestamps, user agents, etc.) for security and operational purposes. These logs are managed by DreamHost under their own privacy practices. DreamHost provides GDPR-related tools and privacy documentation. You can review their privacy policy at https://www.dreamhost.com/legal/privacy-policy.

### 1.7 Newsletter Subscription (via Buttondown)

   We offer an optional newsletter subscription for readers who want updates on new poems and site changes. When you subscribe, we collect your email address and the date you signed up. Subscriptions are managed by Buttondown (https://buttondown.com), a privacy-focused newsletter service.

   We have disabled all tracking features on our newsletter account, including email open tracking, click tracking, and UTM parameters. This means we only know that you subscribed — not whether you opened emails or which links you clicked. We send from a custom domain (echoes.ghostagent.net) for better deliverability and brand consistency. Buttondown still uses basic email delivery infrastructure (Mailgun, US Based), which generates minimal temporary logs for deliverability purposes, but no engagement analytics are collected.  The following is what is shared with GhostAgent™, LLC:

Email address (required for subscription)
Signup date (timestamp of when you subscribed)
Unsubscribe date (retained to prevent accidental re-subscription)

   Subscribers can unsubscribe at any time using the link in every newsletter email.  You can review Buttondown's privacy policy at https://buttondown.com/legal/privacy.  All subscriber data can be deleted upon request.

   Replies to newsletter emails pass through our hosting provider's mail forwarding system before reaching our Proton Mail inbox. This means that even if you use Proton Mail, your reply is not end-to-end encrypted during this routing step — it is protected by TLS in transit and zero-access encryption at rest, but not end-to-end encryption.

   For encrypted communication, please use our Palform contact form instead. If you reply to a newsletter and your message requires a private response, we will reply using Proton Mail's password-protected email feature, which lets you read our message securely without needing an encrypted email account.

### 1.8 Uptime Monitoring (via StatusPulse.AI)

   We use StatusPulse.AI to monitor our site's uptime and SSL certificate validity. We may provide a voluntary public status page where visitors can subscribe to email alerts if the site experiences downtime. If you subscribe, your email address is stored by StatusPulse.AI on their EU-based servers solely for the purpose of sending these alerts. We do not sell or share these addresses. You can unsubscribe at any time via the link in the emails. Note: This subscription feature is optional and may be disabled at our discretion.

### 1.9 Email Communications

   Visitors may contact GhostAgent via email. We offer the following email channels:

   Proton Mail (primary): Our main email address is hosted on Proton Mail, which provides zero-access encryption at rest. Proton users who email us benefit from automatic end-to-end encryption. Non-Proton users' messages are protected by TLS in transit and zero-access encryption at rest, but are not end-to-end encrypted.

   Tuta (alternative): We maintain a secondary email address via Tuta (formerly Tutanota) for visitors who prefer Tuta as their encrypted email provider. Tuta provides end-to-end encryption. This option is available upon request.

   Email content received through either channel is read only by the site owner, treated with strict confidentiality, and never published or shared. You can request deletion of your email correspondence at any time.

### 1.10 Information We Do Not Collect

  We do not use tracking cookies.
  We do not sell your data to third parties.
  We do not track you across other websites.
  We do not use advertising trackers.

## 2. How We Use Your Information

  Analytics: Aggregated, anonymized traffic data is used to understand general site usage patterns (e.g., which pages are visited) to improve the site.

  Form submissions: Messages submitted through the contact form (Palform or backup Proton Mail form) are read by the site owner for the sole purpose of reading and responding (if requested). They are not published, shared with third parties, or used for marketing.

  Donations/merchandise/memberships: Transaction-related data shared with GhostAgent™, LLC is used solely for fulfilling orders, processing donations, and managing memberships. Payment details are handled entirely by FourthWall and governed by their privacy policy.

## 3. How We Store and Protect Data

   Encrypted form submissions (Palform): End-to-end encrypted. Only the site owner holds the decryption key. Data is stored on Palform's EU-based servers in encrypted form. No server — including Palform's — can read the content.

   Backup form submissions (Proton Mail): Protected by HTTPS/TLS in transit. Once received, messages are stored with zero-access encryption at rest on Proton's Swiss-based servers. Only the site owner can decrypt and read stored messages. Proton cannot access content at rest. This is not end-to-end encryption — the message passes through Proton's mail servers in a decryptable state briefly during delivery before being encrypted at rest.

   Direct email communications (Proton Mail & Tuta): Messages sent directly to our Proton Mail (primary email) or Tuta email addresses are protected by TLS in transit and zero-access encryption at rest. Proton users emailing our Proton Mail address benefit from automatic end-to-end encryption. Tuta users emailing our Tuta address (available upon request) also benefit from end-to-end encryption.  Users of standard email providers (e.g., Gmail, Outlook) are protected by TLS in transit and zero-access encryption at rest, but their messages are not end-to-end encrypted. Only the site owner can read these messages. (Note: Newsletter replies routed through our hosting provider do not benefit from Proton-to-Proton end-to-end encryption — see Section 1.7.)

   Analytics: Stored by Plausible Analytics. No personal data is stored on our end.

   Payment data: Not stored by us at all. Handled exclusively by FourthWall.

   Server logs: Managed by DreamHost as part of standard hosting operations. Not accessed or used by the site owner for tracking.

   Newsletter subscribers (Buttondown): Email addresses and signup dates stored on Buttondown's servers. If a subscriber unsubscribes, the email address is retained but marked as unsubscribed to prevent accidental re-subscription. No engagement tracking (opens, clicks) is recorded. Subscribers may request full deletion of their data at any time.

   Transaction data (FourthWall): Order, donation, and membership information shared with GhostAgent™, LLC is stored within our FourthWall account and email communications. Payment data is not stored by us.

   StatusPulse.AI: If subscribed to status alerts, email addresses are stored on StatusPulse.AI's EU-based servers. We may access subscriber email addresses through our StatusPulse.AI dashboard for alert management purposes. We do not export or store this data separately.

## 4. Third-Party Services

  Each of these services operates independently and has its own privacy policy. We encourage you to review them.

## 5. Communication Security & Encryption

We prioritize the confidentiality of your correspondence.

Primary Contact Form: We use Palform, which provides end-to-end encryption. Your message is encrypted before it leaves your browser, and only we can decrypt it.

Backup Contact Form & Primary Email: We use Proton Mail for our backup form and our primary email address. Proton provides zero-access encryption, meaning even Proton cannot read your messages.  Proton users emailing GhostAgent have their communication encrypted automatically.
(Note: This does not apply to replies to our newsletter, which are routed through our hosting provider — see Section 1.7.)

Tuta: We maintain an alternative email address via Tuta (formerly Tutanota). Please just let us know if you prefer to use Tuta, and we will switch our correspondence to this channel for end-to-end encryption.

Standard Email: If you contact us via a standard provider (e.g., Gmail, Outlook), your message is protected by TLS during transmission and stored encrypted at rest on our servers. However, standard email is not end-to-end encrypted.

Requesting Secure Communication: If you require or feel more comfortable using an encrypted and secure email channel but do not use Proton or Tuta, please let us know. We will provide you with a unique security code and a link to a secure messaging portal where you can compose and send your message securely without needing an account.

## 6. Interactive Experiences & Storage

   Our "Experiences" (interactive stories or games) may utilize local browser storage (localStorage) or session storage (sessionStorage) to remember your progress (e.g., items collected, choices made) within the experience.

Local Storage: Data persists across visits so you can resume your journey later.

Session Storage: Data lasts only for the duration of your visit and resets when you close the tab. In all cases, this data is strictly functional, stored only on your device, and is never used to identify you personally, track your browsing habits across the web, or share with third parties.

   Content Consent: When a visitor acknowledges the content consent gate or dismisses an informational popup / banner / notice, a localStorage entry may be set on the visitor's device to remember this acknowledgment and prevent the popup / banner / notice from reappearing. This is strictly functional and does not track or identify the visitor.

## 7. Your Rights

  Depending on your jurisdiction, you may have certain rights regarding your personal data, which may include:

   Right of access: Request a copy of any personal data we hold about you.
   Right to erasure: Request that your personal data be deleted.
   Right to rectification: Request correction of inaccurate data.
   Right to restrict processing: Request that we limit how we use your data.
   Right to data portability: Receive your data in a structured, machine-readable format.
   Right to object: Object to certain types of processing.

  Because we collect minimal personal data and do not use cookies or advertising trackers, most of these rights have limited applicability. However, if you have submitted a message through our contact form and wish to have it deleted, you may request this at any time by contacting us (see Section 13).

  Note: Under GDPR (EU/UK) and CCPA/CPRA (California), these rights are legally guaranteed. Other jurisdictions may offer similar or fewer protections.

## 8. Children's Privacy

  This site is intended for mature audiences only. It is not directed at children, and we do not knowingly collect information from anyone under 18 years of age. Our Content Consent page requires visitors to acknowledge they are at least 18 before entering the site. If you believe a minor has submitted information through our contact form, please contact us so we can take appropriate action.

## 9. Data Retention

   Analytics data (Plausible): Retained according to Plausible's own retention policies. As this data is anonymized and aggregated, it is not tied to you personally.

   Server logs (DreamHost): DreamHost manages server log retention as part of standard hosting operations. On our side, logs are accessible for approximately 7 days. These logs are not actively monitored or used by the site owner for tracking purposes.
  
   Form submissions (Palform): Retained only as long as reasonably necessary to respond to your message or continue correspondence, unless law requires longer retention. You may request deletion of your submission at any time.

   Backup form submissions (Proton Mail): Stored for the period needed to address the submission or maintain communication, except where legal obligations require extended retention. You may request deletion of your submission at any time.

   Transaction data (FourthWall): Order, donation, and membership information shared with GhostAgent™, LLC is retained for as long as necessary to fulfill orders, manage memberships, and resolve potential issues. Payment data is retained by FourthWall according to their own policies and is not accessible to us.

   Newsletter subscriptions (Buttondown): Subscriber data is kept until you unsubscribe or request full deletion. Upon unsubscribe, your email address is retained and marked as unsubscribed to prevent accidental re-subscription. You may request complete deletion of your data at any time, which will permanently remove your email address from our account.

   StatusPulse.AI subscriptions: Email addresses are stored by StatusPulse.AI on their EU-based servers. We may have access to subscriber email addresses through our StatusPulse.AI dashboard for the purpose of managing alerts. We do not export, sell, or share these addresses. Emails are retained until you unsubscribe or until the subscription feature is disabled.

   Email correspondence (Proton Mail / Tuta): Retained for as long as reasonably necessary to respond and maintain communication, unless law requires longer retention. You may request deletion at any time.

## 10. International Data Transfers

  This site is accessible worldwide. Because of the nature of the internet, your data may be processed by third-party services whose servers are located in different countries:

   Plausible — EU-based servers
   Palform — EU-based servers
   Proton Mail — Switzerland-based servers (subject to Swiss privacy laws)
   DreamHost — US Company, EU-based servers (web hosting)
   FourthWall — US-based servers (donations, merchandise, memberships)
   Buttondown — US-based servers (newsletter subscriptions)
   Tuta — Germany-based servers
   StatusPulse.AI — US Company, EU Servers

  If you are in the EU, UK, or another region with strict data protection laws, your data may be transferred to and processed in jurisdictions that may not offer the same level of protection. The services listed above implement safeguards consistent with their respective privacy policies. Proton Mail is based in Switzerland and subject to some of the world's strongest privacy laws. DreamHost provides GDPR-related tools and privacy documentation and hosts this site on EU-based servers, aligning with GDPR data residency principles. Plausible and Palform are EU-based with GDPR-aligned practices.

## 11. Changes to This Policy

   We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We may provide additional notice of material changes where reasonably practicable (e.g., via our newsletter or site announcement). Your continued use of the Site after changes are posted constitutes your acceptance of the revised Privacy Policy. We encourage you to review this page periodically.

## 12. External Links

  GhostAgent contains links to third-party websites and resources (such as art collections, music recommendations, or other creative projects), as well as possible affiliate links (which will be clearly identified).  These sites operate independently and have their own privacy policies. We are not responsible for their content, data collection practices, or terms of service. Before providing any personal information on those sites, please review their policies.

## 13. Contact

  If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, you may contact us through:

   Encrypted contact form (recommended): https://www.ghostagent.net/contact_encrypted/
   Backup contact form: https://www.ghostagent.net/contact_standard/

  Please use the encrypted form whenever possible for any privacy-related inquiries.

(Note: We do not publish our email address publicly to prevent spam. Please use the forms above for all inquiries.)