PRIVACY POLICY

The controller for the processing described here is [CONTROLLER_LEGAL_NAME], [ADDRESS], contactable at [PRIVACY_CONTACT_EMAIL].

// The contact details shown elsewhere on this site are a joke and are not a route to the controller.

No Data Protection Officer has been appointed; the site does not carry out large-scale or systematic monitoring that would require one.

Browsing this site does not require an account and does not build a profile of you.

• └─Server logs. Our hosting provider records the usual request data — IP address, timestamp, requested URL, user agent — to serve pages and to detect abuse.
• └─Theme preference. Choosing light or dark stores the value theme in your browser's local storage. It never leaves your device and is not read by us.
• └─Administrator sign-in. If you sign in at /login with an Arweave wallet, we store a signed session cookie named fr_session containing your wallet address and an expiry. This only happens after you deliberately sign a challenge.
• └─Contact form. The form on the home page sends your name, email address and message to our server, where it is stored so we can reply. A notification naming the sender is posted to our private Discord channel so the team sees it.
• └─Newsletter. If you tick the box and submit the signup form, we store your email address, which page you signed up from, and the date and wording of the consent you gave. Every email carries an unsubscribe link, and you can withdraw at any time.
• └─Artist submissions. Claiming an artist page at /artists/submit sends the name, biography, links, wallet address and contact email you enter, plus any picture you upload. The contact address is used to reach you about the submission and is never published.
• └─Card submissions. Submitting a card sends the token name, artist name, email address, Telegram handle, artwork and any note, so the submission can be reviewed.

We set no advertising, analytics or profiling cookies, so no consent banner is required. Only two items are ever written:

• └─fr_session — strictly necessary. HttpOnly, SameSite=Lax, cryptographically signed, expires after 7 days. Set only when an administrator signs in, never for ordinary visitors.
• └─theme — a local storage entry holding your light/dark choice. Functional, set only when you use the toggle, and removable by clearing site data.

Some content is loaded directly from other servers. Your browser contacts them itself, which necessarily reveals your IP address, user agent and referring page to them. We do not control what they log.

• └─fakeraredirectory.com and arweave.net — card artwork shown in the gallery.
• └─raw.githubusercontent.com — the card image CDN, used throughout the gallery and the homepage carousel.
• └─brooklyn.ghostt.dev — event and moment images, and the endpoint the contact and submission forms post to.
• └─kek.radiopepe.wtf — the radio audio stream, contacted only when you start playback.

Links to sites such as xcp.io and pepetools.site are ordinary links: nothing is requested from them until you click.

// Fonts are served from this site, not from a font CDN, so no request is made to a third party to render text.

• └─Legitimate interests (Art. 6(1)(f)) — serving pages, keeping the site available, and protecting it from abuse. Server logs and the third-party content above rest on this basis.
• └─Contract / pre-contract (Art. 6(1)(b)) — maintaining an administrator session for people authorised to edit the directory.
• └─Consent (Art. 6(1)(a)) — the newsletter, which you opt into by ticking a box that is never pre-ticked. Withdraw it with the unsubscribe link in any email, or by writing to the address above. Also where you actively start the radio stream, which you withdraw by stopping playback.
• └─Legitimate interests (Art. 6(1)(f)) — answering a message you send us through the contact form, and reviewing an artist or card submission you choose to make. In both cases you started the exchange and the data is only what is needed to respond to it.

These providers process data on our behalf, under contract and on our instructions only. Several are based in the United States, so where personal data reaches them the transfer relies on the European Commission's Standard Contractual Clauses.

• └─Vercel (US) — hosting and server logs for this site.
• └─MongoDB Atlas — the database holding contact messages, newsletter addresses, events and photo records.
• └─Our own server at brooklyn.ghostt.dev — receives the contact and submission forms and stores uploaded images.
• └─Discord (US) — when a contact message or an artist submission arrives, a notification naming the sender is posted to our private channel so the team sees it. The message body is not sent.

// No analytics, advertising or email-marketing provider is used. The newsletter list is held in our own database and has not been shared with anyone.

• └─Server logs: retained by our host for [RETENTION_PERIOD], then deleted.
• └─Administrator sessions: 7 days, or immediately when you sign out or your wallet is removed from the authorised list.
• └─Theme preference: until you clear your browser storage.
• └─Contact messages: kept while the matter is open and for up to 12 months afterwards, then deleted.
• └─Newsletter address: until you unsubscribe. Unsubscribing marks the record so the address cannot be re-added by mistake; ask us and we will erase it outright.
• └─Artist and card submissions: kept as part of the archive's record of what was submitted and accepted. Ask us and we will remove the contact details from a submission that was not accepted.

Where we process your personal data you may request access, rectification, erasure, restriction, portability, and you may object to processing based on legitimate interests. Write to [PRIVACY_CONTACT_EMAIL].

You also have the right to complain to a supervisory authority in the EU or EEA country where you live or work.

// In practice we hold almost nothing that identifies you. If you have not signed in as an administrator, we are unlikely to be able to link any record to you, and we will not collect extra data purely to try.

Depending on where our host and the services above operate, data may be processed outside the EEA. Where that happens we rely on the safeguards those providers put in place. Hosting is provided by [HOSTING_PROVIDER].

Traffic is served over HTTPS. Administrator access is proven by wallet signature — we never ask for, receive, or store a password, seed phrase or private key. No one operating this site will ever ask you for a seed phrase.

This site is not directed at children under 16.

If this policy changes materially we will update the date at the top of this page. Continuing to use the site after a change means the revised policy applies.