Privacy at Cast House.

What you choose to send

A private inquiry may include your name, reply email, project category, reference type, materials or timing you already know, a short description, consent state, and optional private reference files. Cast House also keeps limited source or referrer information when it is available so Yao can understand how an inquiry found the site.

Private references

Uploaded reference files are stored in private storage for project review. They are not placed in a public gallery, and Cast House does not use a customer's reference or story as public proof without separate permission. Access may be provided to infrastructure providers needed to receive, store, or deliver the inquiry.

Site measurement

Cast House uses Google Analytics and PostHog for privacy-limited aggregate measurement of pages and approved interactions, such as page path, CTA location, service or category, media engagement, file count, and a coarse traffic-source class. Names, email addresses, phone numbers, project descriptions, filenames, file contents, private storage paths, signed file links, and Cast House visitor identifiers are not part of that vendor analytics contract.

Those tools may use cookies or local browser storage when enabled. Browser privacy controls can limit that storage. Their processing is also governed by their own policies.

Optional private visitor intelligence

If you separately allow private visit history, Cast House uses a signed, secure, HttpOnly first-party cookie to recognize the same browser. A locally bundled FingerprintJS browser fingerprint can add a short-lived, probable returning browser clue if that cookie is later missing. The fingerprint is not proof of a person, is not used to sign in or make an access decision, and never blocks the site, inquiry form, uploads, navigation, or Fiverr link.

The browser sends only a Cast House-scoped one-way fingerprint hash and the exact library version. It does not send FingerprintJS components, confidence details, or the raw library visitor value. Cast House also keeps a finite page and interest timeline, first- and last-touch source classes, and coarse browser, operating system, device class, and country context. The serving network address and user agent are reduced in request memory to rotating one-way network recurrence and coarse device fields; raw IP addresses and raw user agents are not stored in this graph. Raw URLs, queries, referrers, names, email addresses, phone numbers, descriptions, files, lead IDs, and submission IDs are not visitor-event fields.

Netlify handles the first-party visitor routes and Supabase stores the private graph. FingerprintJS 5.2.0 is bundled into this site and is loaded with its monitoring request disabled. The graph is not exported to Google Analytics or PostHog.

If the same browser later saves an inquiry, a verified cookie can connect that browser graph to the separately stored inquiry inside the lead transaction. A fingerprint match alone never creates that link. Withdrawing deletes the current browser graph and its lead link, but does not silently delete the inquiry you chose to submit.

Fiverr is a separate path

If you choose the Cast House Fiverr gig, Fiverr handles that visit, account, order, payment, and marketplace activity under Fiverr's own terms and privacy policy. Cast House does not control Fiverr's platform records.

Use, sharing, and sale

Cast House uses inquiry information to review and respond to the project, operate the site, protect the service, and maintain necessary business records. Information may be shared with service providers that perform those functions. Cast House does not sell or rent personal information.

Retention and requests

Inquiry information is kept only as long as reasonably needed to respond, handle the project, protect the service, keep necessary business records, or meet legal obligations. You may ask about, correct, or request deletion of the information you submitted. Some records may need to remain where an active project, transaction, security need, or legal duty requires it.

For optional private visitor intelligence, rotating network observations are kept for 7 days; fingerprint observations and probable-browser edges for 30 days; page and interest events for 90 days; and an unlinked browser summary, consent choice, and exact cookie for up to 180 days. A graph linked after an inquiry may be kept for up to 24 months after its last graph activity, while the separate business inquiry follows the needs described above. Short-lived rate-limit records expire within 48 hours after their bucket closes.

Use Visitor privacy settings on this site to withdraw and delete private visit history for the current browser. Global Privacy Control forces this optional system off and requests current-browser deletion. For broader access, correction, or deletion questions, email customs@casthouse.art.

Security and contact

Cast House uses access controls and private storage intended to protect inquiry material, but no online system can promise perfect security. For a privacy question or request, email customs@casthouse.art.