Privacy Policy

Effective date: October 21, 2026

This policy explains what personal information Bullquill collects, why, who it is shared with, and what choices you have.

Who is responsible for your data. Bullquill is an independent publication run by one person based in Indonesia, writing as Rowan Ashby. That person is the controller of the personal data described here. Contact: [email protected].

1. What we collect

If you just read the site

• Technical data: IP address, browser type, device information, pages visited, referring page and the time of your visit. This is processed by our web server and by the service providers listed in section 3.
• Analytics: cookie-free visit statistics recorded by Umami, our self-hosted analytics tool. See section 4.
• Cookies and similar technologies: see section 4.

If you email us

• Your email address, your name if you give it, and the content of your message.

Features we plan to offer

• We plan to offer a newsletter, free member accounts and comments. These features are not active yet. If we launch them, we will collect only what they need, such as your email address, an optional name, your subscription preferences and any comments you post, and we will update this policy before they go live.

We do not ask for, and ask you not to send us, sensitive information such as financial account details, identity numbers or health information. We do not sell paid subscriptions, so we do not process payment details.

2. Why we use it

If we launch a newsletter, member accounts, comments or advertising, we will add the relevant purposes and legal bases to this table before those features go live.

We do not sell your personal information, and we do not sell readers' messages. If we launch a newsletter or comments, we will not sell subscriber lists or comments either.

We do not use your personal information to make automated decisions that have legal or similarly significant effects on you.

3. Who we share data with

We use a small number of service providers who process data on our behalf:

• Ghost (open-source publishing software): we run it on our own server in Indonesia.
• Umami (self-hosted, cookie-free analytics): runs on our own server. See section 4.
• jsDelivr (content delivery network): Ghost may load scripts, such as its "Portal" sign-up and account script, from jsDelivr. When your browser downloads these files, jsDelivr and its network providers receive your IP address and browser information.
• Cloudflare (content delivery and security): processes technical data such as IP addresses to deliver pages and protect the site from attacks.
• Cloudflare Email Routing (email forwarding): Cloudflare Email Routing forwards messages you send us to the editor's mailbox provider, which stores them for up to 24 months.
• TradingView (market widgets): some pages embed charts and tickers from TradingView. These widgets load third-party scripts and may set cookies. See TradingView's privacy policy.

We do not currently use an email delivery service or an advertising network. If we start using one, such as Mailgun to send newsletters or Google AdSense to show ads, we will add it to this list before it processes your data.

We may also disclose information if required by law or by a valid order from a court or authority, or to protect the site and its readers from fraud or abuse.

4. Cookies, analytics and advertising

Essential cookies

• Cloudflare may set security cookies to protect the site from attacks.
• Ghost admin cookies apply only to the editor, not to readers.
• If we launch member accounts, Ghost will set the essential cookies ghost-members-ssr and ghost-members-ssr.sig to keep you signed in. They are not used for advertising.

Analytics (Umami, self-hosted)

• We count visits with Umami, an open-source analytics tool that we run on our own server. We do not use Ghost's cloud-based analytics, Google Analytics or any other third-party analytics service.
• Umami does not set cookies and does not build a profile of you across websites. It records the page you viewed, the referring site, your browser, operating system and device type, your screen size, and your approximate country, region and city derived from your IP address.
• Your full IP address is not stored. Umami uses it only at the moment of the visit to derive your approximate location and to create a pseudonymous session identifier, which is generated with a salt that changes regularly so that visits cannot be linked over long periods.
• We respect the "Do Not Track" setting of your browser: if it is turned on, the analytics script does not record your visit.
• We use these statistics only in aggregated form, to understand which stories are read and, if we carry ads, to report audience size to potential advertisers. We do not sell analytics data or share it at an individual level.
• Our legal basis is our legitimate interest in understanding how the site is used, in a way that is designed to minimize the data collected.

Market data widgets

• Some pages embed charts and tickers from TradingView. When your browser loads them, TradingView receives your IP address and browser information, loads its own scripts and may set its own cookies, under its own privacy policy.

Advertising (planned)

• We do not show third-party ads yet. Until we work with an advertising network, ad spaces on Bullquill show only our own "Advertise with Bullquill" message, which does not use cookies or collect personal data. See Advertise with Bullquill.
• When we carry ads, every ad will be labeled "Advertisement". We will not accept ads for gambling, adult content, payday or illegal lending, "get rich quick" offers, or unlicensed investment or crypto products.
• If we start using Google AdSense, Google and its partners would use cookies and similar technologies to serve and measure ads. Before any advertising cookies are used, we will update this policy and ask for consent where required, for example through a certified consent tool for visitors in the EEA, UK and Switzerland. The updated policy will also explain how to choose non-personalized ads and how to change your choices.

Managing cookies

• You can block or delete cookies in your browser settings. Some site features may not work without essential cookies.

5. US state privacy rights, including California (CCPA/CPRA)

• Categories collected: identifiers (email address if you write to us, IP address), internet activity (pages viewed) and approximate location derived from your IP address.
• Selling and sharing: we do not sell personal information, and we do not use advertising cookies. If we start using advertising cookies, which may count as "selling" or "sharing" personal information for cross-context behavioral advertising under California law, we will update this policy first and explain how to opt out, including how we handle Global Privacy Control (GPC) signals.
• Other rights: to know, access, correct and delete your personal information, and not to be discriminated against for using these rights. Send requests to [email protected].

6. International transfers

Our server is in Indonesia. Some of our providers, including Cloudflare (and its Email Routing service), jsDelivr, TradingView and the editor's mailbox provider, may process data in other countries, including the United States. If we add providers such as Mailgun or Google, we will list them here first.

7. How long we keep data

• Emails to us: up to 24 months, or longer if needed to handle a correction, complaint or legal matter.
• Server and security logs: up to 30 days, unless needed to investigate abuse.
• Analytics data: Umami, which we host ourselves, records page views without cookies and does not store IP addresses; we keep these statistics for up to 24 months.
• Newsletter, member and comment data (if we launch these features): until you unsubscribe, delete your comments or delete your account. We will then delete or anonymize it within 30 days, except for a record of any unsubscribe request, which we keep so we don't email you again.
• Data held by Cloudflare, jsDelivr, TradingView and the editor's mailbox provider is kept according to their own policies.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct it;
• delete it;
• object to or restrict certain uses;
• receive a copy in a portable format;
• withdraw consent at any time where we rely on it;
• complain to a data protection authority.

To use these rights, email [email protected]. We will reply within 30 days, or sooner where applicable law requires. We may need to confirm that the request comes from you.

9. Children

Bullquill is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

10. Security

We take reasonable steps to protect personal data, including limited administrator access, encrypted connections (HTTPS), software updates and backups. No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as required by law.

11. Changes to this policy

If we change this policy, we will update the effective date at the top. For significant changes, if we publish a newsletter, we will also tell subscribers.

12. Contact

Privacy questions and requests: [email protected]