Privacy Policy

Version 8 · October 18, 2026

Last updated: October 18, 2026

This policy has two parts. Part A covers darklyenergized.com and localsitefixer.com: the analytics platform, our consultancy work, Local Site Fixer (our service for local businesses), and anything you send us through either site, by email, or on a call. Part B covers Proactive Agent, our iOS app, which keeps your data on your device and has no server of ours behind it.

PART A: darklyenergized.com and localsitefixer.com

1. Introduction and why we are allowed to hold your information

Darkly Energized LLC ("Darkly Energized", "we", "us", or "our") explains here what we collect when you use darklyenergized.com or localsitefixer.com (together, "the Service") or work with us on an engagement, why we hold it, and what you can ask us to do about it.

We do not rely on your consent for most of what we do, because consent is the wrong basis for it. Where the GDPR applies, the basis for each purpose is:

Running your account and your subscription, and performing a project or engagement you have asked us to do, because it is necessary to perform our contract with you, or to take the steps you asked for before entering into one.
Keeping executed agreements and the record of an engagement after a relationship ends, because we have a legal obligation to keep certain records, and a legitimate interest in being able to establish or defend a legal claim.
Hosting, securing and monitoring a website for a Local Site Fixer client, because it is necessary to perform our contract with that client. Where that means handling information about the people who visit the client's site, we do so on the client's behalf.
Answering an enquiry or a support request, because we have a legitimate interest in replying to someone who wrote to us.
Security, rate limiting and preventing abuse, because we have a legitimate interest in keeping the Service working and unabused.
Understanding how the Service is used and which campaigns brought people to us, because we have a legitimate interest in knowing which of our own efforts work.
Contacting a local business we think our service could help, using contact details the business has published, because we have a legitimate interest in offering a relevant service to businesses. Section 2 says what we collect for that, and you can tell us to stop at any time (section 7).
Sending you a newsletter or other marketing email you signed up for, if we ever offer one. That one is consent, and you can withdraw it at any time without affecting anything else.

Where we rely on a legitimate interest, you can object; see section 7.

2. Information we collect

Account information

When you register, we collect your full name, email address, and password (hashed). If you register via Google OAuth, we receive your name, email, and profile image from Google.

Payment information

Payments are processed by Stripe. We do not store your credit card numbers or banking details. Stripe may collect payment information in accordance with their own privacy policy. We store your Stripe customer ID; the identifier Stripe assigns to a payment method you have verified with it, which is not the card or account number itself, and the time you verified it; and the identifiers of the invoices and any subscription Stripe holds for an engagement, so that we can show you where to pay and know when you have.

x402 cryptocurrency payments

When you access the API via x402 pay-per-call, we record your blockchain wallet address, transaction hash, IP address, and series accessed for audit and compliance purposes. Blockchain transactions are publicly visible on the Base network; we do not collect personal identity information beyond what is inherent in blockchain data.

Usage data

We collect information about how you use the Service, including saved chart configurations, indicator preferences, and API usage patterns.

Technical data

We collect your IP address, browser type, operating system, and referring URLs, for security, rate limiting and fraud prevention.

Pages you visit

When you open a page on the site, we record the address of the page, the time, the address of the site that sent you if it was another site, any campaign parameters in the link you followed, whether the visit looks like an automated crawler, and a visitor code. The visitor code is a one-way hash of your IP address and browser details that changes every day, so it cannot follow you from one day to the next; we do not store the IP address itself with a page view. If you are signed in, we also record your account with the visit. We use this to understand which pages are used and which of our campaigns brought people to us. Our own visits are not recorded.

Project briefs

When you describe a project, we store the answers you give and every earlier version of them, with a note of whether you or an agent acting for you wrote each one, and the time each was written. We also store what we write about the project: our notes, an estimate of the work, the checklist of what each side owes once an agreement is sent, and a snapshot of the proposal at each version.

Agreement and party details

When you sign an agreement with us, we store the legal name of the party you are signing for, the kind of entity it is, its registered address and country, and the name and title of the signer. We also store your email address, the IP address and time of signing, the drawn signature image if you provide one, and a SHA-256 seal over the executed document. If we confirm your identity by a call or another method, we store a note of how and when.

Engagement records

While an engagement runs, we keep the record of it: each delivery we make and the note describing it; your acceptance of a delivery, with the name and title you give, the time, the IP address it came from, and a seal over the record; an acceptance you withhold, with the reason you give; and the notes we write on the engagement, such as the reason for a hold, a suspension, a waived billing step, or an objection you sent us outside the Service and we recorded with the date it arrived.

Websites we host for you

If you are a Local Site Fixer client and we host your website, we hold the content and files of your site (its pages, text, images and logo), the details of your domain and its settings (DNS) that we need to point it at our hosting, and any access you grant us to your domain registrar or another account so that we can do that. We also see technical data about the people who visit your site, such as their IP addresses, browser details and the pages they request, in the logs our hosting and monitoring keep. We handle that visitor data on your behalf, only to host, secure and monitor your site for you, and we do not sell it.

If you visited a website we host for one of our clients, the business that owns the site decides what it collects. Ask that business about your information, and we will help it answer.

Information we receive outside the Service

You do not have to use the Service to work with us. Where you deal with us by email, on a call, or in documents you sign elsewhere, we store what you tell us that the engagement needs: your name, title and business contact details, the details of the party you act for, the description of the project you give us, agreements you signed elsewhere that we attach to the record, and the name and email address of a finance or billing contact if you give us one. This information is held with the same records, for the same purposes, and for the same periods as information you give us through the Service.

Enquiries and support

When you write to us through a contact or support form, we store your name, email address, subject, the kind of enquiry, your message, and the IP address it came from, together with the referring URL, any campaign parameters in the link you followed, and the first page you arrived on in that visit.

If you ask Local Site Fixer for a scorecard, we also store the website address you entered, the result of a quick speed test of that website, whether and when you confirmed the request from the email we send you, our notes on the request, a dated record of each step it goes through and who took it (you, us or our systems), the scorecard we email you, and any change we make, at your request, to the address it goes to. These are kept with your enquiry and deleted with it. When you confirm the request from that email, we also create an inactive account for you under the confirmed address, unless you already have an account with us, in which case we link the request to it. An inactive account holds only that address and the fact that it was confirmed. Nobody can sign in to it until you set a password or sign in with Google, and if you never do, it is deleted with your request, unless we have started an agreement with you by then, in which case it is kept with that agreement's records (section 6).

Businesses we contact first

Local Site Fixer contacts some local businesses before they have contacted us. For each such business we collect, from public sources only: the business's name, the email address and phone number it publishes on its website or in a public business listing, its public record with the Oregon Construction Contractors Board where it has one, and the results of our own test of its public website, including a screenshot of its homepage. We do not buy contact lists, and we do not collect anything about the business's customers. Where a business is run by one person, some of this may be information about that person; we treat it under this policy either way.

3. How we use your information

Providing, operating, and maintaining the Service.
Processing payments and managing subscriptions via Stripe, and issuing and collecting invoices for an engagement.
Sending email verification and account-related communications, and the notices an engagement requires, such as that a delivery has been made.
Enforcing rate limits and preventing abuse.
Reading and evaluating a project you describe to us, and preparing a proposal or an agreement from it.
Entering into and performing an engagement, including issuing and keeping the agreements that govern it and the record of what was delivered, accepted, invoiced and paid.
Answering a business enquiry, and answering a product support request. We keep these separate because they are different things and you may ask us about either.
Hosting, securing and monitoring a website we run for a Local Site Fixer client.
Detecting and preventing fraud and unauthorized access.
Improving the Service based on usage patterns, and understanding which campaigns brought people to us.

4. Data storage and security

Your data is stored in PostgreSQL databases and Redis caches on servers operated by Darkly Energized. We do not use a managed hosting provider that administers them on our behalf. Access is limited to the owner of Darkly Energized and to the automated deployment and backup jobs described in section 5.

We implement security measures including:

Password hashing using secure algorithms.
API keys are hashed before storage. We cannot retrieve your raw key.
HTTPS encryption for traffic between your browser and the Service.
CSRF protection on all form submissions.
Session-based authentication with secure, HTTP-only cookies.

We take regular backups of the database, stored encrypted at rest by our storage provider, and keep only recent copies. A backup is a snapshot of the database as it was, so information you have deleted can persist in a backup copy until that copy is replaced in the ordinary rotation, after which it is gone.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5. Third-party services

Hosting

The Service runs on a virtual private server provided by Vultr (The Constant Company, LLC), located in Atlanta, Georgia, United States.

Backups and deployment

Database backups are stored with Amazon Web Services (S3), in the United States. GitHub (Microsoft) runs the automated jobs that deploy the Service and copy the database backup to S3, and holds the credentials needed to do so; the backup passes through GitHub's infrastructure on its way to S3.

We send account and transactional email through Microsoft 365, provisioned through GoDaddy, including the email asking you to confirm a Local Site Fixer scorecard request, the scorecard itself, and, if we agree to work together, an invitation to sign in to your account.

Stripe

We use Stripe for payment processing, for invoicing an engagement, and for the page on which you verify a payment method. Stripe's use of your information is governed by their privacy policy. If you give us a billing contact, Stripe sends invoices and receipts to that address.

Google OAuth

If you sign in with Google, we receive basic profile information as permitted by your Google account settings. See Google's privacy policy for details.

Google Analytics

On localsitefixer.com, if you accept analytics cookies, we use Google Analytics 4 provided by Google LLC. See section 9 for the cookies, how long they last, how to change consent, and where the data may be processed. See Google's privacy policy for Google's own practices.

x402 Protocol / Coinbase

x402 cryptocurrency payments are facilitated through infrastructure operated by Coinbase via the x402.org protocol. See Coinbase's privacy policy for details on their data practices.

Engineering and AI tooling

We carry out our work using computing services and AI tools. Project briefs, materials you send us, and work produced for you may be processed by them.

Some of that processing happens on models running on hardware we control, which sends your information to no one.

Where we use a hosted provider, it may be any of Anthropic, Google, OpenAI, xAI, or Microsoft (Azure AI Foundry). We use a service only where its use of your information to train models is prevented, whether by the service's terms or by account settings we control, and only where the service does not publicly index what we send it. Such services may retain, review and disclose inputs and outputs to the extent their standard terms and applicable law permit, including under legal process. We do not warrant that any of them operates on a zero-retention basis.

We use AI tools for our own work too: writing, research, and general engineering that involves nothing of yours. That use is not covered by this section, because your information is not in it.

Website speed test

When you ask Local Site Fixer for a scorecard, we send the website address you entered to Google PageSpeed Insights, which loads that page and measures how it performs on a phone. We send Google nothing else you gave us: not your email address and not your IP address. Google's privacy policy governs its handling of the request.

Anti-spam check

The Local Site Fixer scorecard form uses Cloudflare Turnstile as its anti-spam check, which sends your IP address and signals from your browser to Cloudflare so that it can tell a person from an automated script, and Cloudflare's privacy policy governs that information.

Data sources

We fetch financial data from third-party APIs (FRED, central banks, CBOE, CoinGecko) on the server side. No user data is shared with these data providers.

6. How long we keep things

Account information: for as long as your account is open. If you close it, your personal profile is removed at once.
Executed agreements and engagement records: seven years from the end of the agreement. These are records we are required to keep, and they hold the party details, signature information and engagement records described in section 2, including information we received outside the Service. They are kept whether or not you have, or had, an account.
Project briefs that did not become an agreement: deleted with your account.
Enquiries and support messages: two years from your last message.
Information about a business we contacted first, or planned to: deleted in our regular clean-up once 12 months have passed since our last contact with the business or its last scorecard request, or since we collected it if we never made contact. If the business becomes a client or makes an enquiry, the record moves under the rules above for that relationship. If a business asks us not to contact it again, we keep only the email address, website address or phone number it asked about and the date of the request, for as long as we need them to make sure we never contact it again.
x402 settlement records: seven years from the settlement, as payment records.
Page views and technical data from darklyenergized.com and localsitefixer.com: thirteen months.
Websites we host for a Local Site Fixer client, with their hosting and monitoring logs: held while we host the site. When the Fast Site agreement ends we give the client the site files, as that agreement describes. We have not yet set a period for deleting our own copies, and will state one here when we do.
Cached financial data: stored temporarily with defined time-to-live values and purged automatically when expired. Session data expires after a configured inactivity period.

Deleting information from the live system does not immediately remove it from backups; see section 4 for how long those persist.

7. Your rights under the GDPR

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal data. We may have to keep an executed agreement or the record of an engagement to meet a legal obligation or to establish or defend a legal claim; if we do, we will tell you what we kept and why.
Restriction: request that we restrict processing of your data.
Portability: request a machine-readable copy of your data.
Object: object to processing carried out on the basis of a legitimate interest.
Withdraw consent: where processing is based on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.

To exercise any of these rights, please contact us at support@darklyenergized.com. You can do so whether or not you have an account with us.

If we contacted your business and you do not want to hear from us again, reply to our email with "no thanks", or write to support@darklyenergized.com. We stop at once, add your business to a do-not-contact list that every future contact is checked against, and delete the rest of what we hold about it. You do not need to give a reason.

8. Your rights under the CCPA

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended:

Right to know: request disclosure of the categories and specific pieces of personal information we collect, the purposes, and how long we keep them. Sections 2, 3 and 6 answer this.
Right to delete: request deletion of your personal information.
Right to correct: request correction of inaccurate personal information.
Right to opt out: we do not sell or share your personal information.
Non-discrimination: we will not discriminate against you for exercising your privacy rights.

These rights apply to business contacts as well as consumers. If you gave us your name and title as the signer of an agreement, or as the person who accepted a delivery, that is your personal information and these rights cover it.

9. Cookies

We use cookies that are essential for Service operation. These include:

Session cookies: required for authentication and maintaining your logged-in state. The session is held in the cookie itself, encrypted; we keep no copy of it on our servers.
CSRF tokens: required for protecting against cross-site request forgery attacks.

On localsitefixer.com only, if you accept analytics cookies through the cookie banner, we also use Google Analytics 4. Google LLC is the provider. Those cookies include '_ga' and related '_ga_*' cookies, which typically last up to two years unless you clear them or withdraw consent earlier. Google Analytics is configured with Google signals off and without Google Ads linking. You can change or withdraw analytics consent at any time with the "Cookie settings" link in the localsitefixer.com footer; rejecting analytics clears the '_ga' cookies. Google Analytics keeps this event data for 14 months. Data sent to Google for this purpose may be processed in the United States.

darklyenergized.com does not use analytics cookies. We do not use advertising cookies.

10. Children's privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will take steps to delete such information promptly.

11. Where your information is held, and who reaches it

Darkly Energized LLC is a Wyoming company. The servers that run darklyenergized.com and localsitefixer.com are located in the United States, in Atlanta, Georgia, and your information is stored and processed there. If you use the Service from outside the United States, your information is transferred to and processed in the United States.

Darkly Energized is run by its owner, who works from Malaysia. Account records, project briefs, executed agreements and engagement records are therefore routinely read from Malaysia, over an encrypted connection to the United States servers, by Darkly Energized itself. This is access by us, not disclosure to anyone else: we do not send your account records, project briefs, executed agreements or engagement records to any other organization outside the United States. Our pages load their fonts, scripts and images from our own servers, with four exceptions. The page where you subscribe to the analytics platform loads Stripe's payment form from Stripe so that your card details go to Stripe rather than to us. The Local Site Fixer page with the scorecard form loads Cloudflare Turnstile, its anti-spam check, from Cloudflare (section 5). If you signed in with Google, your browser loads your profile picture from Google. And on localsitefixer.com, if you have accepted analytics cookies, your browser loads Google Analytics scripts and images from Google (googletagmanager.com and google-analytics.com) so that page views can be measured.

Where the GDPR applies to us, we do not rely on a Chapter V transfer mechanism for the access described above, because it is access by the controller rather than a transfer to another controller or processor.

If that ever changes, and we engage a contractor, a service provider or any other organization outside the United States to handle your information, we will say so here and put an appropriate safeguard in place before we do it.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the Service or via email. The "Last updated" date at the top of this page indicates the most recent revision.

PART B: Proactive Agent (iOS)

Proactive Agent is a separate iOS application published by Darkly Energized LLC. It is designed so that your financial information stays on your device. Specifically:

No account on our servers. The app does not create an account with Darkly Energized. We have no database of Proactive Agent users.
No bank linking. The app does not integrate with bank-linking services. Statements you import (CSV, PDF) are parsed on-device.
No analytics SDKs. The app contains no third-party analytics, advertising, or tracking SDKs.
On-device AI. The in-app advisor uses Apple Intelligence on supported devices and runs locally. Prompts and responses are not sent to Darkly Energized.
One outbound request. The app fetches daily currency exchange rates from the European Central Bank via the public Frankfurter API (api.frankfurter.dev). The request contains no personal data; as with any web request, your IP address may be logged by the rate provider.
Purchases handled by Apple. The optional Pro Unlock and Tip Jar are processed by Apple via the App Store using your Apple ID. Apple's privacy policy governs these transactions.
Deletion. Removing the app from your device removes the data. There is no server-side copy to delete.

Because the app holds your information on your device and sends none of it to us, there is nothing for us to transfer, retain or delete on our side.

If you contact us via the Proactive Agent support form, your name, email, and message reach Darkly Energized so we can reply. That message is handled as described in Part A: see "Enquiries and support" in section 2, section 6 for how long we keep it, and section 11 for where it is held.

13. Contact

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@darklyenergized.com.

Darkly Energized LLC, 5150 Mae Anne Ave, Suite 405 PMB 1002, Reno, NV 89523, United States.