Privacy Policy
Effective date: October 17, 2026
This policy describes how Fictions by Aj (Aj Castelletto) handles information onfictionsbyaj.com. The site is operated from Illinois, United States. It is a small author website. It does not currently sell books or take payments on this domain.
This page is meant to be accurate, not impressive. If a practice is not listed here, that usually means it is not part of the public site.
Who operates this website
Fictions by Aj is the author brand of Aj Castelletto (also A.J. Castelletto). This policy does not claim a company type, registered office, or mailing address, because those details are not published on the site.
For privacy questions or Event Suggestion follow-up, email fictionsbyaj@gmail.com (the inbox FormSubmit uses for suggestion notices). For general Contact questions, use the Contact page or email aj@fictionsbyaj.com. You can also reach Aj on@FictionsByAjorFacebook. Those are the public contact channels. There is no public contact form.
Information you may provide
The public site does not have user accounts, public comments, child accounts, child photo uploads, or on-site payment or checkout. It does not offer a visitor login. A private admin area for the site owner (under /admin and on edit.fictionsbyaj.com) is not linked from public pages and is protected by Cloudflare Access sign-in.
The public site does not have a contact form.
The Events page has an Event Suggestion form intended for adults, parents or guardians, event organizers, booksellers, and media. If you use it, you may submit:
- name
- email address
- phone number (optional)
- event name and date
- event website URL (optional)
- other event contact information you choose to include
That information is used to consider the suggestion and, if needed, to follow up. Submissions are not posted on the website. They are stored in the site's private database so Aj can review them in the admin area, and a copy is emailed as described under "Forms and email" below. Your network address is not stored with the suggestion.
Some pages have an email signup. If you use it and agree to the Terms of Use, your email address is sent to Mailchimp and you are added to the list. Fictions by Aj can then send updates about blog posts, book releases, and events. Mailchimp is a third-party email service. After a successful signup, this site showsa short thanks page. Unsubscribe links will be in those emails. Mailchimp's own retention is described inMailchimp's privacy policy. This site does not store a separate copy of the list on fictionsbyaj.com.
That email list is not the same as advertising cookies or remarketing on this website.
Automatically collected information
Like most websites, this site is delivered over the internet. It is hosted on Cloudflare. Technical information such as IP address, browser type, date and time of the request, and the page requested may be processed by that hosting infrastructure as part of running and securing the site. The exact logs Cloudflare keeps, and how long they are kept, are not controlled in this website's source code.
The Event Suggestion and newsletter signup requests may briefly keep a network address in the site's memory so the form cannot be submitted over and over in a short period. That record is not shown on any public page and is not written into the suggestion database. Whether the host also records the same request is unknown.
Google Analytics
If you allow Analytics in the cookie banner, public pages load Google Analytics 4 (GA4) from Google (measurement ID G-34NYJBYKJE). Fictions by Aj uses it to see where a visit started (for example a search result, a social link, or another website), which pages on this site were opened after that, and when someone leaves this site by clicking an outbound link (for example a book link to Amazon).
It also counts a few on-page moments: when Lark appears, when the mailing-list box comes into view, and when the signup form is sent. These record only the page and which box (home or footer); your email address is never sent to Google Analytics.
That still means Google's script runs in the browser. Google may also see technical details it normally collects with GA4, such as approximate location, browser and device type, and identifiers it stores to recognize a visit. Outbound click reports can include the address of the site you clicked through to. This site does not treat Analytics as anonymous. Google's own processing is described inGoogle's Privacy Policyandhow Google uses information from sites that use its services.
This site does not send names, email addresses, phone numbers, or form contents to Analytics. It does not set a user ID. Google's script is not loaded until you click Accept All, or turn Analytics on under Customise; until then no request goes to Google and no Analytics cookies are set. Advertising storage, ad user data, and ad personalization are always denied, and Google Signals and ad personalization flags are turned off in code. In the Google Analytics account, Enhanced measurement is set to Page views and Outbound clicks. Other account-only settings still cannot be seen from these website files.
Cookies and similar technologies
Public pages show a cookie banner that is part of this website. It is not a third-party service and loads nothing from other sites. You can choose Accept All, Reject All, or Customise, where Necessary storage is always on and Analytics can be switched on or off. If your browser sends a Global Privacy Control signal, Analytics stays off and the banner is not shown unless you turn Analytics on yourself. You can change your choice at any time with "Cookie settings" at the bottom of every page. Choosing Reject All also deletes any Google Analytics cookies already set for this site.
The public site does not set its own login cookies. Browser storage that this site may use includes:
- which book is centered in the home carousel (session storage; a book id, not a name or email)
- a preference to rest or show the Lark animation (local storage)
- your cookie banner choice (local storage,
fba_consent: Analytics on or off, a version number, and the date you chose; no ID, never sent anywhere; asked again after 12 months)
Site colors are chosen by the operator and shown to every visitor. Guests do not get a color picker.
The private admin area uses Cloudflare Access for sign-in (a one-time code sent by email to an allowed admin address). When the site owner signs in, Cloudflare sets strictly necessary authentication cookies, such as CF_Authorization, in that person's browser so the admin session is recognized. These cookies are only set for someone who signs in to the admin area; public visitors do not receive them.
If you allow Analytics, Google Analytics may set cookies (_ga and_ga_*, kept up to about 13 months) so it can connect pages viewed in the same visit and outbound clicks in that visit. If you do not allow it, those cookies are not set. Advertising storage and personalization stay denied in the page tag. Browser settings and Google's own opt-out tools can also limit Analytics.
Forms and email
Event suggestions are sent from this website's server to FormSubmit, which emails them to fictionsbyaj@gmail.com. FormSubmit is a third-party transmission service. Each submission is also stored in the site's private database (Cloudflare D1), which only the site owner can open through the admin area. The stored copy contains the fields listed above and the time it was sent. It does not include your network address.
Copies that arrive in that Gmail inbox are treated as Event Suggestion mail. A mailbox script automatically moves matching messages to Gmail Trash after approximately 30 days. That is not the same as permanent deletion at day 30. Gmail may empty Trash later under Google's own rules. FormSubmit is not that script. FormSubmit may keep its own copy according toits privacy terms (PDF). Fictions by Aj does not operate FormSubmit and cannot empty FormSubmit's systems from this website. Moving a Gmail copy to Trash does not by itself delete a FormSubmit copy.
The site's FormSubmit request turns FormSubmit's captcha off (_captcha is sent as false) so the Event Suggestion dialog can submit by script. Spam resistance on this site is origin checking, a hidden honeypot field, and a short per-address rate limit. FormSubmit may still apply its own filters.
Site content stored by the operator
Blog posts, events, theme settings, and page copy that Aj publishes are stored on Cloudflare (D1 database and a PAGE_COPY key-value store). Photos uploaded in the private admin area are stored in a separate Cloudflare key-value store (IMAGES) and may be shown on public pages at /media/.... Those systems hold the site's own content. They are not a place where visitors upload photos or create accounts. Admin revision history may record which admin email made a change.
Third-party services
Services actually used by the site include:
- Cloudflare, which hosts the public website, stores Event Suggestions and site content in its database and storage services, and provides the admin sign-in (Cloudflare Access)
- Google Analytics, as described above
- FormSubmit, which transmits Event Suggestion emails
- Gmail, which receives Event Suggestion notification mail
- Mailchimp, which holds the email list if you subscribe
- Amazon, when you follow a book or author-store link
- X, when you follow @FictionsByAj
- Facebook, when you open the Fictions By Aj page linked from Contact
- other sites linked from event listings, such as a radio stream page
Those companies operate under their own terms and privacy policies. This site does not control their pages, accounts, or retention.
Fictions by Aj does not sell or rent personal information.
Amazon and other retailers
Book purchases happen on Amazon or another retailer, not on this website. This site does not process payments. The code reviewed for this policy uses ordinary Amazon product and author links. It does not include Amazon Associates tracking parameters. If that ever changes, this policy should be updated.
Children
Cat & Rat is a children's picture book. This website is still a general author site for readers, parents, caregivers, booksellers, and media. It is not designed to collect personal information from children under 13, and children should not submit names, photos, stories, addresses, or other personal information here.
Event Suggestion is for adults and professional or parent/guardian inquiries. The email list is for people 18 or older. The site does not offer child accounts, child profiles, child comments, or a children's mailing list. Public forms do not ask for age. If a submission still includes an age under 13, it is not processed, is not stored, and is not sent on to Mailchimp or FormSubmit. If you believe we received personal information from a child under 13, contact us and we will delete what we control and ask providers where we can.
Security
Reasonable measures are used for a small site of this kind, including HTTPS on the public host, Cloudflare Access on the admin area, and basic checks on the Event Suggestion and newsletter forms. No website can promise that information will never be accessed without permission.
How long information is kept
Event Suggestions stored in the site's database are deleted by Aj once they have been handled. Any that remain are deleted automatically once they are more than 12 months old (the site checks for old suggestions whenever a new one arrives or the admin inbox is opened). Backups that Cloudflare keeps of that database follow Cloudflare's own schedule.
Event Suggestion messages in the Fictions by Aj Gmail inbox are automatically moved to Trash after approximately 30 days. That is not a claim of permanent deletion at that moment. FormSubmit may keep its own copy for a period we do not control. Analytics data follows Google's product settings. Host logs follow Cloudflare's practices. Email list records are kept by Mailchimp until you unsubscribe or the Mailchimp account is changed.
Advertising
Paid advertising, remarketing, advertising cookies, Google Signals, and ad personalization are not currently active on this website. There is no Meta Pixel, TikTok Pixel, Pinterest Tag, or Google Ads remarketing tag in the site's code today.
Those kinds of tools may be added later. If they are, this policy will be updated to name the platforms actually in use, what they receive, and how choices or consent work. Until then, do not treat this page as a description of live ads.
Questions and requests
You may ask about privacy, correction, or deletion of information you submitted through Event Suggestion (including the copy stored in the site's database) by using Contact, emailing fictionsbyaj@gmail.com, or reaching @FictionsByAj. Requests will be handled in a way that is reasonable for a small site. This policy does not list every privacy statute that might apply in another place.
For the email list, use the unsubscribe link in any newsletter, or change your preferences in Mailchimp's own controls. You can also email fictionsbyaj@gmail.com and ask to be removed.
Changes
This policy may be updated. The effective date at the top will change when it is. Continued use of the site after an update means the current version applies to new visits, except where a law requires something else.