Privacy Policy

1. What we collect

We only collect what you give us directly through the site's forms, plus a small amount of anonymous traffic data. Here is the full list, by form.

From the /contact inquiry form:

• Your name
• Your email address
• Event date (optional — only if you type one)
• Venue or Key West location (optional)
• Your message to us

That's every field on that page. Nothing else is captured. There's a hidden honeypot field that bots fill out but humans don't — we ignore it.

From the /book booking form:

• Your name
• Your email address
• Your phone number
• Event date
• Event type (wedding, corporate, private party, etc.)
• Venue
• Guest count
• Event description / notes
• Budget range
• The $200 date deposit charged through Stripe (see below)

From the $200 Stripe Connect deposit checkout:

• The deposit amount ($200 USD)
• The email address you enter on Stripe's checkout page (Stripe emails the receipt there — we use it to match the payment to your booking)
• Stripe's standard payment metadata: card last-4, timestamp, and a checkout-session ID we record to reconcile the payment

We never see or store your full card number. Stripe handles the card data; we only get the receipt-level fields listed above.

Aggregate ad analytics (attached to your booking record):

• UTM parameters on the linking URL (source, medium, campaign, content, term)
• The Facebook Click ID (fbclid) that Meta appends to ad clicks
• The HTTP referrer that brought you to the site

These are attached to your booking only if you actually submit one. They let us know which ad or link sent you — nothing more.

2. Where it lives

All form data and the deposit record live in a Polsia-managed PostgreSQL database (Neon Postgres, hosted on Render). That's the same database every other form on the site writes to, and it is the only place inquiry, booking, and deposit records are stored.

The $200 deposit is also recorded on your company's Stripe Connect account. We never see full card numbers — Stripe returns only an amount, your receipt email, and a session ID, which we save to deposit_payments. The checkout session is created through Polsia's payments endpoint at https://polsia.com/api/v2/app-payments/checkout-session, which talks to Stripe on your behalf.

We do not sell, rent, or share your data with any third party for marketing purposes. Ever.

3. How inquiries reach Keith

When you submit the /contact form, three things happen:

• The row is written to Polsia Postgres via POST /api/inquiries, so we can track who we've responded to and so you don't get duplicate replies on a follow-up note.
• A notification email is sent to the owner address (force-of-nature-ent@polsia.app) through the Polsia email proxy (https://polsia.com/api/proxy/email/send). That email contains your name, the email you entered, your event date, your venue/location note, and your message — exactly the fields on the form.
• Your email address is registered with the email proxy as a known contact so any follow-up message we send doesn't get rate-limited on the agent's sending path.

Keith reads each inquiry personally and replies from force-of-nature-ent@polsia.app. There is no autoresponder, no chatbot, and no third party marketing email goes out from this site.

As a basic abuse-protection measure, the inquiry endpoint is rate-limited to 5 submissions per IP per hour.

4. Cookies & analytics

We try to keep this short, because there's not much here.

The session cookie (fone_sid):

This site drops a single, anonymous, first-party cookie called fone_sid. It's set by public/js/analytics.js, expires after 30 minutes of inactivity (rolling), uses SameSite=Lax, and contains a randomly generated UUID — not your name, not your email, not anything identifying. Its only job is to let the in-house /api/track beacon count a session without double-counting the same person across page loads. You can delete it from your browser at any time; nothing on the site breaks.

Google Analytics 4:

If the site is configured with a ga4MeasurementId (set by your hosting platform), small GA4 tracking tags are injected at page load. GA4 records anonymous page views and standard engagement metrics. You can opt out with the Google Analytics Opt-out Browser Add-on or any modern browser's "Block trackers" mode.

Meta (Facebook) Pixel:

The Meta Pixel is loaded on the /book-now landing page only. Additionally, /book fires a small tracking call (fbq('track', 'Lead') and related events) when the booking form is submitted, so Keith can see which ads are actually converting. This is standard conversion tracking — Meta's documentation explains what the pixel collects and how to opt out.

SiteLock badge:

The SiteLock logo in the footer links out to a SiteLock-hosted verification page. Clicking it opens sitelock.com in a new window — at that point SiteLock's privacy policy applies. SiteLock does not set cookies on this site that we are aware of.

5. Your choices & how to reach us

You can ask us at any time for a copy of the information we hold about you, or to delete it. There is no portal to log into — just send a note.

The fastest way is email. We'll action all reasonable requests within a few business days.

Last reviewed: 2026-08-01. Material changes will be posted here and announced on the homepage.