// Privacy Policy

Privacy Policy

Last updated: July 2026

This website, joshhorneman.com, is operated by J W Horneman Pty Ltd ("we", "us", "our"), based in Perth, Western Australia. We take privacy seriously. It is a core theme of the work we do, so this policy aims to be plain and honest about what we collect, why, and what happens to it. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.

What we collect, and where

Contact form. If you use the contact form, we receive the name, email address and message you provide. The form is processed by Formspree, a third-party form service, which transmits your submission to us by email.

Bookings. If you book a call, scheduling is handled by Cal.com, an open-source scheduling service. Cal.com collects the details you enter when booking (typically your name, email address and anything you add to the booking notes) and shares them with us so the meeting can happen.

The AI Clone (/ask). When you ask a question, the text of your question and the conversation's replies are processed by our AI providers (Anthropic for language models, Voyage AI for search embeddings) and stored by us so the conversation can remember its context and so we can improve the service. We also set a session cookie (described below) and store a hashed, non-reversible fingerprint of your IP address and browser type for rate-limiting and abuse prevention. Please don't enter sensitive personal information (yours or anyone else's) into the AI Clone; it is a public tool, not a confidential channel.

Agent API (/api/agent/ask). Automated agents can pay to query the AI Clone using the x402 protocol with USDC on the Base blockchain. For these requests we log the question, the paying wallet address and payment details. Be aware that blockchain payments are public and permanent by design: the transaction between the paying wallet and ours is visible on the Base network and cannot be deleted by us or anyone else.

Analytics. We use Google Analytics to understand how the site is used (pages visited, buttons clicked, approximate location, device type). Google Analytics uses cookies and collects data subject to Google's own privacy policy. We use this data in aggregate only; we do not use it to identify individuals.

Embedded video. Some pages embed YouTube videos using YouTube's privacy-enhanced mode, which does not set cookies unless you play the video. If you play a video, YouTube (Google) may collect viewing data under its own policy.

Newsletter. Our newsletter runs on Substack. If you subscribe, that relationship is between you and Substack under Substack's privacy policy; we see subscriber information through Substack's tools.

Cookies

We set one first-party cookie of our own: verbatim_session, used on the AI Clone to count free questions and keep your conversation's context. It lasts up to 90 days and contains only a random identifier. Google Analytics and YouTube (on play) set their own cookies as described above. You can block or clear cookies in your browser at any time; the site will still work, though the AI Clone's memory and free-question count reset.

Why we collect it

We use this information to respond when you contact us, run the meetings you book, operate and improve the AI Clone, keep the service fair and abuse-free, get paid for agent API usage, and understand what content is useful. We do not sell personal information. We do not use your questions to the AI Clone to train foundation models; they are processed by our AI providers under their API terms, which do not permit training on our data.

Where your data lives

Our database is hosted with Supabase in Sydney, Australia. Some of our service providers process data overseas: Anthropic and Voyage AI (United States) process AI Clone questions, Vercel (United States) hosts the website, and Google, Formspree, Cal.com and Substack operate globally. Where information goes overseas, it is to providers with recognised privacy and security practices, and only for the purposes described in this policy.

How long we keep it

Contact and booking correspondence is kept as long as needed to manage our relationship with you. AI Clone conversation data and rate-limit records are kept while they are useful for operating and improving the service, then deleted or de-identified. Agent API logs are kept for accounting and abuse-prevention purposes. Analytics data is retained per Google Analytics settings.

Security

Data is encrypted in transit, our database enforces row-level security with access restricted to server-side systems, and access credentials are rotated and scoped. No system is perfectly secure, but we treat your data the way we tell our clients to treat theirs: as something you own and protect.

Your rights

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it (blockchain transactions excepted, as they cannot be altered by anyone). Email josh@joshhorneman.com and we will respond within a reasonable time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Children

This site is aimed at business owners and professionals and is not directed at children.

Changes

If we change this policy, the new version will be published here with an updated date. Material changes to how the AI Clone handles data will be noted on the /ask page itself.