Galascribe

Trust and ownership

How Galascribe keeps your writing yours: your GitHub repository, your domain, encrypted data, and what happens if you leave.

You own your site

Your site is a GitHub repository you control. Each article is one Markdown file with YAML front matter in content/, and settings are JSON files in gala/.

Publishing runs in your own GitHub account through a GitHub Actions workflow, on GitHub’s build minutes, not on Galascribe’s servers. You can edit with git by hand.

Remove Galascribe’s access any time in GitHub settings; your repository and published site stay on GitHub. Retiring a site or closing your account deletes nothing in the repository. You own what you write.

Hosting and domains

Sites publish to GitHub Pages by default, served over HTTPS. Custom domains point DNS at GitHub, and Galascribe tracks the certificate. A free galascribe.com address is available, and Cloudflare manages DNS if you connect it.

Because your site is static files on GitHub Pages, your pages stay up even when Galascribe is down. Only likes, comments and follows call Galascribe.

Security

  • Sign in with GitHub. Passkeys with recovery codes are available; the server keeps only the public part of a passkey.
  • One HttpOnly session cookie, which ends on sign-out or after 12 hours without activity.
  • GitHub tokens and verified emails are stored encrypted.
  • Sensitive actions (data export, account closure, retiring a site, subscriber export) require you to confirm it is you again.
  • Tables that hold your data are protected by row-level security that the service roles cannot bypass.
  • A CycloneDX software bill of materials is kept for every component, and releases are gated on dependency audits with an empty allow-list.
  • A Content Security Policy covers the app and every published site.

Your data

The database is DigitalOcean Managed PostgreSQL with point-in-time recovery, plus a daily encrypted (AES-256-GCM) logical backup.

Account closure has a 7-day grace period. After it, your sign-in methods, sessions, memberships and likes are deleted; comments remain, credited to “Former reader”.

A one-file data export of your profile, sites, connections, comments and reactions is available from Account.

Services Galascribe uses

  • GitHub
  • Cloudflare
  • DigitalOcean
  • Brevo (email)
  • Stripe (payments)
  • Google/YouTube API (channel verification only; access is revoked and the token is never stored)

Search and feeds

Every site ships sitemap.xml, robots.txt, canonical URLs, RSS 2.0 and Atom feeds, and JSON-LD (WebSite, Blog, BlogPosting, Person, Organization, BreadcrumbList, CollectionPage, CreativeWorkSeries, ProfilePage).

Pages you mark to stay out of search results are left out of the sitemap.

Analytics

app.galascribe.com uses Cloudflare Web Analytics: no cookies, no identification.

On your site, Google Analytics 4 is optional, off by default, and loads only after the reader accepts the consent banner.

Pricing and refunds

Refund within 14 days of your first payment. Galascribe is for adults aged 18 and over.

See plans and pricing

Who runs it

Galascribe is run by Rathnas LLC, a California limited liability company, in San Ramon, California.

Contact: support@galascribe.com