Privacy Policy
This policy covers the Cast Cards app for iPhone and the Cast website at cast.katechon.technology. The short version: we collect what we need to run the game and to understand how it’s used. We don’t show ads, we don’t track you across other companies’ apps or websites, and we don’t sell your data.
Who we are
Cast is made by Katechon Technology, Inc., a Delaware corporation based in Butte, Montana, United States (“Katechon”, “we”, “us”). Katechon decides how the personal data described here is used. Questions and requests go to simon@katechon.technology.
What we collect and why
| What | Details | Why |
|---|---|---|
| Account | A random account id, a handle we assign (like @velvet-raven), when the account was created, and your sign-in sessions. For the app we store only a hash of each sign-in token, with the app version, device model and iOS version that signed in. | To run your account. A guest account is created automatically the first time you open Cast, so you can play without signing up. |
| Sign in with Apple (app) | Apple’s user identifier for Cast, the email address Apple shares (often a private relay address), your name if you choose to share it, and an encrypted Apple refresh token. | To save your cards to your Apple ID, restore them on another device, and revoke Cast’s access with Apple when you delete your account. |
| Sign in with Google (website) | Your email address, name and profile picture link from Google. | To save and restore your account on the website. |
| Purchases | For App Store purchases: Apple’s transaction ids, the product, price, currency, storefront, purchase date, any refund, and a random token that ties the purchase to your account. For website purchases: Stripe’s checkout and customer ids and the pack you bought. We never see or store your card number. | To deliver the cards you bought, handle refunds, prevent fraud and keep accounting records. |
| Gameplay | The cards you hold and open, pity counters, free and reward cards, the stories and episodes you play, the scenes you film and who has played them, Found progress, leaderboard rank, and friend challenges. | This is the game itself. Some of it is public; see “What other players can see”. |
| Usage analytics | Events such as “pack opened” or “episode started”, the screen or page, the link and campaign that brought you, the time, your IP address, your browser’s user agent or the app version and device model, and a random visitor id (a cookie on the website; in the app, a random id created on install and kept in your iPhone’s keychain). | To see which parts of Cast work and fix the ones that don’t, and to stop people from earning free cards by playing their own scenes from extra accounts. This is first-party analytics: no analytics company receives it. |
| Notifications | If you allow notifications: your device’s Apple push token, whether the app is a test or App Store build, your language and your time zone. | To tell you when your scene has finished filming, when a card comes back to you, or when you earn a card. |
| Reports and hides | The scene you reported, the reason, any note you add, and the handles whose scenes you chose to hide. | To review reported scenes and to hide the creators you chose. |
| Support | The messages you send us and the email address you send them from. | To answer you. |
| Website video maker | The character names, descriptions and scene prompts you type into the website’s older video maker, and the videos made from them. The app doesn’t include this feature. | To make the videos you asked for. |
| Server logs | The IP address, time, address requested and user agent of each request to our server. | To keep Cast secure and running, and to investigate abuse. Kept for up to 90 days. |
We don’t collect your precise or approximate location (we don’t look up where an IP address is), your contacts, photos, camera or microphone, or your device’s advertising identifier. We don’t fingerprint devices. The app contains no third-party analytics, advertising or crash-reporting code.
How we use it
- To run Cast: your account, cards, purchases, filming scenes and notifications.
- To keep Cast fair and safe: preventing fraud and reward abuse, reviewing reports and enforcing our Terms of Use.
- To improve Cast: counting how many players reach each step, such as opening a pack or finishing an episode.
- To talk to you: replies to support messages and important notices about your account. We don’t send marketing email.
- To meet legal obligations, such as keeping accounting records.
We don’t use your data for advertising and we don’t build advertising profiles. We don’t sell personal data, and we don’t “share” it for cross-context behavioral advertising as US state privacy laws define those terms.
If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performing our contract with you (your account, the game and your purchases); our legitimate interests in understanding and improving Cast, keeping it secure and preventing abuse; your consent for push notifications, which you can withdraw at any time in iOS Settings; and legal obligations such as accounting rules.
What other players can see
- Your handle. We assign it at random; it isn’t your name.
- Scenes you film. When you play a card that nobody has played at that cliffhanger yet, Cast films a new scene. It becomes public: other players who reach that cliffhanger can watch and play it, anyone with its link can watch it, and it shows your handle and its play count.
- Your Found score and handle on the Top finders leaderboard, and your handle in any friend challenge link you share.
AI providers
Cast’s scenes are made with AI models. When a card films a new scene, our servers send the card’s text, a script written from it by an AI model, and reference images and frames of the fictional characters and sets to AI providers. These requests don’t include your name, email address, handle, account id, IP address or device ids.
We use Atlas Cloud, which runs our requests on models from ByteDance (Seedance video and Seed-Audio voices), MiniMax (video), OpenAI and Google (script writing), and Midjourney (character pictures on the website’s video maker). On the website’s video maker, the text you type is sent as well, so please don’t type personal information there.
Other companies that process data for us
- Apple processes App Store purchases and refunds, Sign in with Apple and push notification delivery. Apple’s own privacy policy covers what Apple collects.
- Stripe processes website payments. Your payment details go straight to Stripe.
- Google provides Sign in with Google on the website. The website also loads its fonts from Google Fonts, which receives your IP address and browser details. The app bundles its own fonts.
- The AI providers listed above.
- Our hosting and email providers, which run our servers and carry support email.
We may also disclose data when the law requires it, to protect the rights, property or safety of our players, Katechon or others, or as part of a merger or sale of our business, in which case this policy continues to apply to your data.
How long we keep it
- Account, gameplay and sign-in data: for as long as your account exists.
- Purchase records: after you delete your account we keep them, without your name, email or handle, for as long as accounting, tax, refund and fraud rules require.
- Usage analytics: for as long as they help us understand and protect Cast. When you delete your account we detach your events from you and erase the IP address and user agent stored with them.
- Server logs: up to 90 days.
- Push tokens: until you turn off notifications, sign out or delete your account.
- Reports: for as long as we need them to moderate scenes and keep a record of our decisions.
Deleting your account
In the app, go to You → Settings → Delete account. This works for guest accounts too. If you can’t use the app, or you play on the website, email simon@katechon.technology from the address on your account, or include your handle, and we will delete the account within 30 days.
- Deleted: your email, name and handle, your sign-in sessions, your Sign in with Apple and Google links (we also ask Apple to revoke Cast’s access), your cards, unopened packs, pity counters, rewards, stories, private videos, Found progress, friend challenges and push tokens.
- Anonymized: public scenes you filmed stay in Cast for other players, without your handle, because other players’ stories are built on them. They contain no personal data: they were filmed from our cards, not from anything you typed. Your analytics events are detached from you and their IP addresses and user agents erased.
- Kept: purchase records, as described above.
Deleting the app from your phone doesn’t delete your account. Deleting your account doesn’t refund purchases, and unplayed cards are lost. Refunds for App Store purchases are handled by Apple; see the Terms of Use.
Your choices and rights
- Turn notifications on or off at any time in iOS Settings.
- Save your account with Sign in with Apple, or keep playing as a guest.
- Ask us for a copy of your data, to correct it, to delete it, or to stop or limit a use of it. Email simon@katechon.technology. We’ll confirm it’s your account before acting, and reply within one month (45 days where US state law allows).
- If we decline a request, reply and ask us to reconsider, and we’ll explain our decision. You can also complain to your data protection authority, or in the US to your state attorney general.
California residents: in the last 12 months we collected identifiers, commercial information (purchases) and internet activity (usage analytics), from you, your device, Apple, Google and Stripe, for the purposes above. We don’t sell or share personal information and we don’t use sensitive personal information to infer anything about you. We won’t treat you differently for exercising your rights.
Children
Cast isn’t directed to children under 13, and we don’t knowingly collect personal data from children under 13 (or under the minimum age in your country). If you believe a child under that age has an account, email simon@katechon.technology and we’ll delete it. Players aged 13 to 17 should use Cast with a parent’s or guardian’s permission, and a parent or guardian can ask us to delete their teen’s account.
Security
All traffic to Cast is encrypted with HTTPS. App sign-in tokens are stored on our server only as hashes, Apple refresh tokens are encrypted, and access to our servers is limited to the people who run Cast. No system is perfectly secure, so we can’t promise that data will never be exposed. If a breach affects you, we’ll tell you as the law requires.
Where data is processed
Katechon is based in the United States, and your data is processed in the United States and in the other countries where our providers operate. Their privacy laws may differ from those where you live.
Cookies on the website
| Cookie | Purpose |
|---|---|
cast_session | Keeps you signed in on the website. Lasts up to 60 days. |
cast_vid | The random visitor id used for first-party analytics and reward-abuse checks. Lasts one year. |
cast_oauth_state | Protects Sign in with Google from forgery. Lasts 10 minutes. |
The website uses no advertising cookies. The app doesn’t use cookies.
Changes
We’ll post any change to this policy on this page and update the date below. If a change materially affects how we use your data, we’ll also tell you in the app or on the website before it takes effect.
Contact
Katechon Technology, Inc., Butte, Montana, USA · simon@katechon.technology
Updated