Privacy

1. The data we process

Account: email, a hash of your password (we never know the password itself), your Google ID if you sign in with Google, language, sign-in dates.

Content: the videos and photos you upload, the face photos in your library, thumbnails of the people found in the frame and the results.

Payments: the pack, the amount, the payment address, the TRON transaction hash, your credit history.

Technical: IP address, browser and device type, request and error logs — to run and protect the service.

Analytics: visit data from Google Analytics — only if you accept analytics cookies.

2. Why, and on what basis

To provide the service: the account, swaps, emails about results, crediting payments — performance of our contract.

To protect people and the service: the explicit content filter, handling complaints, preventing abuse and fraud — our legitimate interest.

To keep payment records — a legal obligation.

To learn how to improve the site (Google Analytics) — your consent, which you can withdraw at any time.

3. Faces

Faces in your photos and videos are processed automatically and only to find the people in the frame and replace faces. The facial features computed for that exist only while processing and are not kept afterwards.

We do not use faces to identify anyone, do not build databases of them and do not train models on them.

4. How long we keep it

Uploaded videos and photos, thumbnails and results: 30 days, then deleted automatically. Library faces: until you delete them.

The account: until you delete it. After that only payment records (email, amount, transaction) remain, for as long as accounting law requires. Technical logs: up to 90 days.

5. Who we share it with

We do not sell data. We share it only with providers the service cannot run without, and only what they need: hosting and file storage (such as Amazon Web Services), the email service (Resend), Google (Google sign-in and, with your consent, Google Analytics), the payment gateway that watches for your transfer on the TRON network.

Transactions on the TRON blockchain are public by nature; that is beyond our control.

We may disclose data when the authorities lawfully require it, or to protect people whose faces were used without consent.

Some providers process data outside your country; in that case we rely on standard contractual clauses or other safeguards the law provides.

6. Cookies and local storage

Necessary: the site keeps your sign-in keys and your cookie choice in the browser. Sign-in does not work without them, so they need no consent.

Analytics: Google Analytics starts only after you accept it in the banner. You can change your mind any time with the “Cookies” link at the bottom of the page.

7. Your rights

You can get a copy of your data, correct it, delete it (in your profile or by email), restrict or object to processing, receive it in a machine-readable format and withdraw consent. Write to hello@castme.love; we answer within 30 days.

You may also complain to the data protection authority of your country.

8. Security, age and changes

Files are kept in private storage and reachable only through short-lived links; passwords are stored only as hashes; connections are encrypted.

The service is not meant for anyone under 18, and we do not knowingly collect their data.

We will announce material changes to this policy by email or on the site.