Privacy policy
This policy explains what Castlune processes, why it is needed and how you can control it.
Effective and last updated: September 13, 2026
1. Controller and contact
Policy version: 2026-09-13.2. Roman Leone operates Castlune as an individual operator and is the controller of Castlune account data. Castlune is not currently operated by an incorporated company. Privacy and data-rights requests may be sent to 8686222@gmail.com or submitted through the contact page with “Privacy” or “Data deletion” in the first line.
2. Information we process
We process identity data supplied by the sign-in method you choose, including a provider user identifier, verified email address and, when available, full name; the accepted Terms and Privacy Policy versions, age confirmation and server-recorded acceptance time; content you upload; captions, calendar plans, platform choices, audience and interaction settings, commercial and AI-content disclosures, consent confirmations and delivery results; connected-account identifiers and encrypted authorization credentials; Telegram bot tokens and channel identifiers supplied by the channel owner; support messages; and limited request, device and security information generated while the service operates.
3. Sources and purposes
Data comes from you, Google or your email-based sign-in, connected publishing platforms and normal service operation. We use it to authenticate you, store drafts, carry out explicit publishing instructions, display delivery history, protect accounts, diagnose errors, prevent abuse, answer support requests and meet legal obligations. We do not use user content or connected-platform data to train AI models, sell it or use it for targeted advertising.
4. Legal bases
Where GDPR or similar law applies, processing needed to provide requested features is based on performance of our agreement with you; security, reliability and abuse prevention are based on legitimate interests; optional non-essential technologies would rely on consent where required; and record preservation or disclosure may be based on a legal obligation. You may object to legitimate-interest processing or withdraw consent, subject to applicable exceptions.
5. Sign-in providers
Google sign-in and one-time email sign-in links are handled through Supabase Auth. For Google sign-in, Castlune requests only the basic OpenID identity scopes needed for sign-in: an account identifier, email address and profile information such as your name. Email sign-in uses the address you submit solely to create or access the corresponding Castlune account and deliver the requested sign-in link. Google and Supabase process information under their own policies, including the Google Privacy Policy and Supabase Privacy Policy. Castlune never receives your Google or email password and does not intentionally retain Google provider access or refresh tokens after the sign-in exchange. Castlune issues its own randomly generated session cookie and stores only a one-way hash of that session token.
6. Connected platforms
Instagram, TikTok, YouTube and X use their official authorization flows. For TikTok Direct Post, Castlune requests user.info.basic and video.publish so it can identify the selected creator, obtain the audience and interaction options currently available to that account, submit the content the user expressly approves and check its processing status. Instagram, YouTube and X currently use basic-identity or read-only permissions while their direct-publishing features remain inactive. Telegram uses a bot token entered by the channel owner for direct channel publishing. Credentials are encrypted before storage and are not displayed again. Castlune does not collect social-network passwords, private messages or a permission to download another person's TikTok videos.
7. TikTok media transfer
After you review the preview, select TikTok publishing options, confirm the applicable TikTok rules and press the publishing button, Castlune creates a time-limited cryptographically signed HTTPS address under castlune.com for the selected file stored in Cloudflare R2. TikTok uses that address to retrieve the file for the requested post. The address expires automatically and cannot be used to browse other workspace files. Castlune then sends the TikTok publication identifier to TikTok's status endpoint to report whether the post is processing, complete or failed. TikTok independently processes the content under its own privacy policy and terms.
8. YouTube API Services
Castlune uses YouTube API Services. When you connect YouTube, we access your channel identifier and title and store an encrypted authorization token. When you expressly choose YouTube and submit a video, Castlune uses the YouTube upload permission to send that video, its title and description to your channel. During the beta, uploads from the unaudited API project may be restricted by YouTube to private visibility. Use is also governed by the YouTube Terms of Service and Google Privacy Policy. You can revoke Castlune through Google Security Settings. Following revocation or a verified deletion request, related YouTube Authorized Data is deleted as soon as reasonably possible and within seven calendar days.
9. Service providers and disclosures
Castlune uses OpenAI Sites for hosting, Cloudflare D1 and R2 for database and file storage, and Supabase Auth for Google and email authentication. Those providers process limited account, request and technical data on Castlune's behalf. Selected content and account data are sent to a social platform only when needed for a connection or publishing instruction. Data may also be disclosed when required by law, to investigate abuse or to protect users and the service. We do not currently use a payment provider, advertising network or data broker.
10. International processing
Providers and platforms may process information in countries other than your own. Where required, transfers are supported by provider contractual safeguards or another lawful transfer mechanism. Destination platforms independently determine how they process content after publication.
11. Retention
Drafts, uploads, legal acceptance records, delivery records and connection data are kept while needed for your workspace. Castlune sessions expire after 30 days unless renewed by signing in again and may be revoked earlier by signing out or deleting the workspace. Disconnecting a platform removes the locally stored credential; when the app reports a successful full deletion, Castlune workspace data and internal identity links have been removed, subject to short-lived backups and limited security, dispute or legal records. A technical authentication record held in the Supabase Auth project may remain after in-app deletion; you can request its verified deletion through the contact details above, and we will process that request without undue delay, ordinarily within 30 days. Support messages are kept only as long as needed to answer the request and protect the service. Already published content must be removed from the destination platform separately.
12. Security
Stored platform credentials are encrypted and access is restricted to service functions that need them. We use authentication, ownership checks and transport encryption, but no online service can promise absolute security. Report suspected security issues to 8686222@gmail.com or through the contact page with “Security” in the first line. Do not send passwords, access tokens or bot tokens by email.
13. Your choices and rights
Depending on your location, you may request access, correction, deletion, restriction, portability or objection; withdraw consent; appeal or complain to a privacy authority; and exercise rights without discriminatory treatment. California residents may also request the categories, sources, purposes and recipients of personal information. Castlune does not sell personal information or share it for cross-context behavioural advertising. See the Data deletion instructions for practical steps.
14. Children
Castlune is not directed to children and is limited to users aged 18 or older. If you believe a child supplied personal information, contact us so it can be investigated and removed.
15. Changes
We will update the date on this page when the policy changes and will provide additional notice for material changes where required. Continued use does not override any consent or notification right required by law.