Privacy Policy for Castro

Castro is a social platform available on the web and as a mobile application. It lets you create and share articles (including with AI-assisted writing), notes, and other posts; discover people and content; join communities and publications; stream podcasts (including with background audio on supported devices); register and manage podcasts via RSS feeds; watch or browse video and TV-style content; upload and view photos, videos, and documents; chat and receive notifications; and manage profile and privacy settings. Our data practices are designed to deliver these features, personalize your experience, and keep the service secure.

We collect and use data to provide core features, improve the service, process subscriptions and creator payouts where applicable, and send transactional communications. This policy explains what we collect, why we collect it, how we share it with service providers, and what rights you have over your information.

• Key Data Collected: Account details such as email, password (stored only in hashed form), username, full name, date of birth, gender, phone number, interests, and profile settings; usage and device data including IP address and related metadata for personalization, security, and recommendations; content you create (text, images, audio, video, documents); optional contact information you choose to upload for friend discovery; and, where you monetize, banking details for payouts.
• Third-Party Service Providers: Sign-in with Google, Facebook, or Apple may share limited account data with us. We use PostHog for product analytics and related events; Sentry for error monitoring and diagnostics; Lemon Squeezy to process subscription and related payments; and Resend to send transactional and service emails. On our website, some pages may load Google AdSense or similar advertising scripts, which can use cookies or similar technologies as described below. Each provider has its own privacy policy and may process data on its own terms to deliver its service.
• User Rights: You can access, update, or request deletion of your data, and opt out of certain processing where applicable (for example under GDPR and CCPA). Some analytics processing may be limited in ways that depend on your device or browser settings.
• Security Measures: We use encryption, access controls, and secure practices, especially for sensitive information such as credentials and banking data used for payouts, but no system is completely risk-free.

How to Use This Policy

This Privacy Policy is designed to meet common requirements for app marketplaces such as the Apple App Store, Google Play Store, and Huawei AppGallery, and for our website. It describes Castro's data practices. If you have legal or jurisdiction-specific questions, consult appropriate legal counsel.

Introduction

Welcome to Castro, operated by Castro ("we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and related services (together, the "Service"). By using the Service, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

We are committed to protecting your privacy in compliance with applicable laws and regulations, including (where applicable) the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and app store requirements. Questions: amahlesbana@somaaiapp.com.

Information We Collect

We collect the following categories of information to provide and improve our services:

• Account and profile: Email address; password (we store only a secure hash, not your plain-text password); custom username; full name; date of birth; gender; phone number; interests; profile biography and preferences; and privacy settings (such as public or private profile options where available).
• Authentication (OAuth): If you sign in with Google, Facebook, or Apple, we receive limited identifiers from that provider (for example name and email) as permitted by your consent and the provider's settings, to create or link your account.
• Usage, device, and network data: IP address and related metadata (such as general location derived from IP), device and app identifiers, operating system, app version, and in-app activity such as content views, interactions (for example likes and follows), search and discovery activity, podcast listening and playback (including background playback where supported), and session data. We use this for security, personalization, recommendations, and product analytics.
• User content: Text, images, photos, audio, video, documents, podcast feeds and show metadata you submit, messages you send where messaging is available, and other materials you upload or publish through the Service.
• Contacts (optional): If you use features that help you find friends, you may choose to upload contact-derived identifiers (for example hashed or normalized phone numbers or emails). We use this information to suggest connections and operate the feature; we do not use it for unrelated marketing. Requests may be subject to technical limits (such as a maximum number of contacts per request).
• Payments and subscriptions: Subscription purchases and related payments are processed by Lemon Squeezy. Payment card and billing details are collected directly by Lemon Squeezy (or its partners) according to their terms. We may receive and store subscription status, transaction references, and identifiers Lemon associates with your account (such as customer or subscription IDs) to provide access to paid features.
• Creator payouts: If you receive payouts from subscribers or donors, we may collect banking or payout details necessary to send funds, which are handled by payment processors under their security practices.
• Communications: We send transactional and service emails (such as password resets and important notices) using Resend. We may also send in-app or push notifications according to your settings.
• Analytics and diagnostics: We use PostHog to measure product usage, funnels, and related events (including page views on the web where enabled). We use Sentry to collect error reports, stack traces, and diagnostic data to identify and fix issues. Please review PostHog's and Sentry's privacy policies for details on how they process data.
• Advertising (website): On certain web pages we may display ads through Google AdSense or similar services. Those services may use cookies, pixels, or similar technologies and may collect or receive device and usage data for advertising purposes. Your browser may offer controls for cookies; mobile apps may not load the same scripts as the website.
  Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the Internet. You may opt out of personalized advertising by visiting Google Ads Settings or www.aboutads.info. To learn how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services.

We do not collect unnecessary sensitive information beyond what is needed for the Service and obtain consent where required by law.

How We Collect Information

• Directly from you: When you register, complete your profile, adjust settings, create content, subscribe, enable contact matching, or provide payout or banking information.
• Automatically: Through logs, cookies or similar technologies on the web, SDKs, device information, and analytics and error-reporting tools as you use the Service.
• From third parties: OAuth providers (Google, Facebook, Apple); Lemon Squeezy for payment and subscription status; payment processors for payouts; and advertising partners on the website where ads are shown.

How We Use Your Information

• Core social and content features: To operate feeds, profiles, communities, publications, discovery, search, library, chats, notifications, and other interactive features.
• Articles and AI assistance: To provide editing, drafting, and AI-assisted writing tools, and to display your articles and related media.
• Podcasts and media: To stream audio and video, support background playback where the platform allows, process RSS registrations, and show podcast episodes and related metadata.
• Personalization and recommendations: To tailor content, suggestions, and experiences using account data, usage patterns, and IP or device metadata where appropriate.
• Subscriptions and monetization: To validate subscriptions processed through Lemon Squeezy and to process creator payouts where applicable.
• Communications: To send service emails via Resend, deliver in-app and push notifications, and respond to support requests. You may opt out of some non-essential communications where settings allow.
• Improvements and security: To analyze performance and usage with PostHog, diagnose issues with Sentry, prevent fraud and abuse, and enforce our terms.
• Legal bases: Where applicable, we rely on consent, performance of a contract, legitimate interests (such as analytics, security, and product improvement), or legal obligation, as required by law.

Sharing of Information

We limit how your information is shared and strive to share only what is necessary:

• Service providers (subprocessors): We engage vendors that process data on our behalf, including: Google, Meta (Facebook), and Apple for OAuth sign-in; PostHog for analytics; Sentry for error monitoring; Lemon Squeezy for subscription payments; Resend for email delivery; payment processors for payouts; and, on the website, Google AdSense or similar ad services where used. These providers are required to protect information appropriately and use it only to provide their services to us, subject to their own policies and applicable law.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or to protect rights, safety, or property.
• Business transfers: If we are involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, subject to notice where required.

We do not sell your personal data in the conventional sense of selling lists of personal information for money. Third parties we use may only process your information as described in this Policy, as permitted by their services, or as required by law.

Data Security and Retention

We use technical and organizational measures such as encryption (including for data in transit and sensitive fields), access controls, and secure storage to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We retain data only as long as necessary for the purposes described in this Policy: account information is generally retained until you delete your account; usage data is typically retained for a limited period (for example up to two years) unless a longer period is needed for security or legal reasons; and financial records may be retained longer to comply with tax, accounting, or legal requirements.

To delete your user data, use the account or settings options in the Service (for example, delete account from your settings page) where available, or contact us at amahlesbana@somaaiapp.com.

Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

• Access the information we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to certain legal obligations.
• Object to or restrict certain types of processing.
• Request a copy of your data in a portable format (data portability).
• Withdraw consent where processing is based on consent, without affecting prior lawful processing.

Depending on your region, you may also have choices regarding certain analytics or advertising cookies on the web (for example through browser settings). Opting out of or limiting some analytics may not disable all processing needed to operate secure accounts and core features.

For users covered by GDPR or CCPA, additional rights may apply, such as the right to opt out of certain "sales" or "sharing" as defined by local law (we do not sell your personal data as described in our sharing section above). To exercise your rights, contact us at amahlesbana@somaaiapp.com. We will respond within a reasonable period, typically within 30 days where required by law.

Children's Privacy

Castro is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected such information, we will take steps to delete it. If you believe a child has provided us with personal data, contact us at amahlesbana@somaaiapp.com.

International Transfers

Your information may be transferred to and processed in countries other than your own. Where we transfer data internationally, we implement appropriate safeguards, such as contractual clauses or other lawful mechanisms, to help ensure your privacy rights are protected.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective Date" above and may provide additional notice in the Service if changes are significant. Your continued use of Castro after changes take effect means you accept the updated Policy.

Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, you can contact us at:

Castro
Email: amahlesbana@somaaiapp.com