Skip to main content
Castov

Privacy Policy

Last updated: October 2026.

Transparency First

At Castov, we believe developers should have absolute clarity on where their data goes. Time, date and converter tools do not upload your input to Castov servers. Some preferences, such as theme, custom time zones and selected models, are stored locally on your device. Some features use the network by design: Env Vault uploads an encrypted copy, and P2P tools use public signaling servers.

1. Features That Run Entirely in the Browser (100% Local)

The following tools use Zero-Server Architecture. Your data is processed entirely by your device's CPU and GPU. Data never leaves your browser:

  • Data Visualization: JSON Viewer (3D Galaxy) and AST Conflict Telepathy.
  • Time & Utility: All Timestamp Converters, World Clocks, and Date tools.
  • Steganography & Crypto: Steganography Env Vault (AES-GCM encryption and hiding the result inside a PNG image) and the Secret Scanner. Not the Env Vault sharing tool: see section 4.
  • Compute & Web APIs: NexusGrid WebGPU Engine, Sonic-Gap Audio Bridge, and Quantum Simulator.
  • P2P Tools & Canvas: P2P Ghost Tunnel and Developer Canvas establish direct peer-to-peer connections using WebRTC and CRDTs (Yjs). Data is synchronized directly between browser peers over WebRTC data channels using public signaling servers. Workflow graphs and nodes are never stored on Castov servers or in any database.

2. Features That Store Data Locally

Some tools remember your preferences without uploading them.

  • What is stored: Custom Timezones, selected AI models, UI theme preferences, and your Master Password for local vaults.
  • Where it is stored: `localStorage` or `IndexedDB` on your specific device.
  • Protection: Local secrets are encrypted using the WebCrypto API (AES-GCM).

3. Features That Use External APIs (BYOK)

Our AI Hub (System Prompt Builders, Agent Designers) utilizes a "Bring Your Own Key" (BYOK) model.

  • API Key Storage: API keys you provide are stored strictly in your browser's local storage. They are never sent to Castov servers.
  • Data Transmission: Prompts, Context, and Keys are transmitted directly from your browser to the respective external provider (e.g., OpenAI, Anthropic, Vercel) over HTTPS.

4. Features That Send Data to Castov Servers (Account Required)

Features like Team Vaults require a Castov account:

  • What is uploaded: Authentication details (email, provider ID) and encrypted team vault records.
  • How synced data is protected: For Team Vaults, your `.env` variables are encrypted client-side before transmission. Castov servers store only the ciphertext. We cannot read your secrets.

Env Vault (secure .env sharing) is not a local tool

The Env Vault tool is the one tool on this site that is not zero-server. To let someone else open your file with a link, it uploads data to our servers:

  • What is uploaded: the encrypted payload only (a random salt, an initialization vector and the AES-GCM ciphertext). It is stored in our database, hosted on Supabase.
  • What is not uploaded: your plaintext `.env` contents and your password. Encryption happens in your browser, and the key is derived from your password with PBKDF2, so neither ever leaves your device. Share the password with your recipient through a different channel than the link.
  • What we can see: that a vault exists, its size, its creation time and an expiry timestamp (set to 7 days after creation), plus the standard request logs described in section 5. We cannot decrypt it.
  • Limits of this protection: the stored ciphertext is retrievable only by exact ID lookup via the sharing link (direct table listing is denied). Its security rests on your client-side encryption password: use a long, unique password and share it through a different channel than the link.

5. Server Logs, Analytics, and Backups

  • Server Logs: Our infrastructure providers (Vercel, Supabase) log standard request metadata (IP address, user-agent, timestamp, URL path) for DDoS protection and debugging. These logs do not contain the payload data of your tools (e.g., the JSON you parse or the Regex you test).
  • Analytics & Error Tracking: We use Vercel Web Analytics for aggregate page-view statistics. We do not use session-recording tools (like Hotjar or LogRocket) to capture your screen, ensuring your proprietary code and JSON payloads remain private.
  • Backups: Cloud-synced user data is backed up automatically. If you delete your account, backups are purged within 30 days.

Contact Us

If you have any questions about your privacy or data, please contact us at support@castov.com.