Privacy

Who runs this

Castarot is run by one person, privately. There is no company behind it. For anything in this document — including a request to delete or export your data — write to [email protected].

What is kept

The question you type. The cards that came up and which way round. The reading written for you. Any follow-up you ask and the answer. If you set an echo, what you later said actually happened. The reader and spread you chose, and the language of the page.

The question and the outcome are the sensitive part — they are free text about your own situation, and you may have written something you would not want kept. That is why they are the first thing removed when the retention period runs out, and why the delete control below removes them immediately.

One more thing is counted, and it is not about you. When you pick a piece of background music, the site adds 1 to a tally for that track, that day, and that page language. It is a number, not a record: nothing ties it to you, to your cookie, or to any reading, so there is nothing in it to look up and nothing in it to delete. Your own choice is remembered only in your browser.

What is not kept

No account. No email address, no name, no password — there is nothing to sign up for. No third-party analytics: this site loads no third-party script at all, so there is no Google Analytics, no Clarity, no advertising pixel. The only thing counted on the server is the music tally described above, and it carries no identifier. No payment data, because nothing is sold here.

Your IP address is not written to the database. It appears in the server log for a short time like it does on any web server, and it is used at the moment of a request to check by reverse DNS whether a visitor claiming to be a search crawler really is one. The crawler record that gets stored keeps only the user agent, the path and the language — not the address.

This browser is your identity

When you draw for the first time, the site puts one random id in a cookie called cst_a. It contains no information about you — it exists only so that a reader can recognise that two readings came from the same person. The cookie is http-only, sent only over https, not shared with other sites, and lasts a year.

This cuts both ways, and it is worth knowing before you rely on it: on another browser, another device, or after you clear cookies, you are a new person here. Your earlier readings are not gone, but nothing can connect you to them any more — which also means they cannot be deleted from that side.

Who else touches it

The reading is written by a large language model run by DeepSeek. To produce it, your question, the cards and the reader’s instructions are sent to DeepSeek’s API. If you would rather a third party never saw a particular question, do not type it — draw without a question instead; an open reading works.

The database is Neon, hosted on AWS in Singapore. The site itself runs on a ConoHa server in Japan, behind Cloudflare, which sees requests as they pass. That is the whole list.

How long it stays

After 180 days the question, the reading, the follow-ups and the outcome are emptied. The row itself stays — which cards you drew and when is what lets a reader say “this one has come back to you three times”, and that part is not private in the same way.

This is not a sentence written to look responsible. It runs on a timer on the server, and the count of records still past the deadline is printed every time it runs. At the last run that count was zero.

Deleting it

On the About page there is a control that removes everything stored for this browser: every reading, every follow-up, every echo. It shows you the count first, asks once, and then deletes — immediately, not on a queue. The id in the cookie is released at the same time, so the next reading starts from nothing.

It cannot be undone and there is no account to recover it from. If you would rather have a copy first, or you have lost the browser that held the id, write to [email protected].

Your rights

If you are in the EEA or the UK, the GDPR gives you the right to see what is held, correct it, have it erased, restrict or object to its use, and take a copy elsewhere. If you are in California, the CCPA gives you comparable rights, and this site does not sell or share personal information in the sense that law uses. The legal basis for keeping a reading is the legitimate interest in the site working the way it says it does — a reader that remembers. Everything above can be exercised through the delete control, or by writing to [email protected]. There is no charge and no account required. You can also complain to your national data protection authority.

Age

This site is not for anyone under 13, or under the higher minimum age where you live if your country sets one. If you are under 18, use it with a parent or guardian’s permission. If something here was written by a child, tell me and I will remove it.

Changes

This page changes when the system does, not the other way round. The date at the top is when it was last true. If something material changes — a new processor, a shorter or longer retention — the date moves and the section says what changed. Questions: [email protected].