Privacy

Who runs this

Castarot is run by one person, privately. There is no company behind it. For anything in this document — including a request to delete or export your data — write to [email protected].

What is kept

The question you type. The cards that came up and which way round. The reading written for you. Any follow-up you ask and the answer. If you set an echo, what you later said actually happened, and the reader’s reply to it. The reader and spread you chose, and the language of the page.

If you sign in, a few more things: your email address, the moment it was confirmed, the language you signed in from, a scrambled form of your password that cannot be turned back into it (not the password itself — see below), and, only if you pick one, which card you chose as your mark. No name, no profile.

The question and the outcome are the sensitive part — they are free text about your own situation, and you may have written something you would not want kept. That is why the delete control removes them the moment you use it, and why, for readings not attached to an account, they are the first thing emptied when the retention period runs out.

Signing in leaves a short trail of its own, kept apart from the readings. A one-time code sent by email is stored only as a hash and dropped a week after it expires. The message that carried it keeps its text for a week, then that text is emptied and the row goes after ninety days. A count of sign-in attempts, wrong passwords included, is kept for thirty days so the door cannot be hammered, and an attempt that was turned away is noted, with the address it came from, for ninety days. None of it is used for anything else.

One more thing is counted, and it is not about you. When you pick a piece of background music, the site adds 1 to a tally for that track, that day, and that page language. It is a number, not a record: nothing ties it to you, to your cookie, or to any reading, so there is nothing in it to look up and nothing in it to delete. Your own choice is remembered only in your browser.

Paying adds two things and no more. One is the ledger of sand: how much arrived or was spent, when, and which reading it went to. The other is a single reference number that Lemon Squeezy gives you as a customer, so that a later purchase or a cancellation lands on the same person. The card is not among them, and neither is the billing address — they never reach this site.

What is not kept

Not your password as you typed it. What is kept is a salted hash (PBKDF2-SHA256, 600,000 rounds): it can tell whether a password is right, but it cannot be turned back into the password, so not even this site can read yours. No name, no profile, no picture. No card details and no billing address: the card is handled by Lemon Squeezy on their own pages and never reaches this site. No third-party analytics: this site loads no third-party script at all, so there is no Google Analytics, no Clarity, no advertising pixel.

Your IP address is not written to the database for anything you draw or write. The sign-in machinery is the one exception, and it is described above: attempts are counted per address so the door cannot be hammered, and an attempt that was turned away is noted with the address it came from. Both clear themselves on the schedule given. Apart from that, an address appears in the server log for a short time as it does on any web server, and is used at the moment of a request to check by reverse DNS whether a visitor claiming to be a search crawler really is one. The crawler record that gets stored keeps only the user agent, the path and the language — not the address.

Who you are here

Without an account, this browser is your identity. When you draw for the first time, the site puts one random id in a cookie called cst_a. It contains no information about you — it exists only so that a reader can recognise that two readings came from the same person. The cookie is http-only, sent only over https, not shared with other sites, and lasts a year.

That cuts both ways, and it is worth knowing before you rely on it: on another browser, another device, or after you clear cookies, you are a new person here. Your earlier readings are not gone, but nothing can connect you to them any more — which also means they cannot be deleted from that side.

An account is the way out of that. Sign in and the address becomes the identity instead: the readings made on that browser move into the account the first time you sign in there, and anything drawn there later while signed out moves in the next time the same account signs in — never into a different account. From then on the same history follows you to any device you sign in from, and once you sign out, that browser shows only what was drawn on it without an account. The session lives in a second cookie, cst_session, which is signed rather than stored, and lasts thirty days.

Who else touches it

The reading is written by a large language model run by DeepSeek. To produce it, your question, the cards and the reader’s instructions are sent to DeepSeek’s API. If you would rather a third party never saw a particular question, do not type it — draw without a question instead; an open reading works.

The database is Neon, hosted on AWS in Singapore. The site itself runs on a ConoHa server in Japan, behind Cloudflare, which sees requests as they pass. Sign-in mail, and any reading you choose to have emailed to yourself, leaves through Amazon SES in Tokyo, which sees the address it is delivering to and, for a reading, what the reading says. A copy of that message is kept for seven days so a failed delivery can be retried; after that its text is emptied, and only the note that it was sent remains. Sharing a reading stores nothing new: the link itself says which reading it is, when it stops working (30 days later) and whether your question is shown. If you send a reading to someone else’s address, that address is kept with the message for the same seven days and then replaced by a one-way fingerprint, which only lets the site count and stop repeat sends; if they ask to receive no more, only that fingerprint is kept. If you buy sand, the seller is Lemon Squeezy (Sold through Link, LLC, formerly Lemon Squeezy LLC, in the United States): it takes the payment, sees your card and billing details, and handles them under its own privacy policy. That is the whole list.

How long it stays

With an account, what you wrote stays until you remove it. Nothing expires on a timer, because you have a way to reach back for it — the delete control below, and an address to write to.

Without an account it is the other way round, on purpose: after 180 days the question, the reading, the follow-ups and the outcome are emptied. Someone with no account has no way to come back later and take them down, so the site does it for them. The row itself stays — which cards were drawn and when is what lets a reader say “this one has come back to you three times”, and that part is not private in the same way.

This is not a sentence written to look responsible. It runs on a timer on the server, and the count of records still past the deadline is printed every time it runs. At the last run that count was zero.

Deleting it

Signed in, the control is at the foot of your own page. It removes the account, everything written under it, the address itself, and the records the sign-in machinery had kept. It shows you the count first, sends a code to your address to make sure the request is really yours, and once you enter it, deletes — immediately, not on a queue.

Without an account, the same kind of control is on the About page and removes everything stored for this browser: every reading, every follow-up, every echo. The id in the cookie is released at the same time, so the next reading starts from nothing.

Neither can be undone. If you would rather have a copy first, or you have lost the browser that held the id, write to [email protected].

Deleting the account also settles the money. A subscription is cancelled so that nothing is charged again, and a yearly plan is refunded for the whole months you had not yet been given. If any of that cannot be completed, the deletion stops and you are told why — better to still exist here than to be erased while a charge keeps running. One thing does stay: the record of what was paid remains with Lemon Squeezy, because the law requires keeping accounts. That record is a receipt; it holds nothing of your questions or your readings.

Your rights

If you are in the EEA or the UK, the GDPR gives you the right to see what is held, correct it, have it erased, restrict or object to its use, and take a copy elsewhere. If you are in California, the CCPA gives you comparable rights, and this site does not sell or share personal information in the sense that law uses. The legal basis for keeping a reading is the legitimate interest in the site working the way it says it does — a reader that remembers; for an account it is the agreement you enter by signing in. Everything above can be exercised through the delete control, or by writing to [email protected]. There is no charge, and you do not need an account to ask. You can also complain to your national data protection authority.

Age

This site is not for anyone under 13, or under the higher minimum age where you live if your country sets one. If you are under 18, use it with a parent or guardian’s permission. If something here was written by a child, tell me and I will remove it.

Changes

This page changes when the system does, not the other way round. The date at the top is when it was last true. If something material changes — a new processor, a shorter or longer retention, a new thing kept — the date moves and the section says what changed. Questions: [email protected].

Card-back evolution

If you choose to grow a card-back set, your account stores the chosen set, each rewarded task’s type and Japan-time date, its growth points, unlocked appearances and the equipped appearance. No question or answer text is copied into this record. Clearing reading history does not remove this progress or your unlocks; deleting the account removes them. Sand spent on an appearance is recorded in the sand ledger.