Privacy

This privacy policy describes how Castos, Inc (“Castos”, “we”, “us”, or “our”) collects, uses, and shares information when you visit castos.com, use the Castos platform (including the web app and mobile app), use our free tools, or listen to a podcast hosted on Castos.

It covers website visitors, people who create a Castos account, podcast listeners whose download activity appears in Castos Analytics, and private or hybrid podcast subscribers a Castos customer has added. It does not replace our Terms of Service or Cookie Policy.

How this applies to different kinds of data

For most of what is on this page, Castos decides how and why information is processed. Under privacy law that makes us the “controller” (GDPR) or the “business” (CCPA): our own website visitors, our customers’ account and billing data, and our own marketing lists.

For some information, we act on a customer’s instructions instead. The clearest example is private and hybrid podcast subscribers: when a customer runs a private or paid-access podcast, they add their own subscribers’ names, emails, and access details, and we process that information to deliver the feed, send the customer’s push notifications, and log listening activity, on their behalf. If you are a private subscriber with a question about your data, the podcast owner is usually the fastest path to an answer; we will also act on a request you send us directly, described under Your Data Rights below.

The same applies to integrations a customer chooses to connect, such as ConvertKit (Kit) or Stripe: the customer decides what data flows to those tools, and we act as the pipe.

What personal information do we collect?

Depending on how you use Castos, we may collect:

• Contact details you give us, such as name and email address, when you register, fill in a form, subscribe to email, or use a tool that requires an email.
• Account and billing details needed to run a Castos subscription, including name, address, and payment-method information handled by our payment processor.
• Content you upload to the platform, such as podcast audio and video, artwork, show notes, imported episodes, and Castos Studio recordings (which may include guest and co-host voices).
• Transcripts generated from your audio through our transcription provider, and AI-generated content, such as show notes, generated through our AI provider when you use those features.
• Private or hybrid podcast subscriber information a customer adds or imports, such as name, email, a feed access token, and per-episode listening activity, processed on the customer’s behalf.
• Payment and payout details connected to monetization features, including Castos subscription billing, Commerce creator payouts, Apple Podcast Subscriptions for Hybrid Podcasting, and PayPal, plus limited billing-status information shared with our cancellation-flow provider when a payment fails or you cancel.
• Mobile app account and authentication information, including single sign-on details for enterprise accounts, and a push-notification device identifier if you enable notifications.
• Support and feedback you send us.
• Technical information such as IP address, browser type, device information, and pages, tools, or API endpoints you use.
• Cookie and similar technology data, described in our Cookie Policy.

We do not ask you for a credit card number on this website or in the platform. Card details are collected and processed by our payment processors.

When do we collect information?

We collect information when you:

• Create or use a Castos account, on the web or in the mobile app
• Subscribe to email, respond to a survey, or submit a form
• Use a free tool that asks for an email (for example the podcast name generator)
• Visit pages on this website (through cookies and similar technologies, subject to your cookie choices)
• Download or play a podcast hosted on Castos (listener analytics, described below)
• Connect a third-party integration, such as YouTube, ConvertKit (Kit), or Stripe

Public listener analytics

Castos collects aggregated statistics in order to provide listener data for our customers. We log information about each download of a public episode, including data like IP addresses and user-agents. We then display this information on a podcast episode level to our customers in the form of Castos Analytics.

IP addresses of podcast listeners are hashed as they are stored. Castos does not store the listener’s raw IP address. The hashed value is generalized to a state or city level for reporting. Hashing reduces identifiability; it does not mean the data is outside privacy law in every jurisdiction.

Private podcast subscribers

Private and hybrid podcasts work differently from public listener analytics above. When a customer adds you as a private subscriber, we store your name, email, and a unique feed access token so the right podcast can be delivered to you, and we log which episodes you listen to and how much of each one, tied to that subscriber record. This is more identifiable than the anonymized public analytics described above, because it is tied to a named, emailed individual rather than a hashed identifier.

We process this information on behalf of the podcast that added you. If you want it corrected or removed, contact that podcast first; if you are unable to reach them, email [email protected] and we will act on your request directly.

How do we use your information?

We use information we collect to:

• Provide, maintain, and improve the website, platform, and mobile app
• Create and manage your account, including billing, payouts, and customer support
• Deliver private and hybrid podcast feeds to the subscribers a customer adds, including access control and push notifications
• Generate transcripts and AI-assisted content, such as show notes, when you use those features
• Publish episodes to YouTube when you use Republishing, and to other platforms you connect
• Process payments and payouts through Stripe, Stripe Connect, Apple Podcast Subscriptions, and PayPal
• Send transactional email (for example account, billing, and security notices)
• Send marketing email when you have subscribed or otherwise agreed, which you can opt out of
• Understand how the website and platform are used, and measure marketing, after you accept analytics or advertising cookies
• Generate suggested podcast names and similar tool results when you ask us to
• Detect abuse, fraud, and security issues
• Comply with law and enforce our terms

How do we protect visitor information?

Our website and platform are scanned on a regular basis for security holes and known vulnerabilities.

Security

We use HTTPS across the website and platform. Account passwords are not stored in plain text; they are hashed using standard methods. Tokens for integrations such as YouTube are stored using industry-standard security controls and are used only to operate the feature you connected them to. Access to production systems is limited to people who need it to operate the service.

No method of transmission or storage is completely secure. If we become aware of a breach that affects your personal information, we will notify you as required by law.

Payments and payouts

Castos’s own subscription billing is handled by Stripe; Castos does not collect, store, or process your full card number.

Commerce (listener donations) pays creators directly through their own connected Stripe account (Stripe Connect); Castos does not hold creator payout balances.

Hybrid Podcasting subscriber payments made through Apple Podcasts are handled by Apple under Apple’s own terms and privacy practices; Castos receives the subscription status information needed to grant or remove access.

If you use PayPal for a supported payment flow, PayPal processes that payment under its own privacy practices.

If your subscription is cancelled or a payment fails, limited billing-status information may be shared with our cancellation-flow provider, Churnkey, so we can offer you a chance to pause or fix payment before you lose access.

Cookies and similar technologies

We use cookies and similar technologies to run the site, remember preferences, and (if you accept them) measure traffic and marketing. CookieYes shows a consent banner and records your choices. Google Tag Manager loads only after that setup, and advertising and analytics storage start denied until you accept those categories. The mobile app uses comparable technology, such as a push-notification device identifier, described above.

Details, including how to change your choices, are in the Cookie Policy.

Companies that help us operate

We share information with companies that process it for us, not to sell your contact details. Those processors include:

• Cloudflare, which hosts this website and the Castos platform, provides security features such as Turnstile on some forms, and stores podcast media
• Stripe, for Castos subscription billing, (through Stripe Connect) for Commerce creator payouts, and as a customer-connected integration when a customer links their own Stripe account for automations
• Apple, for Hybrid Podcasting subscriber access and payments through Apple Podcast Subscriptions
• PayPal, for supported payment flows
• Churnkey, to manage cancellation and failed-payment flows
• Drip, for Castos’s own email subscriptions and tool lead capture
• ConvertKit (Kit), when a customer connects it to their own Castos account; we send the data the customer configures, on their instruction
• AssemblyAI, to generate transcripts from podcast and Studio audio
• Anthropic, to generate AI-assisted content, such as show notes, when a customer uses that feature
• OneSignal, to deliver push notifications to customers and, where a customer enables it, their private podcast subscribers
• WorkOS, for single sign-on on enterprise and mobile app accounts
• MaxMind, to resolve approximate, city- or region-level listener location from a hashed IP address
• Sentry, for error monitoring, configured not to collect personal information by default
• CookieYes, for the cookie consent banner
• Google, through Google Tag Manager and any analytics or ads tags you accept
• Formspree, when you submit the contact, nonprofit, or feedback forms
• OpenRouter (and the model behind it), when you use the podcast name generator on this website
• YouTube / Google, when a customer uses YouTube Republishing

If you connect Castos to a third-party integration, the data that flows to that integration is the data you choose to send when you set it up. We act as the pipe; the integration’s own privacy practices govern your data once it arrives there.

We may also share information with professional advisors, or if required by law, or as part of a merger, acquisition, or sale of assets. We may disclose information when we believe it is appropriate to protect Castos, our customers, or others.

This website links to third-party products, integrations, directories, and (in some articles) affiliate offers. Those sites have their own privacy practices.

YouTube Republishing

Castos’s Republishing feature uses the YouTube API Services to publish your podcast episodes as videos to your own YouTube channel.

To do this, we ask you to connect your YouTube channel, which requests broad YouTube account access, including the ability to upload, edit, and manage videos, rather than upload-only access, because YouTube does not offer a narrower scope for this workflow. We store the resulting access token, tied to your Castos account, so we can publish new episodes automatically. We do not use that access for anything other than publishing the episodes you choose to send to YouTube, and we do not share data obtained through the YouTube API with anyone outside operating this feature.

You can revoke Castos’s access at any time, either by disconnecting YouTube Republishing in your Castos dashboard or by removing Castos from the connected apps in your Google Account. Disconnecting in your Castos dashboard deletes the stored token immediately. If you revoke access from your Google Account first, we delete the token the next time we attempt to use it and find that access is gone.

Use of the YouTube API Services is also subject to Google’s Privacy Policy and YouTube’s Terms of Service.

Mobile app

The Castos mobile app uses the same account system as the website, plus single sign-on and one-time-passcode login for enterprise accounts. If you enable push notifications, we store a device identifier through our notification provider, OneSignal, so we can deliver them. The app uses Sentry to capture crash and diagnostic information, such as device model, operating system, and app version, when something goes wrong. The app does not request access to your camera, microphone, contacts, or location.

The app’s listing on the Apple App Store and Google Play is the current source for any changes to this since our last update.

Free tools

Some tools on this site keep data in your browser’s storage (localStorage or IndexedDB). The teleprompter saves your script and settings. The voice recorder auto-saves an in-progress recording so it can be recovered if the tab closes, and clears it when you export or discard the recording. That data stays on your device and is not sent to Castos.

The podcast name generator requires an email, checks a Turnstile token, sends your topic to a language model through OpenRouter, and adds your email to Drip along with the generated names so we can send them to you and follow up by email. The names are stored as part of your Drip subscriber record for as long as you remain subscribed; unsubscribing or requesting deletion (see Your Data Rights) removes them.

Children

The Castos platform is not intended for anyone under 18. Do not create an account or submit personal information if you are under 18. See our Terms of Service.

Your Data Rights

Depending on where you live, you may have rights to access, correct, delete, or export personal information, or to object to or restrict certain processing.

• Castos customers can update much of their profile information in the Settings page of the Castos dashboard.
• You can unsubscribe from marketing email with the link in any marketing message.
• You can change cookie choices through CookieYes (see the Cookie Policy).
• If you are a private podcast subscriber, see Private podcast subscribers above.
• For other requests, including account deletion, email [email protected].

If you are in California, you may also have rights under the CCPA/CPRA, described in the California section below.

Retention

Castos retains personal information you provide to create your account for as long as you maintain an account with us, including in archives and logs used to operate and improve the service.

If you cancel your Castos account, we keep your account and podcast data for a limited period in case you want to come back, then permanently delete it, including podcasts, episodes, transcripts, and private subscriber records. If you want your account deleted sooner, email [email protected].

If you are still an active customer and want specific personal information deleted rather than your whole account, email [email protected]; some information cannot be deleted while your account remains active because we need it to provide the service or to meet legal and financial record-keeping obligations.

Private podcast subscriber information is controlled by the podcaster who added you; see Private podcast subscribers above for how to request its removal.

We may retain aggregated or de-identified usage statistics after an account or subscriber record is deleted, when we have a legitimate business reason, such as improving the service. Those statistics are no longer linked to an identifiable person.

Form submissions, email records, and cookie-consent records are kept for as long as needed for the purpose they were collected, then deleted or aggregated.

International Transfers of Information

Castos is a United States company. Information may be processed, stored, and used in the United States and other countries where we or our processors operate. Privacy laws vary by jurisdiction. If you use Castos from outside the United States, you understand that your information will be transferred to and processed in the United States.

Information for European Union and UK visitors

If you are in the EU or UK, we rely on the following lawful bases to process personal information:

Purpose	Lawful basis
Creating and running your Castos account, billing, and support	Performance of a contract with you
Delivering podcast hosting, private and hybrid feeds, transcription, and AI content features you use	Performance of a contract with you
Security, fraud prevention, and enforcing our terms	Legitimate interests, in protecting the service and other customers
Website and platform analytics	Legitimate interests, or consent where the Cookie Policy requires it
Marketing email and advertising cookies	Consent
Complying with law, tax, and accounting obligations	Legal obligation

Most personal information comes directly from you. Private podcast subscriber information comes from the podcaster who adds it, not from you directly; see Private podcast subscribers above. Account and billing information is required to provide the service; without it we cannot create or run your account. Other information, such as marketing preferences, is optional and only affects the related feature. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on you.

You have the right to access, correct, delete, restrict, or object to our processing of your personal information, to receive a copy of it in a portable format, and to withdraw consent at any time where we rely on consent. You also have the right to lodge a complaint with your supervisory authority. Castos has not appointed a separate Data Protection Officer or EU/UK representative; contact [email protected] to exercise any of these rights.

Information for California residents

If you are a California resident, you have rights under the CCPA and CPRA. In the preceding 12 months we have collected these categories of personal information, for the purposes described throughout this policy:

• Identifiers, such as name, email, IP address, and account or device identifiers
• Commercial information, such as billing history, subscription plan, and payments or payouts
• Internet or network activity, such as pages and tools used, and download or listening activity
• Approximate geolocation, at a city or region level, derived from a hashed IP address
• Audio and visual information, such as podcast audio and video you upload, including Castos Studio recordings
• Professional or employment-related information you provide in a support or sales conversation

We collect this information directly from you, automatically through cookies and similar technology, from a podcaster’s account activity (for private subscribers), and from the service providers listed in Companies that help us operate.

We do not sell personal information for money. We do share some personal information, through cookies, with advertising partners for cross-context behavioral advertising, unless you opt out. You can opt out of that sharing, and change other cookie categories, through Cookie Settings; see the Cookie Policy.

We do not knowingly collect or sell the personal information of anyone under 16. We do not process sensitive personal information in a way that gives rise to a right to limit its use beyond what is described in this policy.

Your rights include the right to know what personal information we have collected about you, to delete it, to correct it, to opt out of the sale or sharing of it, to limit the use of sensitive personal information, and to not be discriminated against for exercising these rights. To make a request, email [email protected]; we may need to verify your identity by confirming details on your account before completing a request. You may designate an authorized agent to make a request on your behalf; we may ask the agent for proof of your authorization.

Contacting Us

If there are any questions regarding this privacy policy you may contact us using the information below.

[email protected]

Castos, Inc 1209 North Orange Street Wilmington, DE 19801 United States

Last updated: September 10, 2026