Privacy Policy

Last Updated: February 06, 2026

ByteJoy LLC operates CastleHQ, a tool built for teams to manage projects and collaborate. This notice describes our practices for personal information when you visit castlehq.app, create an account, use the service (including subdomains), or interact with our communications.

Privacy matters to us. We limit ourselves to the data required to deliver and maintain the service. We do not sell personal information under any circumstances. When you use CastleHQ to store or manage your team's own information—such as tasks, messages, files, discussions, or profile images—this policy does not govern your handling of that content. In those situations, we act solely as a data processor acting on your directions. Your own privacy rules apply there. See our terms of service for more on processing, or reach out for our data processing agreement (DPA).

How We Protect Information

Security is a priority. We apply encryption to data while it moves (SSL/TLS) and when stored. We maintain regular backups, restrict team access, provide ongoing training, and rely on DigitalOcean's cloud infrastructure for additional layers of protection. No setup is unbreakable, but we take consistent steps to reduce risks.

Data We Collect and Our Reasons

We stick to essentials only—no extras.

Basics for Signing Up and Logging In

To create or access an account, we need your name, email address, and organization name. These allow account setup, identity checks, and delivery of critical notices like resets or alerts about the service.

Payments and Subscriptions

Paddle processes all billing. We keep none of the card numbers, addresses, or related payment details ourselves—Paddle manages that securely. We receive only confirmation data from Paddle to verify subscription status.

User-Generated Content

CastleHQ stores the items you and your team create or upload: posts, tasks, attachments, conversations, avatars, etc. This storage enables normal use and sharing within your team. We do not repurpose it except when you specifically request help (e.g., in a support ticket). Deleted items vanish from live systems immediately, though backups may retain copies for up to 30 days to allow recovery if needed.

Security and Access Logs

We record IP addresses at signup, login, or during security reviews to detect suspicious patterns and block fraud. Our hosting (DigitalOcean App Platform) handles these logs, kept per their rules—currently up to 90 days. Future security additions like DDoS protection would involve short-term similar logging by those services.

Usage and Performance Tracking

We sometimes gather anonymized or aggregated details about browsers, operating systems, and page interactions. This helps us spot trends and refine the product. Third-party analytics may assist here.

Preventing Abuse

No CAPTCHA or bot-detection is active now. Should we implement any, it would use temporary checks without permanent extra storage.

Marketing and Promotion

We might place advertisements or apply tracking technologies (third-party cookies, etc.) to reach potential users and evaluate campaign results. This can involve showing relevant ads tied to your site/app activity. We select partners who follow privacy rules. Opt-out is possible via browser controls or partner-provided links. If active, we will detail specifics here and give required notices.

Communications You Send Us

Support emails or feedback submissions are retained to address problems and make improvements. We archive them for future reference. No call or meeting recordings occur currently.

Cookies and Tracking Tools

Session cookies (first-party) handle login and keep your session active—these are required for the service to function. Additional third-party cookies may support analytics, ads, or tracking as outlined earlier. Turning cookies off in your browser will break core features like authentication. For smooth use, leave them enabled.

Who Sees or Receives Your Information

We share only when strictly necessary and vet partners thoroughly.

Partners and Providers

We rely on these services to operate:

They receive only required portions and operate under tight privacy obligations. Advertising or analytics partners (if used) get minimal data for their role.

Team Access

Our staff views content only with your clear approval (e.g., documented consent for support) or in extreme cases to address violations like spam or unlawful use. Serious issues may lead to reports to authorities.

Aggregated Information

We do not produce or distribute combined/anonymous statistics from user content currently.

Legal Obligations

Valid court orders or subpoenas are met only after resistance where possible. We try to alert you beforehand unless barred. Tax or audit requests receive only narrow billing facts.

Company Changes

In an acquisition or merger, data moves with the service. We would inform you of major shifts ahead of time.

Deletion and Retention Practices

Content you remove becomes inaccessible right away (soft-deleted initially for possible recovery). Permanent deletion clears it from active systems. Backups hold copies no longer than 30 days. After account termination or extended inactivity, we keep only legally or operationally required remnants, then erase them.

Data Location and International Transfers

Our headquarters is in Ocala, Florida, USA. Data resides primarily on DigitalOcean servers in the United States. For users in the EU, UK, or equivalent jurisdictions, we apply appropriate safeguards for transfers. A Data Processing Agreement including Standard Contractual Clauses is available—email privacy@castlehq.app to request it. We supply it as required for compliance.

Your Rights and Choices

These options apply universally, location aside:

Send requests to privacy@castlehq.app. We handle them promptly—typically within 30 days—and charge nothing unless requests become unreasonable.

California Residents

If you are a California resident, additional disclosures and rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) apply to you. Please see our California Privacy Notice for those details.

Policy Changes and Contact

We may revise this notice as needed. Significant updates come with email alerts and in-app messages. Questions? Concerns? Write to privacy@castlehq.app—we respond.