Privacy Policy

This policy applies to anyone who opens this Castle Stream website, creates a room, or joins a room with an invite link. Castle Stream is not directed at children under 13, and we do not knowingly collect information from children under 13. If you are under 13, do not use Castle Stream.

There are no user accounts, profiles, or billing records. You are not asked for an email address, phone number, or real name. The display name you pick is a label for the current session only. It is stored in your browser’s session storage on your device, not in a Castle Stream database. A room can optionally have a password; that password is not an account login.

While you are in a room, the following may exist in memory:

• the text you type, sent keystroke-by-keystroke to others in that room
• your display name, visible to others in that room
• your cursor position and a rough typing-speed signal
• the room name, and how many people are in it, shown on the landing page
• if the creator set a password, a one-way hash of that password, only until the room ends
• a temporary room identifier in the URL
• a short-lived connection between your browser and the Castle Stream relay, and, when possible, a direct peer connection to other people in the room

Castle Stream does not write room contents to a database, log, or archive. When the last person leaves a room, the server drops that room from memory. If you close or refresh the page, your local copy of the text is gone.

Your browser may keep:

• a display name in session storage, until you close the tab
• a short-lived room password you typed, in session storage, so you can rejoin that room in the same tab
• accessibility choices (reduce motion, pause background, high contrast, larger text) in local storage, until you clear site data

Castle Stream does not set advertising cookies itself. Google Analytics and Google AdSense, described below, may set cookies or similar storage on your device.

Castle Stream uses Google Analytics (gtag.js, measurement ID G-RGFXZR4J8G) to understand how people find and use the site. Google may collect device and browser information, page views, approximate location, and similar usage data, and may set cookies or use similar storage on your device. Castle Stream does not send room text, display names, or room passwords to Google Analytics as custom events.

Google’s processing is governed by Google’s Privacy Policy. You can also use Google’s opt-out browser add-on.

Castle Stream uses Google AdSense (publisher ID ca-pub-1566573312352415) to show ads. Google may collect device and browser information, page views, approximate location, and similar data to choose and measure ads, and may set advertising cookies or use similar storage. Castle Stream does not send room text, display names, or room passwords to AdSense as custom targeting.

An ads.txt file at the site root authorizes Google to sell ads for this publisher account. Google’s processing is governed by Google’s Privacy Policy and How Google uses information from sites that use our services.

Anyone who has the room link can try to join, up to the room’s seat limit. If the creator set a password, the room will not admit anyone who does not know it. People who get in will see live text and display names. Treat the link (and the password, if there is one) like a secret. Do not paste account passwords, government IDs, health information, payment details, or anyone else’s private data into a room.

Typing is sent through an in-memory relay and, when the connection succeeds, through a WebRTC data channel directly between browsers. Other people in the room receive your keystrokes. Castle Stream does not keep a copy after the room ends.

To connect you to a room, the relay sees ordinary connection data such as your IP address for as long as the socket is open. That address is used to keep the session alive. It is not used to build a profile and is not stored after disconnect.

If a peer-to-peer channel is established, other participants may also learn your IP address through standard WebRTC / ICE negotiation. Castle Stream uses a public STUN service (stun.l.google.com) to help browsers find a path to each other. Google’s handling of STUN traffic is governed by Google’s own terms and privacy policy, not this one.

• We do not sell personal information.
• We do not use room contents for advertising or training models.
• We do not require identity verification.
• We cannot recover a conversation after everyone has left. There is nothing to recover.

If data-protection law in the EEA or UK applies, the limited processing described here (operating an ephemeral session you asked to join) is based on taking steps at your request and on legitimate interests in running a real-time tool that does not retain conversation history. You can stop the processing at any time by leaving the room and closing the site.

Room state is kept only while at least one person is connected. Browser storage for your name and accessibility settings remains until you clear it. We do not operate a backend archive with a retention schedule because there is no archive.

Room IDs are random and unguessable in ordinary use, but they are not a substitute for encryption of highly sensitive material. Anyone with the URL can join. Your device, network, and the other people in the room are part of the trust boundary. Use Castle Stream accordingly.

• Leave a room to end your session and erase your local text.
• Do not share the invite link beyond people you trust.
• Clear this site’s data in your browser to remove a stored name and accessibility settings.
• Use the Accessibility control to reduce motion, pause the background, increase contrast, or enlarge text.
• Use Google’s Analytics opt-out add-on if you do not want Google Analytics to measure your visits.
• Use your browser’s ad / tracking controls, or Google’s ad settings, if you want fewer personalized ads.

If this policy changes, the date at the top will be updated. The live version on this page is the current one. Because Castle Stream does not collect emails, we cannot send notices.

Questions about this policy can be directed to the operator of the Castle Stream instance you are using. If you deployed Castle Stream yourself, you are the operator.