Privacy

Beta privacy

This page is available before you activate an invitation.

Membership

Cloudflare D1 stores your email, invitation status, passkey public keys, sessions, observed passkey names and use times, and email delivery status. Queued invitation codes are encrypted and removed after processing or expiry. Your fingerprint, face and device unlock code stay on your device.

Profile pictures

You can choose a royal avatar or explicitly upload a photo in Settings. Photos are cropped and resized on your device, then stored encrypted with your membership account. They are visible to you and the beta owner, excluded from agent context and workspace backups, and never included in invitation emails. You can remove your photo in Settings by choosing Use royal avatar. Your selected avatar and update time are stored as account metadata.

Online workspace

You choose whether to create an online workspace. Record text, suggestions, workspace and agent names, permission request reasons, agent action reports and audit details are encrypted in account storage using a separate key for each workspace. The hosted service can decrypt context to answer approved agent requests while your browser is closed. This is encryption at rest, not end-to-end encryption.

Record types, scopes, identifiers, revision numbers, action categories and status, alert-read and email-delivery status, timestamps, grant expiry and connection status are stored as metadata. Agent access and refresh tokens are stored as digests. OAuth client names and registered callback addresses are public client metadata. A connected provider receives only the context its access permits and handles received copies under its own terms.

Personal Squots

Squot profiles, examples, requests and answers are encrypted in your workspace. Record recall searches approved context without a model call. Hosted writing and planning send the selected context, required rules, training examples and your request to Cloudflare Workers AI after you enable hosted execution for that Squot. Learning starts off; corrections wait for your approval in Records. Daily execution counts and feedback status are stored as metadata. Squot removal clears its profile and answer history; approved personal Records remain until separately removed.

Optional source processing

When an operator-configured processor is available, you can explicitly send selected notes, approved records or a selected PDF for candidate extraction, relevance ranking or reference-text conversion. Consent applies to that selected operation. Candidates require normal owner review before approval. Processing results and vectors are not retained by the bridge; content-free operation identifiers and compute counts are retained for replay protection and budgets. No processor or model download is required for ordinary workspace use.

Local workspace

Local mode keeps its encrypted workspace on your computer. Existing local data is never uploaded automatically. Import and export are explicit actions. Remote providers require internet access.

Saved drafts

Record, handoff and Squot drafts are encrypted in your workspace for up to 30 days after their last save. They are never included in connected-agent context. The browser reports whether an account save was confirmed and retains unsaved edits in the open tab if a save fails.

Browser and service data

The browser remembers whether you paused the decorative animations in Your Keep. This preference grants no access and contains no records or character names.

Secure, HttpOnly session and challenge cookies support sign-in. The browser keeps the notification-enabled setting and the latest workspace audit sequence and hash under castellan-receipt:<workspace-id> in local storage. It also keeps a non-secret activation preference under castellan-activated to show passkey sign-in first, and whether you hid the Squot guide under castellan-guide:<workspace-id>. Neither grants access. It does not store record contents or agent tokens there. When you enable browser alerts, session storage remembers previously shown notification identifiers. Optional email alerts go to your membership address and contain action categories and a Watchtower link. Action details remain in the workspace. Rate-limit identifiers are hashed. Cloudflare processes connection and delivery metadata. There are no advertising, analytics scripts or email tracking pixels.

Feedback

When you explicitly send feedback with a Squot, your written message, selected Squot name and optional page name are sent to the Castellan feedback mailbox and private GitHub issue tracker. Your records, skills and account email are not attached automatically. If you choose to include your account email for a reply, it goes only to the feedback email, not the issue. Pending messages are encrypted for up to 24 hours and removed after processing; submission and delivery metadata, owner triage notes and reply drafts are retained for up to 30 days. The owner can send a reviewed reply only to an address you included for that purpose. Queued replies are encrypted, expire within 23 hours, and their queued message bodies are removed after processing. Email and GitHub copies remain in those services. Feedback from a local workspace uses your email app or the copy option, without a hosted submission.

Owner administrative activity records the action type, authentication method, timestamp and outcome for up to 180 days. It does not copy form contents, email addresses or personal context into that history.

Delete and export

Record edits retain encrypted version history so you can restore an earlier version. Removing a record also removes its version history. Action-result reviews record your own confirmation or concern separately from agent reports.

Settings provides a complete password-encrypted workspace backup with source history, Squots, answers, preferences and drafts. Restore requires review and an empty destination workspace. Historical activity is imported as a separate archive; agent credentials and account passkeys are excluded. Hosted Squot execution and email alerts require fresh choices after restore. Workspace deletion requires a fresh passkey confirmation. Deletion removes the active workspace, its wrapped encryption key, grants and agent credentials. Cloudflare backup retention can delay removal of encrypted backup copies. Copies already received by an agent or exported by you are outside this deletion. Beta membership remains until separately removed.

Signing out ends your browser session. Agents stay authorized until you end their access, their grant expires, or beta membership is revoked. For membership removal or privacy questions, contact contactus@castellan.us.

Email updates

Newsletter addresses are stored encrypted in a separate mailing-list table, with signup source, time and subscription status. Website signup and owner-added entries do not create beta membership. Newsletters include an unsubscribe link and have no open or click tracking. Delivery uses the configured Cloudflare Email Sending or Resend service. Subscription and delivery status are retained to honor opt-outs and prevent duplicate sends. Unsubscribing does not end beta access. Contact contactus@castellan.us for removal requests.