Privacy Policy

Castcard is run by Sunya LLC, a Wyoming limited liability company. We hold the record you build, and the handful of things a visit to your page tells us. We do not sell any of it, we do not track anyone around the web, and there is no third-party tracker on a Castcard page.

Your record: the name, bio, stats, credits, training and representation you type in, and the photos and videos you upload.

Your email address, because that is how you sign in.

Your date of birth. It is stored and it is never displayed. It is used for two things: confirming you are 18 or over, which everyone on Castcard must be, and offering a playing age.

Your contact email and phone number, if you give them. Neither is ever shown on your page. A message from the contact form is sent to you by email instead.

Profile data is in Supabase, in their Singapore region. Photos and videos are in Cloudflare R2 and are served from cdn.castcard.co. Email is sent through Resend. The site runs on Vercel.

Each of those companies holds this data to provide a service to us, and they are not allowed to do anything else with it.

Our analytics are first-party, which means we count visits ourselves rather than handing the job to someone who also sells advertising.

A page view records four things: the domain a visitor arrived from, the country their connection reports, whether they are on a phone, a tablet or a desktop, and a visitor hash that changes every day.

We do not store IP addresses. We do not store the full address a visitor came from, only the domain. We do not store the full browser string. There are no cookies for tracking and no third-party trackers of any kind.

The daily hash is what lets us tell one visit from ten without knowing who anybody is. It is built from things that identify a connection, it cannot be turned back into an address, and it changes at midnight, so nobody can be followed from one day to the next.

You see your own record and your own page statistics. We can see them too, because we run the service.

Your public page shows only what you put on the card. Your date of birth and your contact details are not on it.

A message sent through the contact form goes to the account holder by email.

We do not sell data, and we do not share it with anyone but the companies named above who help us run the service.

A reel is embedded from Vimeo or YouTube. Nothing reaches them until a visitor plays it, and once they do, that visit is between them and that service under its own privacy policy.

Assets are retired rather than deleted, so a record can be restored. A retired photo is off every page and out of the library, and it still exists.

Write to hello@castcard.co if you want your data exported, or the whole account deleted for good. Either way it is done within 30 days.

If this policy changes, we email every account holder to say so. It was last updated on 18 September 2026.