This Privacy Policy describes how High Moon LLC (“High Moon,” “we,” “us,” or “our”) collects, uses, and shares information about you when you use Cast Away (the “Service”) at cast-away-app.com.
1. Information We Collect
Account Information
When you create an account through our authentication provider Supabase, we collect:
- Email address (required for one-time-link sign-in and account recovery)
- A salted, hashed password if you opt into password sign-in from Settings — we never see or store the password itself in plaintext
- Display name and avatar preference (chosen during signup)
Activity Information
As you use the Service, we store:
- Slates you create (including any private drafts)
- Votes you cast (Bravo / Boo on slates and individual picks)
- Films on your watchlist
- Users you follow (Crew connections)
- Direct messages you send and receive
- Badges you earn
- Tournament bracket participation
Payment Information
If you subscribe to Auteur, our payment processor Stripe handles your payment details. We do not store your full payment card number. We receive limited billing information such as your subscription status, the last four digits of your card, and your billing country.
Technical Information
We automatically collect:
- IP address
- Browser type and version
- Device and operating system information
- Pages visited and actions taken on the Service
- Timestamps of activity
Cookies and Similar Technologies
We use cookies and similar technologies for authentication (via Supabase), session management, analytics, and advertising measurement. The advertising pixels described in Section 4b allow Meta and TikTok to set and read their own cookies in your browser. You can control cookies through your browser settings, though some features of the Service may not function without them.
2. How We Use Information
We use the information we collect to:
- Provide, maintain, and improve the Service
- Authenticate you and secure your account
- Process subscription payments
- Display your public activity (Slates, votes, badges) to other users
- Send transactional emails (account notifications, receipts)
- Analyze usage patterns to improve the Service
- Detect and prevent fraud or abuse
- Comply with legal obligations
3. How We Share Information
We share information with the following third parties who help us operate the Service:
- Supabase — authentication, database hosting, and transactional email delivery
- Vercel — application hosting and analytics
- Stripe — payment processing for Auteur subscriptions
- JustWatch — streaming availability data and affiliate tracking
- TMDB — film and television metadata (we send film identifiers; TMDB does not receive your personal information)
- Meta (Facebook and Instagram) and TikTok — advertising measurement. These companies receive technical information about your visit, and a one-way hashed form of your email address and account identifier when you create an account. See Section 4b for exactly what is sent.
We may also share information:
- With law enforcement or in response to valid legal process
- To protect the rights, safety, or property of High Moon, our users, or others
- In connection with a business transfer (merger, acquisition, or asset sale)
We do not sell your personal information for money, and we do not share it with data brokers. However, our use of advertising pixels (Section 4b) may constitute a “sale” or a “share” of personal information as those terms are defined under California and certain other state privacy laws. You can opt out — see Do Not Sell or Share My Personal Information.
4. Public Information
By design, certain information is visible to other users of the Service:
- Your display name and avatar
- Slates you create
- Votes you cast on public Slates
- Badges you have earned
- Your Crew (followers and follows)
4a. Advertising
Free-tier users see display ads in some parts of the Service. When ads are enabled:
- The ad network may set cookies or similar identifiers and combine your activity on Cast Away with data it has observed on other sites to serve personalized ads.
- A consent banner on your first visit lets you reject non-essential cookies. Rejection limits ads to contextual (page-based) serving — no cross-site profiling. Your choice is stored in your browser and you can change it at any time by clearing site data.
- Auteur subscribers do not see display ads.
Any processing performed by the ad network is governed by the network’s own privacy policy and our agreement with it. The consent banner described above controls display ads only — it does not control the advertising pixels described in the next section.
4b. Advertising and Analytics Pixels
We advertise Cast Away on Facebook, Instagram, and TikTok, and we use measurement pixels from Meta and TikTok to understand which ads lead to signups. These pixels load on every page of the Service, for every visitor, including Auteur subscribers.
When you browse the Service, the pixels send to Meta and TikTok:
- The page address you are viewing
- Your IP address, browser, and device information
- Any identifiers those companies have already stored in your browser from their own services
When you finish creating an account, our servers additionally send Meta and TikTok a one-way (SHA-256) hashed version of your email address and of your Cast Away account identifier, together with your IP address and browser user agent.
Hashing obscures your email address but does not make it anonymous. A hash is a matching key: if Meta or TikTok already holds the same email address, it can match the hash to the account they have for you. The practical effect is that these companies can learn that a person they already recognize visited Cast Away and signed up. They may use that to measure our ads, to build or refine advertising audiences, and for their own purposes as described in their respective privacy policies.
We do not send these companies your slates, votes, watchlist, direct messages, or payment information.
To limit this:
- Use browser privacy settings or a tracker-blocking extension to block the pixels from loading.
- Adjust the ad and off-platform activity settings inside your Meta or TikTok account.
- Ask us to stop — see Do Not Sell or Share My Personal Information.
5. Data Retention
We retain your information for as long as your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, accounting, or security purposes.
6. Your Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Object to or restrict certain processing
- Receive a portable copy of your data
You can exercise most of these rights directly from your account settings or by contacting us at legal@cast-away-app.com.
California Residents
California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”):
- The right to know what categories of personal information we collect, the purposes for collecting it, and the categories of third parties to whom we disclose it
- The right to request access to, or deletion of, that information
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information
- The right not to receive discriminatory treatment for exercising any of these rights
Do Not Sell or Share My Personal Information
We do not receive money in exchange for your personal information. But the CCPA defines a “sale” broadly enough to cover disclosures made for other valuable consideration, and separately defines “sharing” to cover disclosures for cross-context behavioral advertising. Our use of the Meta and TikTok pixels described in Section 4b may fall within those definitions, so we treat it as though it does.
The categories of personal information involved are identifiers (a hashed email address, a hashed account identifier, and IP address) and internet or other electronic network activity information (pages viewed on the Service, browser and device information). The recipients are Meta and TikTok, and the purpose is advertising measurement and targeting.
To opt out, email legal@cast-away-app.com with the subject line “Do Not Sell or Share” and the email address associated with your account. We will suppress advertising-related disclosures for that account as soon as reasonably possible, and in any event within the time period required by applicable law. You do not need an account to make this request, and we will not charge you or degrade your experience for making it.
EU/UK Residents
If you are in the European Economic Area, United Kingdom, or Switzerland, you have rights under the GDPR. Our legal basis for processing your information includes performance of our contract with you, your consent, and our legitimate interests in operating and improving the Service.
7. Children’s Privacy
Our minimum age to create an account is 13. At signup you are asked to confirm that you are at least 13 years old; we rely on that attestation and do not use age-verification services beyond it. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at legal@cast-away-app.com and we will delete it.
8. Security
We use reasonable technical and organizational measures to protect your information, including encryption in transit (HTTPS), secure authentication via Supabase, and row-level security on our database. No system is 100% secure, and we cannot guarantee absolute security.
9. International Transfers
High Moon LLC is based in the United States. Our service providers may process your information in the United States and other countries. By using the Service, you consent to the transfer of your information to the United States.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated policy at cast-away-app.com/legal/privacy and update the Effective Date. For material changes, we will provide additional notice (such as an email or in-app notification).
11. Contact
Questions about this Privacy Policy? Contact us at legal@cast-away-app.com.
High Moon LLC
Illinois, USA