PRIVACY NOTICE

Castdeck (the "Software") is made and sold by Avalon Holding Partners LLC, doing business as Avalon Partner ("we", "us"). This notice explains what the Software sends, to whom, and what we keep. Questions or requests: Joshua.amado@avalonpartner.com.

• Castdeck runs on your own PC and keeps your settings there.
• The Software has no analytics, no crash reports and no usage statistics.
• The only time it talks to us is to activate, deactivate and, at most every 30 days, refresh a Pro license. Free users who never enter a key never contact us.
• Phones and tablets on your Wi-Fi talk to your PC directly, not through us.

Only these connections, and only when you switch the feature on:

• OBS: the address in Settings, this PC (127.0.0.1) by default.
• Twitch chat: Twitch's official chat servers. If you log in with Twitch for follows and the viewer count, also Twitch's official API. The login is kept on your PC.
• YouTube chat: YouTube's official API, with your own API key.
• Kick chat (Pro): Kick's website and chat feed for your channel.
• TikTok chat (Pro): read from TikTok LIVE Studio on this PC (127.0.0.1).
• Social Stream Ninja: its local relay on this PC by default, or its hosted relay if you pick that.
• Discord member count: Discord's public invite lookup, only with that module on.
• Webhook: the address you set, HTTPS only, only with that module on.
• TikTok LIVE Studio control: this PC only (127.0.0.1), only with that module on and the risk note accepted.
• License server: only after you enter a key. When you activate or deactivate, and at most every 30 days after that, it sends the key, a device code and the Castdeck version.

Nothing else. No analytics, no crash reports, no usage statistics and no update checks. If an update check is added later, it will be listed here first.

Your settings, passwords and keys (OBS password, phone passcode, chat logins and API keys, webhook address), chat, queue, votes, results, logos and sounds. They are not sent to us.

Checkout is run by Stripe. Stripe collects your payment details and email address under its own privacy policy and sends you the payment receipt. We never see your full card number.

From Stripe we keep: your email address, the purchase date, the checkout and payment reference (for refunds and support) and, for renewals, the key you typed.

Your key is shown on screen right after payment. That page works for 30 days after the purchase. We do not send newsletters, and we only write to you if you write to us.

For each key it stores the key, your email address, the purchase date, the date your updates run until, the number of PCs allowed and whether the key was switched off. For each PC the key is active on, it stores:

• a device code: a one-way hash made on your PC from its Windows machine ID. The machine ID itself never leaves your PC, and the code cannot be turned back into it.
• the Castdeck version, and the first and last time that PC checked in.

To slow down key guessing, it keeps a short hash of your IP address with the time of each activation try and each visit to the key page, for about a day. Your IP address itself is not stored.

The license token saved on your PC contains a key ID and a hash of your email address, never your email address itself.

The Castdeck page on avalonpartner.com loads no analytics, no cookies, no trackers, no ads and nothing from other sites. Like any web host, our host handles your IP address and the request (page, browser, time) to deliver the page and protect it from attacks. Other pages of avalonpartner.com, including this one, are covered by the site's own setup, which may use analytics.

• License and purchase records: as long as the key exists, and as long as tax and accounting law requires for the purchase.
• Device records: until you deactivate that PC or ask us to remove them.
• Rate limit records: about a day.

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Purchase records we must keep for tax law are kept until that period ends. Write to Joshua.amado@avalonpartner.com. If you are in the EU or UK you can also complain to your data protection authority. We do not sell your data and do not use it for advertising.

• Stripe (payments)
• Cloudflare (the license server and its database)

If we change what the Software sends, we update this notice first.

Avalon Holding Partners LLC (doing business as Avalon Partner), Massachusetts, USA. Joshua.amado@avalonpartner.com, avalonpartner.com