Your data, clearly.

1. At a glance

• The hosted client has no Castonaut user-account database and currently charges no fee. It does not ask for payment or a payment-wallet transaction.
• Farcaster posts, profiles, follows, reactions, and signer records are public network data. Do not treat a public cast as private.
• Your app signing key, Time Capsules, drafts, notes, and curation settings are kept in this browser. The hosted client does not sync them to a Castonaut account.
• Public feed and profile responses may be cached briefly in this browser and at Vercel’s edge. The device cache is bounded and excludes signer records and keys.
• Core search uses the configured Snapchain node: post search filters posts already loaded in the current feed, exact username lookup resolves a public profile, and channel lookup reads posts by channel URL. The node and hosting provider may process these query fields and request metadata. No Neynar search key is needed.
• Recovery phrase entry is optional. If you enter one, page code can read it while you use it. The app derives the first five standard account slots locally, checks their public addresses against Farcaster’s ID Registry, clears the field before lookup, and does not intentionally send or save the phrase or custody private key. A linked wallet avoids putting the phrase into the page.
• Production Vercel Web Analytics sends page-view events only after you opt in under About → Local by default.
• Feed media previews are on by default. Your browser requests media from hosts named in Farcaster data; those hosts can see your IP address. Turn previews off under Profile → Customize.
• Photo uploads are optional. When you choose Upload & attach, the selected image is uploaded directly from your browser to the operator’s public Vercel Blob store, then its URL is included in the cast. Anyone can access or copy that image URL.
• Optional GIF search sends search words through the app host to GIPHY. GIPHY sees the host’s outbound IP. The shared limiter stores a one-minute lock marker, not the search, FID, or account. The GIPHY key stays server-side.
• The application source is published under the MIT License. That lets others inspect and run the code; it does not mean the hosted service has been independently audited or that every deployment runs the same code.

2. Data and where it goes

Farcaster account and public network data

When you open a feed, Castonaut sends the requested numeric FIDs and other query fields to the Snapchain endpoint configured by the app operator. The feed service returns public casts, profile fields, follow links, signer records, and related network data. The app may query the Optimism ID Registry to match a custody address to an existing FID. Reads and writes are handled by Snapchain; the protocol network distributes messages that are accepted.

Social actions

If you post, reply, follow, like, or recast, your browser signs a protocol message with the limited app key and sends the encoded, signed message to the configured Snapchain service for relay. That message contains the information needed for the selected action and may become public network data. A successful relay is not a guarantee that every client will display it or that it cannot later be removed under protocol rules.

Search

Castonaut does not use a third-party search API for its core search tools. Post search filters posts already loaded into the current feed in this browser. Exact username lookup and channel post lookup use the configured Snapchain endpoint through Castonaut’s same-origin proxy. The node receives the requested username, channel URL, pagination fields, and the hosting provider’s outbound request metadata; Castonaut’s proxy uses the connecting IP transiently for rate limiting. The results depend on what the configured node has indexed and can provide. The hosting provider may separately process request metadata in platform logs. These searches do not send your recovery phrase, custody key, or app signer.

Recovery phrase and custody key

The optional phrase flow processes the phrase in page memory and derives the first five standard account slots locally. The app checks their public custody addresses against the public Optimism ID Registry and uses the first matching Farcaster account. The phrase field is cleared before those network lookups. The app does not intentionally send the phrase or custody private key to Castonaut’s server or the registry, and it does not store them in localStorage or IndexedDB. This describes the source code and header configuration reviewed in this repository; it cannot verify what a live deployment actually serves or what browser extensions, malware, developer tools, or a compromised device may do. The page can read a phrase while it is entered. The app shell references only its same-origin application script and styles; it does not include third-party-hosted JavaScript. Vercel's same-origin analytics script is injected only after opt-in, with automatic route tracking disabled. Its production Content Security Policy blocks inline scripts, inline event handlers, frames, and object embeds. The app still makes first-party service requests and, when features are used, direct requests to Optimism, Base, and user-selected HTTPS media hosts. Only enter a phrase on a deployment you control after verifying the live source and headers. A linked wallet avoids putting the phrase into the page.

Wallet providers

If you connect a wallet, its browser extension or wallet provider receives the connection and signing requests. The selected wallet provider may process your IP address, wallet address, and signature metadata under its own terms. Castonaut does not request token approvals or payments. The app-key authorization for Farcaster is a separate typed signature, not a token approval or blockchain transaction.

Hosting and service requests

In hosted mode, your browser requests Castonaut’s web host and same-origin Snapchain API. The function uses the connecting IP address transiently in memory to apply a per-instance rate limit. For photo upload-token requests, a short-lived SHA-256 prefix derived from that address is sent to the operator-configured Redis rate limiter; the key expires within 30 minutes. Castonaut does not intentionally store the raw address in its own user database. Successful public read responses may be cached briefly at Vercel’s edge under their query URL; browser responses remain no-store. This can reduce repeat work on the Snapchain node, while a refresh request bypasses the shared cache. The hosting provider may process IP addresses, device/request metadata, diagnostics, and platform logs to deliver, secure, and operate the service; its own retention and use are governed by its privacy notice and your deployment configuration. The configured Snapchain node receives the application’s requests from the host’s network egress and can process the request fields and signed messages sent to it.

When you use GIF search, your browser sends the search text to Castonaut’s same-origin endpoint. The endpoint applies the shared cooldown through operator-configured Redis and calls GIPHY with the server-side GIPHY key. GIPHY sees the search text and the hosting provider’s outbound IP, not the browser’s direct request IP. The Redis service records only a global GIF-search lock marker that expires after 60 seconds and receives no search text, Farcaster ID, or account details. Photo-upload rate limiting stores a short-lived hash of the request IP in Redis; it does not store the raw address there. Hosting providers may process request metadata under their own terms.

Links, embedded media, and photo uploads

Link cards are built from the URL already present in a cast; Castonaut does not fetch a remote preview service. Pasted links and GIF selections are attached as URLs. If you choose a local photo and then select Upload & attach, Castonaut issues a short-lived, size- and type-limited Vercel Blob upload token. The browser sends the image directly to the operator’s public Blob store; the image does not pass through Castonaut’s function. The browser then puts the public image URL in the cast embed. The hosting provider may process your IP address and request metadata, and Vercel Blob receives the image bytes. Uploads are optional and do not happen just by choosing a file. A public image URL can be copied, cached, or fetched by anyone; removing the local draft or cast does not guarantee deletion of the stored image or copies. The current client does not provide an image deletion control. Do not upload private or sensitive images.

If you open an external link, the destination site receives your request and may see your IP address and browser information. Post images and GIFs load by default; your browser directly requests the relevant media host. Media is loaded lazily and without a referrer, but the host still sees the request and IP address. Turn post media off under Profile → Customize.

3. Information kept in this browser

Castonaut stores settings and personal lists on this device:

• IndexedDB app key store: the separate Ed25519 app key as non-extractable Web Crypto key material, its public key, FID, and custody address. Browser storage is not hardware-backed custody. Anyone controlling this browser or device may use the app or inspect stored metadata.
• IndexedDB public read cache: up to 32 recent public query responses, each capped at 1 MB. Route-specific expiry ranges from 30 seconds to 6 hours. It excludes signer records, keys, and write requests; accepted writes clear the cache. Expired entries are ignored and removed on lookup; entries are evicted as the cache fills. Clearing site data removes them all.
• Local storage: theme and voice; up to 14 Time Capsules with up to 30 visible posts each; Desk pins, saved posts and topics; profile notes and cover choices; Circle and Group lists; mutes, filters, scroll positions, drafts, pending posts, and your analytics choice.
• Temporary page memory: the recovery phrase during local derivation, then the derived account signer during authorization; feed responses and pending UI state. Closing the dialog or finishing authorization clears the signer reference. JavaScript cannot guarantee secure memory erasure.

Settings do not sync. You can export a backup of Desk pins, saved posts, Time Capsules, notes, and selected preferences. It is created in your browser and never uploaded. It may contain post text and private notes; keep it safe. Anyone with access to your unlocked browser may see local content. The backup excludes keys, phrases, and drafts. Restoring replaces matching local values after confirmation. “Forget this browser” deletes the local app key but does not revoke it on Farcaster; revoke it separately in signer settings.

4. Your choices

• Analytics: opt in or out under the app’s About page. With no opt-in, the app’s Vercel Analytics hook drops the event before sending it. Your choice is kept locally on this device. Opting out stops future events; it does not delete historical aggregate data already collected by Vercel. Clear site data to reset the choice.
• Post media: media loads by default. Turn “Load GIFs and post images” off under Profile → Customize to prevent direct image requests from this browser.
• Recovery phrase: use a linked wallet if you do not want the page to handle a phrase. Never enter a phrase into an untrusted site.
• Local data: clear this site’s browser storage or remove individual local items in the app. Revoke a protocol signer separately through Farcaster.
• Public protocol data: Castonaut cannot erase or control network data. Use the protocol’s account and message-management tools where available.

5. Optional Vercel Web Analytics

In production, Castonaut’s client, Node page, Guide, Field Notes, Privacy, and Terms pages use @vercel/analytics only when you have opted in. It sends page views only; Castonaut does not send custom events, feed text, FIDs, wallet addresses, recovery phrases, profile notes, or saved casts to analytics. Before an event is sent, Castonaut removes the URL query string and fragment. Vercel describes Web Analytics as using a short-lived hashed visitor identifier rather than third-party cookies, with aggregated reporting; page-view data can include timestamp, page path, referrer, coarse location, operating system/browser, and device type. See Vercel’s Web Analytics privacy documentation. Vercel separately processes technical data to host and secure the site under its Privacy Notice.

6. Providers, open source, and self-hosting

The hosted service relies on the operator’s web host and Snapchain endpoint, the Optimism public network and registry, and—if you choose them—your wallet provider, GIPHY for GIF search, the operator-configured Redis service for shared cooldowns and upload limits, Vercel Blob for optional public photo uploads, external image hosts, and external link destinations. Each provider can process data needed to provide its service under its own policies. Castonaut does not control their security, uptime, or retention. The operator must list the actual deployment providers and relevant privacy notices here before public launch.

The application source is available at github.com/wlplease/castonaut under the MIT License. Open source code can be inspected, copied, modified, and self-hosted under that license. The source repository is not a data controller for every independent deployment. If you use a self-hosted or modified copy, its operator controls that deployment and is responsible for its privacy notice, providers, logs, security, and legal compliance. The public source does not certify a hosted build, guarantee that it has been audited, or guarantee that a deployment matches the repository.

The hosted client does not use advertising pixels or a Castonaut account cookie. It does not currently run targeted advertising. GIF search is optional and routed through the app host; feed, profile, follow, post, reaction, and direct media-link features do not require you to enter a third-party API key.

7. Retention, security, and limitations

Local settings and saved material remain until you remove them, the browser evicts them, or you clear site data. Browser storage may be cleared by private-browsing settings, storage pressure, device cleanup, or browser failure. The app’s in-memory rate-limit counters are used for request control and are not written by this app to a database. Public read-cache entries expire or are evicted as described above. The operator has not committed to a fixed retention period for hosting, function, security, or node logs; infrastructure providers and independent node operators may apply their own retention periods. Analytics retention is controlled by Vercel and the applicable deployment plan. Copies of signed messages and public data may remain on independent protocol infrastructure even if a client removes a local display.

The hosted service uses technical and organizational safeguards that are available in its code and hosting configuration, but no method of storage, transmission, access control, encryption, or incident response can guarantee that information will never be accessed, altered, lost, or disclosed. The service may be affected by browser vulnerabilities, device compromise, malicious extensions, credential theft, provider incidents, configuration mistakes, denial of service, or protocol-level risks. Castonaut does not warrant a particular security level, uninterrupted service, recoverability, or that every vulnerability will be found or fixed. Keep your browser and device updated, use a screen lock, protect recovery material, review signer permissions, avoid shared devices for authorization, and revoke a signer promptly if you suspect misuse.

If the operator becomes aware of an incident involving information it controls, it may investigate, contain, and take steps it considers appropriate, including notices when required by applicable law. The operator cannot promise advance notice, a particular response time, recovery of affected information, or notice about incidents in systems operated solely by independent providers or network participants. Provider incident handling is governed by that provider’s terms and practices.

Requests to remove data can affect only systems the relevant operator controls and only to the extent technically and legally possible. Clearing this browser does not delete a server log, provider record, protocol message, or another person’s copy. Revoking a signer stops future use of that signer when the protocol recognizes the revocation; it does not undo actions already accepted or guarantee immediate propagation to every node.

8. U.S. privacy requests, children, and changes

Privacy rights depend on your state, the information involved, and applicable law. Depending on those rules, U.S. residents may be able to ask for access to, correction of, deletion of, or a copy of certain personal information, or to opt out of certain processing. Legal exceptions, identity checks, scope limits, and response periods may apply. To make a request, the operator needs to provide a monitored privacy contact and a reasonable identity-verification process. Those contact details are not available yet, so this request process is incomplete and must be finished before public launch. Do not include a recovery phrase, private key, or seed words in a request.

Castonaut does not currently maintain a user-account database. You can clear most app preferences and local information in your browser. A request to the operator cannot erase public protocol records held by independent network participants. The operator can only respond for systems it controls and will direct you to the relevant network or provider for information it controls. This notice does not promise that a request can be matched to an anonymous browser, protocol address, or public message without additional information or verification.

Castonaut is intended for a general audience and is not designed for children under 13. Do not use it if you are under 13. The operator has not built an age-verification or parental-consent process for this client. If the operator learns that personal information from a child under 13 was collected by a system it controls, it will assess and take steps required by applicable law. This statement does not represent that the hosted service is suitable for children or that a third-party network complies with child privacy rules. See the FTC’s COPPA guidance.

This notice may change as the client, providers, or law changes. The current version and effective date appear above. Material changes should be announced in the app or its official distribution channel. Where required, the operator will obtain consent before applying a material change to prior collection or use. The operator may retain prior versions for compliance, dispute resolution, and operational records. Your continued use is subject to applicable notice and consent requirements; it does not waive rights that cannot be waived.