Start free

Updated October 7, 2026

Privacy policy

Castrook is a social publishing API. This policy explains how we process data to connect accounts, organize customer profiles, upload and schedule content, manage supported comments, display post performance, bill for paid plans, and operate the service. For privacy questions or complaints, contact support@castrook.com.

YouTube API Services

Castrook uses YouTube API Services. Connecting a YouTube channel lets Castrook identify that channel, upload videos you request, check their processing status, and retrieve and reply to comments. With your acceptance of this policy, we also read view, like and comment counts for your videos published through Castrook and display timestamped performance snapshots. We do not request audience, revenue or watch-time reports. Use of these features is subject to the YouTube Terms of Service. Google’s handling of information is described in the Google Privacy Policy.

Data we process

  • Your email address, workspace information, and preferences.
  • Customer or brand profiles and external references you provide to organize accounts, posts and uploaded media.
  • Connected-account and YouTube channel identifiers, names, handles, account types, granted permissions, and encrypted authorization tokens. For LinkedIn, this includes the member or Page you authorize; for Pinterest, the business account and boards you select. We do not receive your social-account passwords.
  • A one-way Google account identifier used to coordinate revocation across connections that share a Google authorization. We do not store the original identifier or request Google email or profile permissions.
  • Videos, photos and media URLs you submit, file checksums and dimensions, captions, titles, schedules, audience and visibility settings, and other publishing options. We also receive video identifiers and processing or delivery results from the destination platform.
  • Available performance counters for your published posts, such as views, reach, likes, comments, shares and saves, with the time we retrieved them. Availability varies by platform. Reports identify lifetime counters or the date range they cover; Pinterest reports cover a bounded date range. These reports do not contain audience profiles.
  • Short-lived connection-session records and policy acceptance receipts used to connect the accounts you choose and control performance-data access.
  • Requested comments and replies, including their text, author names, identifiers, timestamps, and like counts when available.
  • API request metadata, security and error records, and webhook delivery records.
  • For paid plans, billing records: customer, subscription and order identifiers, your plan, subscription status, billing period, amounts and currency. We never receive or store card details.
  • Usage records that apply your plan’s allowances: counts, identifiers and timestamps, never your content.
  • If you arrive through a partner’s link, a referral identifier and your referral-tracking choice.

Pinterest and LinkedIn

When you connect Pinterest, we read your account identity and available boards and sections, publish the image or video Pins you request, and retrieve available Pin impressions and saves. Your chosen board, title, description, link and accessibility text are sent with the Pin. When you connect LinkedIn, we read your authorized member identity or eligible Pages and publish the text, images, video or article links you request. Supported comment and performance features use only the permissions you grant. Page access depends on your role and the access available to Castrook.

You choose each destination and its available visibility settings before publication. The platforms process the content and account information under the Pinterest Privacy Policy and LinkedIn Privacy Policy.

Use and sharing

We use this information to perform your requested actions, display your connected accounts, delivery results and post performance, manage comments, apply plan allowances, bill for paid plans, secure the service, apply rate limits, and resolve support issues. Performance is refreshed periodically and when you request it, while the connection remains authorized. YouTube receives the video, metadata, or reply you choose to send. Other social platforms receive content only for the destinations you select.

Your data is available within your workspace and through API access you authorize. Webhook endpoints you configure receive the relevant delivery events. Authorized service operators and providers for identity, hosting, storage, payments, partner-referral attribution, and operational delivery process information needed to operate, secure, and support Castrook.

Castrook does not sell connected-account data, including Google or YouTube data. We do not use this data for advertising or profiling, or send it to AI services for processing or model training. Castrook does not serve advertisements.

Payments

Paid plans are sold through Polar, our merchant of record. When you check out, Polar collects and processes your payment details, billing address and tax information under its own privacy policy. Your checkout is linked to your workspace identifier so the plan applies to the right workspace. Castrook stores the customer, subscription and order identifiers, plan, status, billing period, amounts and currency that Polar reports, so we can apply your plan and show your billing history. Castrook never receives or stores card details.

Usage metering

To apply plan allowances, we count usage for each workspace and usage period: connected accounts, publications, media bytes, API requests, comment requests and new account connections. These records contain counts, identifiers and timestamps, not your content, and are deleted about 13 months after the period they cover.

Partner referrals

Castrook runs an affiliate program with Affonso, our affiliate platform. Only when you arrive through a partner’s referral link do we load Affonso’s tracking script. With your permission where it is required, the script stores a first-party cookie named affonso_referral for up to 60 days, so a purchase you make in that time can be credited to the partner.

In the European Economic Area, the United Kingdom and Switzerland, and wherever we can’t determine your location, we ask for your consent first. To decide whether to ask, we check the country your request comes from without storing it. Until you choose, no referral cookie is set, and the partner’s click identifier stays in the page address so the referral can still be credited if you allow it. If you decline, no referral cookie is set. Either way, we remember your choice in a castrook_referral_consent cookie for 180 days. Elsewhere, the referral cookie is set when you arrive through a partner link.

If you sign up or subscribe after a referral, we share your sign-up email address and workspace identifier with Affonso, and attach the referral identifier to your checkout, so the referral can be attributed. This applies only to referred users. Partners see the status of their referrals, such as sign-ups, conversions and commission amounts, never your content, connected accounts or workspace data.

If you join the program as a partner, Affonso processes your partner account, links, referrals, earnings and payout details, and payout identity and tax details are collected in the partner portal. The affiliate program terms describe the program.

Retention

User-authored posting requests, customer profiles and internal delivery records remain while your workspace is active, unless you request deletion. Request logs, cached comments, and webhook delivery attempts are retained for up to 30 days. Unused uploaded files are retained for 30 days. Files referenced by pending posts remain available through scheduled delivery and for at least seven days after delivery ends; you can then delete them. Temporary processing copies stop being accessible after 48 hours and are removed through bounded cleanup. Billing records are kept while your workspace exists and afterwards only as long as accounting, tax and other legal obligations require.

We periodically check YouTube authorization and refresh or remove stored YouTube API data within 30 days. Performance snapshots expire within 30 days unless refreshed, and unavailable data is not shown as current. Disconnecting immediately stops new actions through that YouTube connection. Castrook requests Google authorization revocation and removes the channel’s stored metadata, cached comments, performance snapshots and provider delivery data. During cleanup, a one-way authorization identifier and, if needed, an encrypted retry credential may be retained for up to six days. They are used only to finish revocation and cleanup, and removed sooner once that work completes.

Revocation through Google’s account settings also results in removal of associated YouTube API data after our authorization checks detect it, within 30 days of revocation. Disconnecting does not itself erase your authored publishing requests or internal delivery history. Workspace deletion removes those records too, except legally required information and the temporary cleanup identifier or retry credential described above.

Disconnecting Pinterest or LinkedIn removes the connection’s stored credentials and performance snapshots and stops new actions through it. Reconnecting requires fresh authorization. Your authored publishing requests and internal delivery history remain until you request their deletion; content already published remains on the platform.

Your control

You can revoke API keys, revoke customer connection links, remove unused files in Media, disconnect accounts in Connections, and request deletion using our data-deletion instructions. In addition, you can revoke Castrook’s access to your YouTube data directly from Google account permissions. Disconnecting or deleting Castrook data does not delete or change videos or comments already on YouTube or another platform.

Google revocation applies to the full authorization granted to Castrook. Other YouTube connections under the same Google authorization may also be disconnected and need reconnection.

You can also remove Castrook in Pinterest’s connected-app settings or LinkedIn’s permitted-services settings. Removing access prevents further authorized actions; reconnect in Castrook if you choose to grant access again.

Cookies and browser storage

We use cookies and similar browser storage for sign-in, account security, and preferences such as the selected test or live mode. The public demo stores its sample workspace and your demo changes in your browser. Our sign-in and hosting providers may use essential cookies to deliver and protect these functions. Partner-referral cookies are described under Partner referrals; you can clear them in your browser at any time.

Security and changes

API key secrets are stored as hashes. Connected-account credentials are encrypted at rest and are not returned by the API. We limit access to information needed for the service. No service can guarantee absolute security.

We may update this policy as Castrook changes. The date above identifies this version. If we introduce new uses of YouTube data beyond the policy you accepted, we will ask you to accept the updated policy before that new use.