The short version
Castaway TV doesn't have user accounts, doesn't run analytics, doesn't show ads, doesn't use tracking or advertising SDKs, and doesn't use a crash-reporting service. The app doesn't send your watch history, favorites, or settings anywhere, they stay on your device.
You point Castaway TV at content sources you choose yourself (playlist links, add-on catalogs). The app connects to those servers directly from your device. We never see that traffic and we don't operate any of those servers.
The only network calls the app makes on its own are: (1) a version check against our own server, so the app knows an update exists, (2) household sync, if you turn it on, (3) the one-time trial registration, and (4), once purchases exist, the license exchange and an occasional license status check. All of them are described below, in full, because they're the only real data flows there are.
Who we are
Castaway TV is developed by Jones Innovations (castaway.watch). For anything in this policy, or to exercise any of the rights described below, contact:
For the purposes of GDPR, Jones Innovations is the data controller for the limited data flows described in this policy that involve personal data, see "What data actually moves" below for which ones those are.
What data actually moves
Stored only on your device, never sent to us
Watch progress, favorites, hidden-category preferences, playback settings, your list of added playlists and installed add-ons, and diagnostic files (a rolling crash log and sync diagnostics, which may include nicknames you've given your TVs) all live in local app storage on your device. None of it is transmitted to us. A diagnostic file only leaves your device if you personally attach it to an email or message to support, that's your choice each time, not something the app does automatically.
Content sources you add, direct connections, not through us
When you add a playlist link or install an add-on, the app fetches from that server directly, from your device. We don't proxy, log, or see any of these requests. What that source sees (your IP address, the titles you request) is between you and whoever runs that server, read their privacy policy, not ours, for that.
Title information, artwork and subtitle search come from metadata services run by their own projects, not by us. When you browse or search, the app sends only what's needed to look up a match, a title or an identifier, directly from your device to those services. They are never used to fetch or play video.
Update check
On a schedule, the app asks a server we run (a Cloudflare Worker) for the current version number, so it can tell you an update is available. That request necessarily exposes your IP address and standard HTTP request metadata to Cloudflare, our hosting provider, the same as visiting any website. No account identifier, device ID, or usage data is sent. We don't log or retain this beyond Cloudflare's standard, short-lived infrastructure logs, and we don't use it for anything besides serving you the correct version information.
Legal basis (GDPR): legitimate interest, keeping the app functional and up to date (Art. 6(1)(f)).
Household sync (optional, off by default)
If you turn this on, your watch progress, favorites and settings are encrypted on your device and uploaded as an opaque blob to a relay we run (a Cloudflare Worker with storage). The encryption key never leaves your own devices and is never sent to us, so the relay stores a blob we have no way to decrypt. The relay sees your IP address and standard request metadata, the same as the update check above, plus a random household identifier that is not tied to you, your email, or your device. The relay keeps only the last few revisions, so your TVs can exchange them, and drops a household's blob altogether after six months without a write. We keep no logs of these requests. We are the data controller for the relay traffic and for holding the encrypted blob, but we cannot access its contents.
Legal basis (GDPR): performance of the sync feature you asked for (Art. 6(1)(b)).
Trial registration
The fourteen-day trial is recorded against the device so that reinstalling the app does not restart it. When the trial starts, the app sends our Cloudflare Worker a one-way SHA-256 hash of the device's Android ID combined with a fixed app value. We never receive the Android ID itself, and the hash cannot be turned back into it. The Worker stores the hash with the date the trial began and answers with a signed trial record the app keeps on the device. The hash is a persistent pseudonymous identifier for that device, which is personal data under GDPR even though it is not linked to a name, email or account. It is used for nothing but the trial and is kept for up to two years.
Legal basis (GDPR): legitimate interest, keeping the free trial to fourteen days per device (Art. 6(1)(f)).
License purchases (upcoming feature)
Buying a license works like this:
- The app requests a short, random claim code from our Cloudflare Worker and polls it for a signed license file. This exchange sends no personal data, no account, and no device identifier, just the claim code itself.
- A payment processor collects your card details in a secure checkout. Our app and license service do not receive or store your card number. The license service receives the payment status, purchase identifier, claim code and receipt email. It stores a one-way hash of the email address so you can recover your license after reinstalling.
- Once payment clears, the app receives a signed license file over the claim-code exchange above and stores it on your device. Afterward, the app verifies the license offline. About once a month, when the TV is online, it asks our Worker whether that license is still valid, sending only the license's own random id. That check exists so a refunded or charged-back purchase can be switched off; if the check cannot be made, nothing changes.
For questions about a charge, refund, receipt or license, contact [email protected].
What we don't do
- No user accounts or sign-in
- No analytics or telemetry, in-house or third-party
- No advertising, and no advertising or attribution SDKs
- No crash-reporting service, crash logs stay in local storage unless you choose to send one yourself
- No sale or sharing of personal information, to anyone, ever
- No advertising ID, IMEI or serial number collected. The trial uses a one-way hash of the Android ID, described under Trial registration, and nothing else does
Your rights (GDPR)
Because we hold almost nothing, there's rarely anything to look up, but where it applies, you can ask us to:
- Access what we hold about you
- Correct it if it's wrong
- Delete it
- Restrict or object to our processing of it
- Receive a copy in a portable format
In practice this applies to: content of any email you've sent us (including a diagnostic file you chose to attach), and the short-lived Cloudflare request logs described above (ask Cloudflare directly for anything beyond what we can see, see https://www.cloudflare.com/privacypolicy/). For questions about your purchase information, contact [email protected].
You can also lodge a complaint with your local data protection authority at any time.
California residents (CCPA/CPRA)
The CCPA applies to businesses that meet specific size or data-volume thresholds, broadly, over roughly $26.6 million in annual revenue, or buying/selling/sharing the personal information of 100,000+ California consumers or households a year, or getting half or more of revenue from selling personal information. Jones Innovations meets none of these, so the CCPA does not apply to us as a matter of law. Regardless of that, the practical answer is the same one as everywhere else in this policy: we don't sell or share your personal information, we don't collect more than described above, and if you'd like anything described in this policy corrected or deleted, contact us and we'll handle it as if the law required it.
Children's privacy
Castaway TV is not directed at children and we don't knowingly collect personal data from anyone, of any age, there's no account or profile system for the app to attach data to in the first place.
Security
Household sync data is end-to-end encrypted before it leaves your device; we never hold the key. Update checks and license exchanges run over HTTPS. We don't operate a database of user accounts or payment information, so there's no such database to secure or that could be breached.
Changes to this policy
If what the app does changes, this page will change with it. We'll update the "Last updated" date above; material changes (for example, adding a new data flow) will also be called out in the app's release notes.
Contact
[email protected]
castaway.watch