Privacy Policy
Last updated: July 2026 · cast-away.net
Castaway is designed from the ground up to collect as little data as possible. No account is required, no tracking is used, and all messages are encrypted before being stored. This policy explains what is processed and why.
Castaway is operated at cast-away.net. For data protection enquiries, contact us at:
Email: privacy@cast-away.net
Website: https://cast-away.net
Message content
When you submit a message, the text is encrypted on your device using AES-256-GCM before being transmitted and stored. The encrypted content is stored in our database. We cannot read your message without the encryption key embedded in the site code.
Submission timestamp
The date and time of submission is stored alongside your message. This is used only for the automatic 365-day deletion policy.
IP addresses in server logs
Like all websites, our web hosting provider (Spaceship.com) and database provider (Supabase) automatically log IP addresses as part of standard server operation. These logs are retained for a short period by those providers for security and diagnostic purposes. We do not access, store, or process these logs for any purpose.
Browser storage
We use sessionStorage to enforce a 60-second cooldown between message submissions. This is essential site functionality, expires when you close your browser tab, and contains no personal information. We use localStorage solely to remember that you have dismissed this privacy notice.
No cookies are set by Castaway.
We use two external services to operate Castaway. Both process data on our behalf under appropriate agreements:
Supabase, Inc.
Our database provider. Encrypted messages are stored on Supabase infrastructure located in the United States (East US — North Virginia). Supabase is certified under the EU-US Data Privacy Framework and provides a Data Processing Agreement. More information: supabase.com/privacy
Spaceship.com
Our web hosting provider. Website files are served from Spaceship servers. Standard server access logs may be retained by Spaceship according to their own privacy policy: spaceship.com/legal/privacy-policy
Fonts
All fonts are self-hosted on cast-away.net. No requests are made to Google Fonts or any other external font service.
Your message content is stored on Supabase servers in the United States. This transfer is covered by Supabase's participation in the EU-US Data Privacy Framework, providing an adequate level of protection for personal data transferred from the European Economic Area.
If you are located in the European Economic Area (EEA), you have the following rights:
Important note on erasure: Because messages are submitted anonymously with no account or personal identifier, we are unable to link a stored message to a specific individual using only an email address or name. To exercise your right to erasure for a specific message, please use the deletion code shown to you at the time of submission. You can do this at cast-away.net/delete. If you no longer have your deletion code, contact us and we will discuss available options.
To exercise any of these rights, contact us at privacy@cast-away.net. We will respond within 30 days.
You also have the right to lodge a complaint with your national data protection authority. In the UK this is the ICO (ico.org.uk). In Ireland it is the DPC (dataprotection.ie).
All messages are encrypted on your device using AES-256-GCM before transmission. Data in transit is protected by TLS (HTTPS). We apply HTTP security headers including Content-Security-Policy, HSTS, and X-Frame-Options. Database access is restricted using Row Level Security.
Castaway is not directed at children under the age of 16. We do not knowingly collect data from children. If you believe a child has submitted data, contact us and we will delete it promptly.
If we make material changes to this policy, we will update the "Last updated" date above. Continued use of the site after changes constitutes acceptance of the updated policy.