Overview

Castle App is an Android streaming application distributed as a direct APK download from castleapkhd.com. This policy applies to the app itself and to this website. It does not apply to third-party sites or services you may reach through the app.

Two principles shape everything below. First, the app is built to work without an account — you can install it, browse the catalogue, and watch without ever giving us your name, email address, or phone number. Second, anything we do collect exists to keep the app running and to fix what breaks, not to build a profile of you for advertising.

If you are in India, this policy is written to align with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the rules made under it. Where the app is used elsewhere, we apply the same practices.

What We Collect

Collection is limited to what is technically necessary to operate a streaming app. In practice, that means:

  • Device and technical information. Android version, device model and manufacturer, app version, screen resolution, and the language setting the app is running in. This tells us whether a crash is specific to one device family or affects everyone.
  • Crash and diagnostic logs. If the app fails, a stack trace and the sequence of screens leading to the failure may be sent to us. These logs are tied to a randomly generated installation identifier, not to your identity.
  • Playback and usage signals. Which titles are opened, whether playback starts successfully, buffering events, and chosen quality level. We use this to measure whether streams are healthy and which content should be cached closer to users.
  • Download activity. Which titles are downloaded and at what resolution, so we can manage bandwidth and storage guidance. The downloaded files themselves stay on your device and are never uploaded.
  • Approximate region. A coarse, country-level location derived from your IP address, used to route you to an appropriate content and language configuration. This is not GPS location.
  • Information you send us voluntarily. If you email support, we receive whatever you include in that message — typically your device details, a description of the problem, and any screenshots or attachments.

We do not require registration, and we do not ask for your name, email address, or phone number to use the app.

What We Never Access

This list matters more than the one above, because it defines the boundary of what the app is technically capable of doing:

  • Your contacts, call logs, and SMS. The app does not request these permissions and cannot read them.
  • Precise location. We do not request GPS or network-based fine location. Region routing uses IP address only.
  • Your photos, videos, and personal files. The app writes downloaded content into its own app-specific storage. It does not scan your gallery or documents.
  • Microphone and camera. Never requested. There is no voice search or camera feature that would need them.
  • Other installed applications. We do not query the list of apps on your device.
  • Passwords and financial details. No account means no password. We do not process card, UPI, or bank information, and no member of our team will ever ask you for an OTP.
Third-party content is outside our control. Castle App is an independent streaming application and is not affiliated with any third-party content provider. Some titles may link out to external players or sites. Those destinations have their own privacy practices, which we cannot govern and which this policy does not cover. Check their policies before sharing anything with them.

Permissions and Why the App Asks

Every Android permission has to be justified, and you should expect a clear reason for each. Castle App requests four:

  • Internet access. Required to stream and to fetch the catalogue. Without it the app cannot function at all.
  • Network state. Lets the app detect whether you are on Wi-Fi or mobile data so it can warn you before a large download consumes your data pack.
  • Storage access (scoped). Used to save downloaded titles and to free space when you delete them. On Android 10 and later this is limited to app-specific directories.
  • Foreground service / notifications. Keeps a download running when you switch away from the app, and shows progress. You can revoke this at any time in Android Settings → Apps → Castle App → Permissions.

Revoking a permission does not break the app entirely — it only disables the feature that depends on it. Declining notifications, for example, disables background downloads but leaves streaming untouched.

Cookies and Identifiers on This Website

This website is a static set of pages. It does not set advertising cookies, does not run a remarketing pixel, and does not embed social media tracking scripts. Any cookie present is either a functional preference or is set by the font delivery service used to render typography consistently.

Inside the app, we use a randomly generated installation identifier to group crash reports from the same install. It is not derived from your hardware, is not shared with advertisers, and is regenerated if you uninstall and reinstall the app. We do not use the Android Advertising ID for behavioural targeting.

Why We Process Your Data

  • To deliver the service you requested — streaming, downloading, and remembering your language preference.
  • To keep the app stable and secure — diagnosing crashes, detecting abuse, and preventing fraudulent traffic.
  • To understand what to improve — aggregated, non-identifying metrics on which features are used and where playback fails.
  • To meet legal obligations — responding to valid legal requests and copyright notices.

We do not sell personal data. We do not rent it, trade it, or hand it to data brokers.

Your Rights Under the DPDP Act

If you are in India, the DPDP Act gives you specific, enforceable rights over your personal data. We honour them for all users regardless of location where technically feasible:

  • Right to access. You can ask what personal data we hold about you and receive a summary.
  • Right to correction. You can ask us to correct inaccurate or incomplete data.
  • Right to erasure. You can ask us to delete your data. For most users this is straightforward, since the only identifier we hold is an installation ID — uninstalling the app and writing to us is usually enough to eliminate our records entirely.
  • Right to grievance redressal. You can raise a complaint with us first, and escalate to the Data Protection Board of India if you are unsatisfied with our response.
  • Right to nominate. You can nominate another person to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these, email support@castleapkhd.com with the subject line “Data Request”. We will acknowledge within 3 business days and respond substantively within 30 days, as set out on our contact page. There is no charge, though we may ask you to verify that the request genuinely comes from you.

Children

Castle App is not directed at children under 18. We do not knowingly collect personal data from children, and we do not engage in behavioural tracking or targeted advertising directed at children. If you believe a child has provided personal data to us, contact us and we will delete it.

Sharing and Third Parties

We share data only in three narrow circumstances: with infrastructure providers who host our servers and content delivery network under contract and instruction; with analytics and crash-reporting services that process technical data on our behalf; and where required by law, a court order, or a valid government request. In the event of a merger or acquisition, data may transfer to the successor entity under the same commitments described here.

Every processor we use is bound to handle data only on our instructions and to apply appropriate security safeguards.

How Long We Keep Data

  • Crash and diagnostic logs — retained for 90 days, then deleted or aggregated beyond recognition.
  • Usage and playback metrics — retained in aggregated form for up to 24 months; individual records are discarded after 12 months.
  • Support correspondence — retained for 24 months from the last message, so that recurring issues have context.
  • Copyright and legal notices — retained as long as required by applicable law.

When retention periods expire, data is deleted or irreversibly anonymised.

Security

Traffic between the app and our servers is encrypted in transit. Access to production systems is restricted to a small number of engineers and requires multi-factor authentication. We review access logs and apply security patches promptly. No system is perfectly secure, but we design on the assumption that we should hold as little personal data as possible — the most reliable way to protect data is not to collect it.

Changes to This Policy

When we change this policy, we update the date at the top of the page. If a change materially affects how we handle personal data, we will note it prominently on this page and, where appropriate, in the app. Continued use of Castle App after a change takes effect constitutes acceptance of the revised policy.

Contact Us

Questions about this policy, or a request to exercise your rights, can be sent to support@castleapkhd.com. Written correspondence can be addressed to Castle App, Bengaluru, Karnataka, India — please email first so we can direct your letter to the right team.

For the rules governing use of the app, see our Terms of Use. For support channels and response times, see the contact page.