Privacy Policy
CastLoop Privacy Policy
Last Updated: May 22, 2026
Welcome to CastLoop
X ORIGINAL (HONG KONG) LIMITED ("we", "us", and/or "our") operates the CastLoop website castloop.ai, the CastLoop iOS and Android applications, the xNarrator Studio creator tool, and other related services (collectively, the "Services").
We are committed to protecting your privacy. This Privacy Policy describes how we collect, store, use, and disclose information through our Services.
The Services are intended for users located in the United States. If you are a resident of California, please also see the Additional Information for California Residents section below. If you reside in another U.S. state with applicable consumer privacy laws (Virginia, Colorado, Connecticut, Utah, and others as listed), please also see the Additional Information for Other U.S. State Residents section.
We care about the protection and confidentiality of your information. When you use the Services, you may provide information during your interactions with stories and AI characters. We process this information only as described in this Privacy Policy, including to provide you with a personalized, safe interactive storytelling experience and to allow our AI to learn from your interactions to improve story quality. We may also use information about your visit to our Website to promote our Services, but we will never use or disclose the content of your story interactions or your free text inputs for marketing or advertising purposes.
Any terms we use in this Policy without defining them have the definitions given to them in our Terms of Service. If you have any questions, please contact us at privacy@castloop.ai.
1. Information We Collect
1.1 Information You Provide
Through your use of the Services, you may provide us with the following information:
| Category | Examples |
|---|---|
| Account information | Your name, email address, and password. If you choose to log in using a third party identity provider (such as Google, Apple, or Facebook), we receive information about the provider you used and, depending on your account settings with that provider, details about you including your name, email address, and unique user identifiers. |
| Profile information | We may ask you to provide your birth date, pronouns, and content preferences when you register for the Services. |
| Messages and content | The free text inputs, choice selections, in story actions, and other content you send or receive through the Services, including voice and text inputs. |
| Creator uploads | Scripts, character setups, world building, images, video, and audio you upload through xNarrator Studio. |
| Interests and preferences | The genres, themes, and types of stories you favor; settings such as preferred play times. We also learn about your interests and preferences over time through your use of the Services to personalize your experience. |
| Payments, transactions, and rewards | When you make purchases through the Services, our third party payment processor collects your payment information. We maintain a record of your purchases, features selected, and virtual items earned or used. |
| Feedback and reports | Ratings, comments, bug reports, and content reports you submit through the Services. |
| Third party information | If you provide us with personal information relating to a third party (such as another person's voice or likeness), you represent that you have obtained that third party's consent under applicable laws and regulations. |
1.2 Information We Collect Automatically
We automatically log the following information about you, your device, your network, and your interactions with our Services over time:
| Category | Examples |
|---|---|
| Device and network data | Operating system, manufacturer and model, browser, IP address, device and cookie identifiers, language settings, mobile carrier, and general location (such as city, state, or region inferred from IP). |
| Usage data | How you use the Services: which stories you open, the nodes you visit, choices you make, time spent on each node, buttons clicked, page visits, and error logs. |
Our advertising partners may also use such technologies to collect limited information about your device and interactions with the Services, such as the links you click, pages you visit, IP address, advertising ID, and browser type. However, advertising partners will never have access to the content of your story interactions, your free text inputs, or any media you upload through the Services.
We and our service providers use cookies, scripts, software development kits, web beacons, and similar technologies to manage the Services and to collect information about you and your use of the Services. These technologies help us to recognize you, customize or personalize your experience, offer additional products or services to you, and analyze the use of our Services. Most internet browsers allow you to remove or manage cookie functions and adjust your privacy and security preferences. Please note that disabling our cookies may mean that you cannot take full advantage of our Services.
2. How We Use Your Information
2.1 General Principles
In accordance with this Privacy Policy, personal data are processed by X ORIGINAL (HONG KONG) LIMITED as the data controller, in line with the following principles: (i) lawfulness and good faith; (ii) accuracy and, where necessary, currency; (iii) processing for specific, explicit, and legitimate purposes; (iv) data minimization (limited to the purposes for which the data is processed); and (v) retention for the period stipulated in applicable law or required for the purpose.
2.2 Specific Uses
We use your information for the following purposes:
a. Operating and Administering the Services
| Item | Detail |
|---|---|
| Why and how | Providing and maintaining the content and functionality of the Services. Carrying out obligations arising from our contract with you. Creating your Account and profile. Facilitating payments and transactions and managing virtual items. Responding to inquiries, comments, feedback, or questions, and troubleshooting. Managing our relationship with you, including sending administrative messages about the Services. |
| Categories of information used | Account information; Profile information; Messages and content; Interests and preferences; Payments, transactions, and rewards; Device and network data; Usage data. |
b. Providing Core Interactive Story Functionality
| Item | Detail |
|---|---|
| Why and how | Providing you a personalized interactive story experience. Sending your free text inputs to AI models in real time to generate new story branches. Rendering imagery, voice, and video. Syncing your story progress across the devices you use to access the Services. Allowing the AI to learn from interactions in your stories so future generations are more coherent and personalized. |
| Categories of information used | Account information; Profile information; Messages and content; Interests and preferences; Device and network data; Usage data. |
c. Monitoring and Protecting the Services
| Item | Detail |
|---|---|
| Why and how | Preventing fraud, criminal activity, and misuse of the Services; ensuring the security of our IT systems, architecture, and networks (including testing, maintenance, support, and hosting). Performing content moderation (both AI and human) to enforce the Community Guidelines. |
| Categories of information used | All categories above. |
d. Analyzing Trends and Improving the Services
| Item | Detail |
|---|---|
| Why and how | Aggregating, anonymizing, and deidentifying personal information. Analyzing how the Services are used and how effective they are. Improving the AI's storytelling quality and consistency (you may turn off the "use my data for model improvement" setting in your account, in which case we will not use your identifiable inputs for model improvement). Adding new features. Developing our business and marketing strategy. |
| Categories of information used | All categories above (for AI model improvement, only after de identification or aggregation). |
e. Marketing and Advertising the Services
| Item | Detail |
|---|---|
| Why and how | Sending you information by email that we believe will be of interest to you, such as updates about the Services, new stories, features, and surveys. Displaying and targeting advertisements about our Services on the internet. We will never use the content of your story interactions, free text inputs, or uploaded media for marketing or advertising. |
| Categories of information used | Account information; Device and network data; Usage data. |
f. Enforcing Agreements, Complying with Legal Obligations, and Defending Claims
| Item | Detail |
|---|---|
| Why and how | Enforcing and complying with our Terms of Service and policies. Protecting our and others' rights, privacy, safety, or property. Ensuring the integrity of the Services. Verifying the age of registered users. Defending against legal claims and disputes. Recovering payments due to us. Keeping records of transactions and complying with legal process. |
| Categories of information used | All categories above. |
3. How We Disclose Information
3.1 Service Providers
We share your information with companies and individuals that provide services on our behalf or help us operate the Services or our business (such as hosting, IT, customer support, email delivery, and analytics services). We also share information with companies that provide marketing services on our behalf, but we do not share the content of your story interactions, free text inputs, or uploaded media for marketing or advertising purposes. For example, we may share your email address with marketing service providers to deliver our marketing emails on our behalf and to help us identify other individuals who may be interested in the Services. We require these marketing service providers to agree not to use your email address for any other purpose.
Specifically, the service providers that power our core Services include:
| Type | Purpose | Data Categories |
|---|---|---|
| AI model providers (LLM / TTS / image generation) | Generating story branches, dialogue, voice, and imagery in real time | Free text inputs, story context, generation parameters |
| Cloud computing / storage / CDN | Service hosting, data storage, content delivery | Most technical data |
| Content moderation providers | Automated detection of policy violations | Free text inputs, uploaded media |
| Analytics and crash reporting | Performance monitoring, product improvement | Device information, usage logs, error stacks |
| Payment and billing | Processing payments and reconciliation | Order information (we do not receive full payment instrument details) |
| Customer support and ticketing | Handling your feedback and inquiries | Information you proactively share with support |
3.2 Professional Advisors
We may share aggregate information with professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
3.3 Advertising Partners
We share information about visitors to our Website, such as the links you click, pages you visit, IP address, advertising ID, and browser type, with advertising companies for interest based advertising and other marketing purposes. Sharing this information allows us and our advertising partners to target and serve advertising to you and others. We will never share your story interactions, free text inputs, or any media you upload through the Services with our advertising partners, or use that information for marketing or advertising.
3.4 Affiliates
We may share necessary information with our corporate affiliates for legitimate internal business purposes such as accounting, security, and risk control.
3.5 Authorities and Others
We may share information with law enforcement and government authorities as we believe in good faith to be necessary or appropriate for the legal compliance and protection purposes described in Section 2.
3.6 Business Transferees
If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a "Transaction"), your personal information and other information may be shared in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
4. How We Secure Your Information
We use a variety of industry standard security technologies and procedures to help protect your data from unauthorized access, use, or disclosure:
- All transmitted data is encrypted in transit using HTTPS/TLS;
- Stored data is encrypted on secure servers;
- Access to stored data is protected by firewalls, role based access controls, and multi factor authentication;
- We perform periodic security assessments and penetration testing;
- Employees are bound by confidentiality obligations and receive security training.
Your account is protected by a password (or by your third party identity provider's authentication mechanism). You must prevent unauthorized access to your account and personal information by selecting and protecting your password appropriately and limiting access to your devices.
While we use commercially reasonable efforts to protect your data, no technology, data transmission, or system can be guaranteed to be 100% secure. In the event of a security breach leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to your data, we will notify you as soon as we identify the issue, in accordance with applicable U.S. state breach notification laws.
5. Where We Store Your Information
The Services are operated from the United States of America. Our servers are located in the United States, and we may use cloud services in other regions to enable content delivery. If you are accessing the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, a jurisdiction whose privacy laws may differ from those in the country where you reside.
By using the Services, you consent to such transfer, storage, and processing.
6. Data Retention
We will retain your personal information only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
Reference retention periods:
| Data Type | Retention Period |
|---|---|
| Account basic information | Duration of your Account plus any legally required post deletion retention |
| Story progress and free text inputs | Default 24 months (for experience continuity and AI improvement); you may request earlier deletion |
| Usage and device logs | Typically 12 months |
| Payment and order records | As required by U.S. financial, tax, and anti money laundering laws (typically at least 5 years) |
| Moderation and policy violation records | As required for compliance purposes |
7. Your Rights and Choices
7.1 Opt Out of Marketing Communications
You may opt out of marketing related emails and other communications by following the opt out or unsubscribe instructions in the communications you receive from us, or by contacting us as provided in the "Contact Us" section below. You may continue to receive Services related and other non marketing emails from us.
7.2 Opt Out of "Sale" or "Sharing" of Personal Information for Targeted Advertising
We share information with third party advertising partners and allow them to collect information about your visit to our Website using cookies and other tracking technologies to display targeted advertising. Our disclosure of information to these partners may be considered a "sale" or "sharing" of personal information or "targeted advertising" under applicable U.S. state laws. You can opt out of these disclosures and limit our use of tracking technologies by following the instructions after clicking the "Your Privacy Choices" link in our website footer. We will also honor browser based opt out signals such as the Global Privacy Control (GPC) in accordance with our legal obligations.
7.3 Personal Information Requests
Depending on your location and the nature of your interactions with our Services, you may request the following:
- (a) Information about how we have collected and used your personal information (this Privacy Policy provides much of that information already);
- (b) Access to a copy of the personal information we have collected about you, in a portable, machine readable format where applicable;
- (c) Correction of personal information that is inaccurate or out of date;
- (d) Deletion of personal information that we no longer need to provide the Services or for other lawful purposes (you can also delete your account in your account settings);
- (e) Withdrawal of consent, where we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal;
- (f) Additional rights, such as the right to object to or restrict our use of personal information.
To make a request, please contact us at privacy@castloop.ai. We may ask for specific information from you to help us confirm your identity. Depending on where you reside, you may be entitled to authorize an agent to submit requests on your behalf, and we will require authorized agents to confirm their identity and authority in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.
In some instances, your choices may be limited (for example, where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations). If you are not satisfied with how we address your request, you may submit a complaint by contacting us, or by contacting the appropriate regulator in your state.
8. Children's Privacy (COPPA)
The Services are not directed to children under the age of 13. We do not knowingly collect personally identifiable information from children under 13.
If we learn that we have collected personal information from a child under 13, we will promptly delete the information from our servers and terminate the account. If you are a parent or guardian and you believe your child under 13 has provided us with personal information, please contact us at privacy@castloop.ai and we will take appropriate action.
For users between 13 and 17 years old, the Services may be used only with the consent of a parent or legal guardian who agrees to the Terms of Service on the minor's behalf. We do not market our Services to anyone under 18.
9. Changes to This Privacy Policy
The Services and our business may change from time to time. As a result, at times it may be necessary for us to make changes to this Privacy Policy. We reserve the right to update or modify this Privacy Policy at any time without prior notice. We encourage you to periodically review this page for the latest information on our privacy practices. The "Last Updated" date at the top of this Privacy Policy indicates when this Policy was last revised.
10. Additional Information for California Residents
If you are a California resident, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act ("CPRA") requires us to provide you with information about:
- the purpose for which we use each category of "personal information" (as defined in the CCPA/CPRA) we collect; and
- the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross context behavioral advertising," and/or (c) "sell" such personal information.
Under the CCPA/CPRA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer's personal information obtained from the consumer's activity across distinct online services, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. We "share" information with our advertising partners to provide more relevant and tailored advertising to you regarding our Services. Moreover, our use of third party analytics services and online advertising services may result in the sharing of online identifiers (such as cookie data, IP addresses, device identifiers, and usage information) in a way that may be considered a "sale" under the CCPA/CPRA.
In the past 12 months, we have processed the categories of personal information listed in the table below.
| Personal Information Category | Business Purpose of Use | Third Parties to Whom Information Is Disclosed | Third Parties to Whom Information Is Sold/Shared |
|---|---|---|---|
| Identifiers (e.g., name, email address) | Provide the Services; Personalize the Services; Respond to your requests; Advertising and marketing; Analyze and improve the Services; Security and legal purposes | Affiliates; Vendors; Entities for legal purposes; Advertising and analytics vendors/partners | Advertising and analytics vendors/partners |
| Protected classification information (e.g., gender) | Same as above | Same as above | Advertising and analytics vendors/partners |
| Demographic information (e.g., birth date, sexual orientation, preferences, if voluntarily provided) | Provide the Services; Personalize the Services; Analyze and improve; Security and legal purposes | Affiliates; Vendors; Entities for legal purposes | We do not sell/share |
| Commercial information (e.g., products purchased, payment information) | Process payments; Provide the Services; Analyze and improve; Security and legal purposes | Payment processors; Affiliates; Vendors; Entities for legal purposes | We do not sell/share |
| Internet or other electronic network activity (e.g., browsing history, search history) | Provide and personalize the Services; Advertising and marketing; Analyze and improve; Security and legal purposes | Affiliates; Vendors; Advertising and analytics vendors/partners; Entities for legal purposes | Advertising and analytics vendors/partners |
| Geolocation data (general, not precise) | Same as above | Same as above | Advertising and analytics vendors/partners |
| Inferences drawn from other personal information (e.g., preferences, characteristics, behaviors) | Provide and personalize the Services; Advertising and marketing; Analyze and improve | Affiliates; Vendors; Advertising and analytics vendors/partners; Entities for legal purposes | Advertising and analytics vendors/partners |
| Message content information (story interactions, free text inputs, voice/text messages, uploads) | Provide and personalize the Services; Respond to your requests; Analyze and improve | Affiliates; AI model providers; Content moderation providers; Entities for legal purposes | We do not sell/share |
| Account login credentials | Provide the Services; Security and legal purposes | Affiliates; Vendors; Entities for legal purposes | We do not sell/share |
Your Choices Regarding "Sharing" and "Selling". You have the right to opt out of our sale or sharing of your personal information for purposes of online advertising by clicking "Your Privacy Choices" in our website footer or by contacting us at privacy@castloop.ai. We will also honor browser based opt out signals (such as the Global Privacy Control) in accordance with our legal obligations.
Other CCPA Rights. Please see the "Your Rights and Choices" section of this Privacy Policy for information about the additional rights you have with respect to your personal information under California law and how to exercise them. You are entitled to exercise these rights free from discrimination.
Sensitive Personal Information. The CCPA/CPRA allows California residents to limit the use or disclosure of their "sensitive personal information" if it is used for certain purposes. We do not use or disclose "sensitive personal information" other than for purposes for which California residents cannot exercise the right to limit under the CCPA/CPRA. You can change or delete any demographic information you have provided that constitutes sensitive personal information (such as sexual orientation) at any time through your account settings.
Retention of Your Personal Information. Please see the "How We Secure Your Information" and "Data Retention" sections above.
Do Not Track. "Do Not Track" ("DNT") is a privacy preference that users can set in certain web browsers. We do not currently recognize or respond to browser initiated Do Not Track signals, but we provide the variety of opt out mechanisms listed above.
California "Shine the Light" Disclosure. Under California Civil Code Sections 1798.83 to 1798.84, residents of California have the right under certain circumstances to opt out of the disclosure of certain categories of personal information with third parties for those third parties' direct marketing purposes. We maintain a free opt out policy. To opt out of these disclosures, please contact us at privacy@castloop.ai with "California Shine the Light Request" in the subject line.
11. Additional Information for Other U.S. State Residents
If you reside in one of the following U.S. states with comprehensive consumer privacy laws, you may have additional rights under your state's law:
| State | Applicable Law |
|---|---|
| Virginia | Virginia Consumer Data Protection Act (VCDPA) |
| Colorado | Colorado Privacy Act (CPA) |
| Connecticut | Connecticut Data Privacy Act (CTDPA) |
| Utah | Utah Consumer Privacy Act (UCPA) |
| Texas, Oregon, Montana, Iowa, Tennessee, Delaware, New Jersey, New Hampshire, Maryland, Minnesota, Indiana, Kentucky, Rhode Island, and others | State specific consumer privacy laws (as in effect on the date of access) |
Subject to the specific provisions of each state's law and applicable exceptions, you generally have the right to:
- (a) Access: confirm whether we are processing your personal data and obtain a copy in a portable format;
- (b) Correct inaccuracies in your personal data;
- (c) Delete personal data we have collected from you;
- (d) Opt out of (i) the sale of personal data, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects;
- (e) Limit the use or disclosure of sensitive personal data (where applicable);
- (f) Appeal our refusal to take action on a request.
How to Exercise. Submit your request to privacy@castloop.ai. We will respond within the timeframe required by your state's law (generally 45 days, with one permitted extension where applicable). We will not discriminate against you for exercising your rights.
If your request is denied, you may appeal by replying to our response. If we deny your appeal, you may contact your state's attorney general or consumer privacy regulator.
12. International Users
The Services are intended for users located in the United States. If you choose to access the Services from outside the United States, you do so on your own initiative and at your own risk, and you are responsible for compliance with applicable local laws. By using the Services, you consent to the transfer of your information to the United States, which has data protection laws that may differ from those in your jurisdiction.
13. Contact Us
For privacy related questions, requests, or concerns, please contact us:
- Privacy inquiries and data requests: privacy@castloop.ai
- Legal inquiries: legal@castloop.ai
- Support and help: support@castloop.ai
Mailing address:
X ORIGINAL (HONG KONG) LIMITED Rm D07, 8/F, Kai Tak Fty Building No. 99 King Fuk Street San Po Kong, Kowloon, Hong Kong
Last Updated: May 22, 2026 Related documents: Terms of Service · Community Guidelines