Last updated: 2026-08-15 (v3 — added the TikTok API access section below)
CAST (Content Automation & Story Tool) is a local-first application. There is no backend server operated by the developer that your data passes through — the web version runs entirely in your browser, and the standalone app runs entirely on your own computer. This page describes what data the app handles and where it goes.
localStorage, on your own device. They are never transmitted to any server the developer operates.If you configure a cloud story-generation provider (OpenAI, Anthropic, DeepSeek, Groq, OpenRouter, Mistral, Google Gemini) or a cloud voice provider (OpenAI TTS, ElevenLabs), your story text and/or generated audio is sent directly from your own browser to that provider, using the API key you supplied. This happens under that provider's own privacy policy and terms — CAST does not see, log, or proxy this traffic. Using a local model (Ollama) or the built-in in-browser TTS engines avoids sending any content to a third party at all.
CAST requests the following Google OAuth scopes, only when you explicitly choose to connect a YouTube channel, and calls only these three YouTube Data API methods — nothing else:
youtube.upload — used for videos.insert (publishing a video you generate to your own connected channel, only when you click "Upload" or enable auto-publish) and thumbnails.set (setting a generated or custom thumbnail on that upload).youtube.readonly — used for channels.list (reading your connected channel's own name, so the app can show which channel you're uploading to).CAST's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your YouTube data is used solely to provide CAST's publishing feature to you and is never sold, shared with third parties, or used for advertising. Google's own handling of your account data is governed separately by the Google Privacy Policy.
CAST requests the following TikTok OAuth scopes, only when you explicitly choose to connect a TikTok account, and calls only these Content Posting API methods — nothing else:
user.info.basic — used to read your account's own nickname, username, and avatar, so the app can show which account you're posting as before you publish, and to look up which posting privacy levels (public/friends/only me) and comment/duet/stitch settings TikTok currently allows for your account, shown live in the publish panel before every post.video.publish — used to upload and publish a video you generate to your own connected account, only when you click "Post to TikTok." Until this app has passed TikTok's audit review, TikTok itself restricts every post made through it to private ("only me") visibility, regardless of what CAST's UI offers — this is a TikTok platform restriction on unaudited apps, not a choice CAST makes.Your TikTok data is used solely to provide CAST's publishing feature to you and is never sold, shared with third parties, or used for advertising. TikTok's own handling of your account data is governed separately by the TikTok Privacy Policy.
By default, CAST reports three anonymous counts to help understand overall usage: when the app is opened, when a video finishes generating, and when a video is published to YouTube. Each report is nothing more than one of those three event names — there is no per-user identifier, no IP address logging, no device fingerprint, no story content, no API keys, and no YouTube account or channel information included, ever. It is not possible to attribute any individual report back to a specific person, install, or session.
This can be turned off at any time in Settings → Advanced → Privacy ("Share anonymous usage data"). The reporting code is open source and part of the same repository linked below, alongside the small server-side counter that receives it — both are short enough to read end to end.
Since all data lives on your own device, you control it directly: clear your browser's site data to remove settings and API keys, or disconnect a YouTube or TikTok account from within the app's Settings to revoke and delete its stored tokens (you can also revoke access at any time from your Google Account permissions page or your TikTok account settings).
CAST is open source. You can review exactly what the code does at github.com/YourAverageCow/CAST.
Questions about this policy can be raised via a GitHub issue. See also the Terms of Service.