Privacy policy

Last updated: 15 November 2026

This policy explains what personal data Jentera AI Sdn Bhd ("we", "us"), a company registered in Malaysia (registration no. 202601042741), collects when you use the CastSpell app for Mac, the castspell.dev website, and our licence and feedback services, and what we do with it.

The short version

• CastSpell runs on your Mac. Your code, prompts, conversations, files and agent output never come to us. Agents talk to their own providers directly.
• The app has no analytics or tracking. Signing in is optional.
• We get data only when you buy Pro, sign in (in the app or at castspell.dev/account), activate a licence key, send us feedback, email us, visit castspell.dev, or when the app checks for updates.
• We don't sell personal data or use it for advertising.

1. What we collect and why

When you buy Pro

Payment is handled by Stripe. You enter your card details on Stripe's checkout page; we never see or store them. Stripe tells us your email address, name, country and billing details, the plan you bought, and the payment and subscription status. We use this to create and send your licence key, run your subscription, handle refunds and disputes, and keep the tax and accounting records the law requires.

In our licence database we store your email address only as a keyed hash (HMAC). We can't read it back, though we can check whether an address you give us matches. That hash links your purchase to signing in, in the app and on castspell.dev/account. Your full email address stays in Stripe and in the licence email we send you. The licence record also holds your Stripe customer and subscription IDs.

When you sign in from the app

Signing in is optional, on Free and Pro. You type your email in the app; we email you a link, valid 15 minutes, and you confirm the short code the app shows. We store your email only as the keyed hash above, plus a masked form (for example "q•••@gmail.com") on the sign-in request so the page can show which address the link went to; the sign-in request is deleted about a day later. We keep a record that the account exists (the hash, when it was created and when you last signed in). The app gets a sign-in session that we store only as a hash, together with the app's install ID and the device name. The session lasts 90 days from when it was last used, or until you sign out; the app keeps it in your Mac's Keychain. If you have Pro, signing in turns it on for that device.

When you activate or use a Pro licence

To check a licence, the app sends our licence server:

• your licence key, or your sign-in session;
• the CastSpell version;
• a random install ID the app creates (not a hardware ID);
• the name of your device (for example "Aisha's MacBook Pro"), so you can tell your activated devices apart when you deactivate one.

We store a hash of the key, its last 4 characters (for support), an encrypted copy of the key (so you can see it again in your account), the install ID, the device name, and when each device activated and last checked in. Nothing about your work is sent. The app keeps working offline for up to 30 days after the last successful check. When the app receives your key after you sign in, we log the licence and the time (not the key or your email), so misuse of a key can be spotted.

When you sign in to castspell.dev/account

You sign in with a one-time link sent to your purchase email. We store only hashes of the link (valid 15 minutes, used once) and of your session. The session is kept in one strictly necessary cookie, cs_session, which lasts 30 days or until you sign out. We record a short audit line (without your email or key) when you reveal or replace your key or deactivate a device.

When you send feedback

"Send feedback" in the app sends us your message, its type (bug, idea or question) and the CastSpell version, and, only if you choose to include them: your email address, a screenshot, and app details (update channel, operating system version, device model, memory, which agent tools are installed, and up to 50 recent lines of the app's own log). Screenshots are stored privately and deleted automatically after 2 years. Reports are also emailed to us. If you include your email, we store it as you wrote it so we can reply. We use reports to answer you and to fix problems. Don't include secrets in a screenshot or message.

When you email us

We receive what you send to [email protected] and keep it to answer you.

When you visit castspell.dev

• Analytics: we use Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you. It doesn't load at all if your browser sends "Do Not Track".
• Fonts: the site loads fonts from Google Fonts, so your browser connects to Google, which receives your IP address.
• Server logs and security: Cloudflare hosts the site and our services and processes IP addresses to deliver pages and block abuse. Our services keep short-lived rate-limit counters keyed by a hash of your IP address.
• Your browser: the site remembers your light or dark theme choice in your browser's local storage; it never leaves your device.

Updates

The app checks download.castspell.dev for updates and downloads them from there, and may fetch its agent engine from releases.herdr.dev. Like any web request, these reveal your IP address to the host (Cloudflare).

2. Services you connect yourself

CastSpell starts agent tools you install and pay for (Claude Code, Codex, opencode, Hermes and others), uses your own fal.ai key for image and video cards, and connects to remote machines you choose. What you send to those services goes directly from your Mac to them, under their own privacy policies. We don't receive it.

3. Who processes data for us

We share data with others only when the law requires it, to protect our rights or prevent fraud, or as part of selling or reorganising the business (the new owner would be bound by this policy).

4. International transfers

We are in Malaysia and our providers process data in other countries, including the United States. Where the law requires it, we rely on safeguards such as the providers' standard contractual clauses.

5. How long we keep it

6. Your rights

You can ask us to access, correct or delete your personal data, to get a copy of it, or to stop using it for a purpose. If you're in the EU or UK you can also object to or restrict processing and complain to your local data protection authority; in Malaysia, to the Personal Data Protection Commissioner. Email [email protected]. We may need to confirm you own the purchase email first, and we keep what the law requires (for example payment records).

You can deactivate a device or replace your key at castspell.dev/account, and cancel your subscription in Stripe's customer portal.

Legal bases (EU/UK): performing our contract with you (licence, payment, account), our legitimate interests (security, fraud prevention, improving the app from feedback, privacy-friendly site analytics), legal obligations (tax and accounting), and your consent where you choose to include optional feedback details.

7. Security

Licence keys are stored hashed and encrypted; in our licence database emails are stored only as keyed hashes; sign-in links and sessions only as hashes. Data travels over HTTPS. Feedback screenshots are stored in private storage. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

8. Children

CastSpell is not meant for children under 13 (or the minimum age in your country), and we don't knowingly collect their data.

9. Changes

We'll post changes on this page with a new date, and email Pro subscribers about material changes before they apply.

10. Contact

Jentera AI Sdn Bhd, No 20, Mezzanine Floor, Level 2, Jalan SS 2/61, SS 2, 47300 Petaling Jaya, Selangor, Malaysia. Email: [email protected] (privacy questions and requests too).