Privacy Policy

Effective Date: April 5, 2026
Last Updated: April 5, 2026

This Privacy Policy describes how FishINDY / CastNET ("we", "us", or "our"), operated by Brody McWilliams, collects, uses, and protects information when you use our content management services, including the CastNET Content Engine platform at fishindy.com.

1. Who We Are

CastNET is a content automation platform for professional bass fishing anglers. We help anglers manage their social media content across Facebook, Instagram, and YouTube through automated clipping, formatting, captioning, and posting.

2. Information We Collect

2.1 Information You Provide

Account Information: Name, email address, and professional angler profile details
Social Media Credentials: OAuth access tokens for Facebook, Instagram (via Facebook Graph API), and YouTube (via Google OAuth) that you authorize us to store and use on your behalf
Content: Video clips, transcriptions, captions, thumbnails, and metadata you create or generate through the platform

2.2 Information Collected Automatically

Platform Data: When you connect Facebook, Instagram, or YouTube accounts, we retrieve and store: Page IDs, Instagram Business Account IDs, YouTube channel IDs and titles, and content publishing permissions you grant
Usage Data: Post history, engagement metrics, posting timestamps, and API response logs
Technical Data: IP addresses, device identifiers, browser types, and access logs for security and debugging

3. How We Use Your Information

We use the collected information exclusively to:

Post content (videos, photos, captions) to your connected Facebook, Instagram, and YouTube accounts on your behalf, as authorized by you via OAuth
Retrieve engagement analytics and insights from your connected platforms
Store and organize your video clips, transcriptions, and generated content
Generate AI-powered captions, hashtags, and platform-specific content formats matching your voice profile
Provide you with approval workflows and a master clip library
Monitor token health and notify you when re-authentication is needed
Improve our services and troubleshoot issues

4. OAuth and API Data Handling

4.1 YouTube API Services

Our use of information received from YouTube APIs adheres to the YouTube API Services Terms of Service and the Google Privacy Policy.

Specifically, we:

Only access YouTube data with your explicit OAuth consent
Use YouTube data only for the content posting and analytics features you have authorized
Do not share YouTube API data with third parties
Allow you to revoke our access at any time via your Google Account security settings
Delete YouTube API data from our systems upon your account deletion or revocation request

4.2 Facebook and Instagram

Our use of information received from Facebook and Instagram via the Meta Graph API adheres to the Meta Platform Terms and Developer Policies.

You can revoke our access at any time by removing our app from your Facebook Business Integrations settings.

5. Data Storage and Security

Encryption at rest: All OAuth access tokens and refresh tokens are encrypted using Fernet (AES-128-CBC) symmetric encryption before being stored in our database
Secure infrastructure: Data is stored on private servers with restricted access, accessible only via Tailscale VPN mesh networking
PIN-gated access: Our platform is protected by PIN authentication with rate limiting
No third-party sharing: We do not sell, rent, or share your data with third parties for marketing purposes

6. Data Retention

We retain your data for as long as your account is active. Upon account termination:

OAuth tokens are permanently deleted within 7 days
Video clips and metadata are deleted within 30 days unless you request earlier deletion
Logs are retained for 90 days for security and audit purposes, then purged

7. Your Rights

You have the right to:

Access the data we hold about you
Correct inaccurate data
Delete your account and associated data
Revoke OAuth permissions at any time via the respective platform (Facebook, Instagram, YouTube)
Export your clip library and content metadata

To exercise any of these rights, contact us at the email below.

8. Third-Party Services

We use the following third-party services to provide our features:

Meta Graph API (Facebook, Instagram) — for content publishing
YouTube Data API v3 — for video uploads and channel management
Anthropic Claude API — for AI caption generation
OpenAI Whisper — for audio transcription
Supabase — for auxiliary data storage

Each service has its own privacy policy governing how they handle data.

9. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy at this URL with a new "Last Updated" date.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Brody McWilliams
FishINDY / CastNET
Email: brody@fishindy.com
Website: fishindy.com

← Back to Dashboard | Terms of Service