Privacy policy

CASTE is operated by Caste Systems LLC. We are the controller of the personal data described here. Questions, requests, and complaints: privacy@caste.social.

This policy explains what we collect, why, and what you can do about it. The service sorts accounts using an assessment and a set of signals; that sorting is the product, so we describe it in detail rather than burying it.

What we collect

Identity and account. If you sign in with X, we receive your X user ID, handle, display name, profile image, and email address where X supplies one. If you sign up with email, we store your email address and a hashed password. We never receive or store your X password.

Assessment data. You take a figural reasoning assessment once, at sign-up. We store your answer to each item, how long you took on each item, and integrity events recorded while the assessment is open — whether the window lost focus, the tab was hidden, fullscreen was exited, or a screenshot key was pressed. We do not capture your screen and we record nothing outside the assessment page. From these we derive a score and a placement.

Signals from your connected X account. Where you connect X, we read public profile fields: follower count, following count, listed count, account creation date, and verified status. With your authorisation we also import a small number of your recent public posts to populate your CASTE profile. These signals feed the composite described under Placement and reclassification below.

What you do on CASTE. Posts, replies, images, follows, likes, reports, and notifications.

Images. Images you upload are re-encoded and stripped of all metadata — including any location data — before being stored. The original file you selected is never written to storage; it exists only in memory during processing.

Technical data. An encrypted session cookie, and ordinary server and security logs (IP address, user agent, timestamps) used to operate the service and detect abuse.

Device and connection. When you sign in we record what you are browsing on: operating system and version, browser and version, whether the device is a phone, tablet or computer, and your screen dimensions. We derive these from your browser's user agent and client hints. We also derive, from your IP address, whether the connection arrived over the Tor network or a VPN or hosting provider. We do not store your IP address as part of this record — only the derived yes/no — and we do not attempt to identify your location from it.

This capture is overwritten each time you sign in, so we hold only the most recent. Unlike the other data here, it is not something you provide deliberately, so it is worth stating plainly: these device and connection characteristics contribute to your placement, as described below.

Placement and reclassification

Every account is placed into one of four tiers. Placement determines what appears in your feed and which accounts can see you and be seen by you.

Your first placement is derived from your assessment score alone. From then on, placement is recalculated weekly from a composite of: your assessment score; the signals read from your connected X account; the device and connection characteristics described above; and your activity on CASTE, including a measure of standing derived from who follows you and the engagement your posts receive. The relative weighting of these inputs is not published.

This is automated decision-making. No human reviews an individual placement, and the weekly recalculation can move an account up or down. The effects are limited to what you see and who sees you within CASTE — placement is not shared with anyone outside the service, is not used to make decisions about your employment, credit, housing, insurance, or education, and is not sold or licensed. Placement is not disclosed to you, except that accounts entering or leaving the highest tier receive a single notice.

You have the right to request human review of your placement, to express your point of view, and to contest the outcome. Write to privacy@caste.social and a person will look at it.

Why we may lawfully process this

• To perform our contract with you — creating your account, running the assessment, placing you, and operating your feed. The service does not function without these.
• Our legitimate interests — detecting cheating on the assessment, preventing duplicate accounts, fraud and abuse, and keeping the service secure and working.
• Your consent — connecting a social account and importing your posts, and any future financial connection. You can withdraw consent at any time by disconnecting the account or contacting us.
• Legal obligation — where we must retain or disclose data by law.

Who we share it with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We disclose it to the service providers that run CASTE, each processing only on our instructions:

• Vercel Inc. — application hosting and image storage (United States)
• Neon Inc. — database hosting (United States)
• X Corp. — only where you choose to connect an X account, and only to authenticate you and read the fields described above
• The Tor Project — we download their public list of exit nodes and check it locally. Your address is never sent to them.
• IPinfo — where enabled, your IP address is sent to determine whether the connection is a VPN or hosting provider. Nothing else about you is sent.

We may also disclose data where we are legally required to, or to establish, exercise, or defend legal claims. If the business is sold or merged, data may transfer with it; we will tell you first.

We are based in the United States and our providers process data there. If you are in the UK or EEA, transfers rely on the UK Addendum and the EU Standard Contractual Clauses.

How long we keep it

• Account, content, and assessment data — while your account exists. Assessment responses and integrity events are retained for the life of the account because placement rests on them and because they are what allows us to investigate irregularities.
• After deletion — removed from the live service immediately and purged from backups within 90 days. We retain a minimal record of a banned or voided account so the ban cannot be trivially evaded.
• Server and security logs — 90 days.

Your rights

Wherever you live, you can ask us to give you a copy of your data, correct it, delete it, or export it, and you can object to or ask us to restrict certain processing. Email privacy@caste.social. We will respond within 30 days (45 days for California requests, extendable once where permitted). We will not discriminate against you for exercising any of these rights.

California residents. Under the CCPA as amended by the CPRA you have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, and to limit the use of sensitive personal information. We do not sell or share personal information, and we do not use sensitive personal information for any purpose beyond providing the service. You may use an authorised agent.

UK and EEA residents. You additionally have the rights described under “Placement and reclassification” regarding automated decisions, and the right to complain to your supervisory authority — the ICO in the UK, or your national data protection authority in the EEA.

Age

CASTE is for people aged 16 and over. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, write to privacy@caste.social and we will delete it.

Security

Passwords are hashed, sessions are carried in an encrypted cookie, and data is encrypted in transit. Your placement and the scores behind it are stored server-side and are never sent to any browser. No system is perfectly secure; we will notify you and the relevant regulator of a breach affecting your data as the law requires.

Cookies

One strictly necessary cookie, holding your encrypted session so you stay signed in. We use no analytics, advertising, or third-party tracking cookies. If that changes we will update this policy and ask for consent first.

Changes

We will update the date above when this policy changes, and tell you in the app before any material change takes effect.

Contact

Caste Systems LLC — privacy@caste.social