Privacy Policy
Last updated 18 October 2026.What Onkast collects, why, and the choices you have - written in plain language, not legal boilerplate.
Who we are
Onkast is a casting network connecting Onkasters, Creators, and Brands. Onkast is operated by its founder, based in the United Kingdom. The data controller for the purposes of this policy is Abdiwahaab Mohamed, trading as Onkast. Postal correspondence address (not necessarily a geographic business address): Office 166586, PO Box 7169, Poole, Bournemouth BH15 9EL, United Kingdom. For anything covered by this policy, contact privacy@onkast.app.
Who can use Onkast
Onkast is for adults only. Every account, regardless of type, must confirm a date of birth showing they are 18 or older before they can use the app. This check happens once, during sign-up, for every account type; there is no way to skip it. Your actual date of birth is used only on your own device to calculate your age and is never sent to or stored on our servers - we only keep a record that the check was completed, with a timestamp.
Information we collect
This table reflects what the app's code and database actually do today, not an aspirational description.
| Category | What | Why | Where it goes |
|---|---|---|---|
| Account | Email address, password (never stored in readable form) | To create and secure your account, sign you in | Supabase (our database and authentication provider) |
| Age confirmation | A yes/no confirmation and timestamp only - not your date of birth | To confirm you're 18 or older, required to use Onkast | Supabase |
| Profile | Full name, username, bio, profile photo, social media handles you choose to add, free-text location (e.g. "London, UK" - typed by you, not detected from your device) | To show your profile to other users and let them find and recognise you | Supabase |
| Cast Calls | Title, description, screening questions, compensation details, location, dates, photos/video you upload | The core casting opportunity a Creator or Brand posts | Supabase (data and media storage) |
| Applications | Your answers to a Cast Call's screening questions, application status | To let a Creator or Brand review and respond to your application | Supabase |
| Messages | The content of conversations between users connected through a Cast Call | In-app messaging between matched users | Supabase |
| Profile posts | Short videos, captions, and thumbnails you choose to post to your profile | The "Posts" section of your profile, visible to others per your account's privacy setting | Supabase storage |
| Follows, saves, blocks | Who you follow, which posts you've saved, who you've blocked | To personalise what you see and let you control who can reach you. Your block list is private to you. | Supabase |
| Reports | The reason and any detail you provide when reporting a user, Cast Call, or conversation | Trust and safety review by Onkast | Supabase, visible only to Onkast's founder |
| Feedback | Free-text feedback you submit through "Help Shape Onkast" | Product feedback, read by the founder | Supabase |
| Push notifications | A device push token (if you allow notifications) | To deliver notifications (new messages, application updates, etc.) | Supabase (stores the token), Expo's push notification service, Apple (APNs) for delivery to your device |
| Camera, microphone, speech recognition, photo library | Access only when you actively use a camera/recording/upload feature or dictate text | Recording video for Cast Calls or profile posts, voice-to-text for Cast Call descriptions, choosing existing photos/videos | Processed on your device; resulting media is uploaded to Supabase storage only if you choose to post or submit it |
| AI-assisted Cast Call generation | The description you type or dictate when using "Build it for me" | To generate a complete Cast Call draft from your description | Sent to Anthropic (the AI provider) through our own secure server; Anthropic processes the text to generate the draft |
| Crash and error diagnostics | Technical error reports if the app crashes or hits an error | To find and fix bugs | Sentry (crash-reporting service). Configured not to collect your name, email, or other personal details, and not to record screens or sessions. |
What we do NOT collect
- Precise or background device location (GPS). Any location shown on your profile or a Cast Call is text you typed yourself.
- Advertising or analytics tracking of your activity across other apps or websites. Onkast does not use any advertising SDK.
- Payment information. Onkast is currently free to use for every account type, with no in-app purchases active.
Who we share information with
We don't sell your data. We use the following services to run Onkast, each acting on our instructions:
- Supabase - our database, authentication, file storage, and backend functions provider. Supabase hosts our database and storage in the EU (Frankfurt, Germany). This does not necessarily describe where our other service providers listed below process data.
- Anthropic - processes the text you provide when using AI-assisted Cast Call generation, to produce the generated draft.
- Sentry - receives technical crash/error reports, configured to exclude personal information.
- Expo and Apple - deliver push notifications to your device.
Other Onkast users see what you choose to make visible: your public profile, posts, and Cast Calls, according to your account's privacy setting. Messages are visible only to you and the person you're messaging.
How long we keep your information
While your account is active, your information is kept so the app can function. When you delete your account:
- Your profile, Cast Calls, applications, messages, and follows are removed from the live service.
- Photos and videos you uploaded are deleted immediately where possible. If a deletion attempt fails, the remaining files are queued for automatic cleanup rather than left in place; a job that keeps failing is flagged for manual review rather than retried indefinitely.
- If you've filed a report about someone else, that report may be retained for safety and dispute-handling purposes even after your account is deleted. The link to your account is removed, but the report's written contents may remain.
- A minimal internal record that a deletion took place is retained for accountability, without your name, username, or email.
Onkast's current database hosting plan does not include scheduled database backups. We do not promise that deleted information is immediately removed from every underlying system or technical copy. Uploaded files are handled separately from database records.
Your rights and choices
- Delete your account at any time from Settings inside the app, or by emailing privacy@onkast.app.
- Access or export your data by emailing privacy@onkast.app.
- Control who sees your profile using the "Private account" setting inside the app.
- Block or report any user directly from their profile or a conversation.
Onkast is operated from the United Kingdom and is subject to UK data protection law. Depending on where you live, you may also have additional rights under applicable local data protection laws. You can contact us at privacy@onkast.app to ask about your personal information or exercise your rights.
Children
Onkast is restricted to users 18 and older, enforced at sign-up for every account type. We do not knowingly allow anyone under 18 to use Onkast.
Changes to this policy
If we make material changes to this policy, we'll update the date at the top of this page and, where appropriate, let you know in the app.
Contact
Questions about this policy or your data: privacy@onkast.app.