Privacy Policy

Effective date: July 30, 2026

1. Introduction

Monterey’s Coast, Inc. (“Company,” “we,” “us,” or “Castle”) respects your privacy and is committed to protecting your information. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you access or use our application, website, and related products, programs, and services, including Bricks, Castle Dweller, and the Castle Creator Payout Program (collectively, the “Service”).

This Privacy Policy is intended to provide notice of our information practices. Where applicable law requires Castle to obtain consent for a particular use of information, we will request that consent separately. We may also provide additional or just-in-time privacy notices when you use a specific feature, such as creator payout onboarding or identity verification.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as described in Section 13.

2. Information We Collect

We collect information:

directly from you or your parent or legal guardian;
automatically when you use the Service; and
from payment providers, payout providers, app stores, identity-verification services, and other third parties.

The information we collect depends on how you use Castle.

Account, Profile, and Content Information

We may collect:

contact details, such as an email address or phone number;
account and profile information, including username, profile picture, bio, and profile settings;
user-generated content, such as games (decks), comments, chats, and other content you submit;
responses to surveys, contests, promotions, and support inquiries; and
parent or legal guardian contact information and related child-account information when needed to respond to a parental request, obtain or document parental authorization, administer a minor’s account, or comply with applicable law.

We do not generally require an exact date of birth as part of ordinary account registration. However, we or our service providers may collect an exact date of birth or other age-related information when needed to operate the Creator Payout Program, verify age or identity, administer parent or guardian involvement, provide age-appropriate features, enforce our policies, protect users, or comply with law.

Purchase and Subscription Information

When you purchase Bricks, a Castle Dweller subscription, or another paid Castle product, Castle, an app store, or a payment provider may collect:

purchaser or billing name;
billing address, country, and contact information;
payment method type and limited payment details, such as a token, transaction identifier, or the last digits of a payment method;
purchase, receipt, subscription, renewal, cancellation, refund, and chargeback information; and
information about the Bricks, subscription, or other product purchased.

Full payment-card or financial-account credentials may be collected directly by an app store or payment provider rather than by Castle. The information that Castle receives depends on the provider and payment method.

Creator Payout, Tax, and Verification Information

If you apply to or participate in the Castle Creator Payout Program, Castle and our payout, tax, identity-verification, and compliance providers may collect or process:

identity and contact information, such as legal name, email address, phone number, residential or mailing address, date of birth, country of residence, tax residency, and, where required, nationality or citizenship;
identity-verification information, such as a government-issued identification document, document number, document image, photograph, selfie, liveness check, age- or identity-verification result, and information used to confirm that a document or person is authentic;
tax information, such as a taxpayer identification number, Social Security number or other national tax identifier, tax classification, withholding status, tax residency, and Forms W-9, W-8, or other local tax forms and certifications;
payout information, such as bank-account information, routing information, PayPal account information, payout method, currency, payment instructions, returned-payment information, and payout history;
Creator Payout Program information, such as Earned Bricks, payout requests, estimated or approved Creator Fees, eligibility status, payment status, adjustments, reserves, disputes, and compliance-review results;
fraud, security, and compliance information, such as IP address, device information, approximate location, account relationships, risk indicators, sanctions or watchlist-screening results, and suspected fraudulent or manipulated activity; and
parent or legal guardian information, where a creator is a minor, including the parent’s or guardian’s legal name, contact information, date of birth, relationship to the creator, consent or authorization records, identity-verification information, and—if the parent or guardian is the legal payee or taxpayer—tax and payout information.

Some of this information may be collected directly by a Payout Provider rather than by Castle. Depending on our technical integration, Castle may receive a verification result, tax classification, masked payment information, payment status, transaction identifier, or other administrative information instead of the complete underlying document or financial credential.

If required information is not provided, Castle may be unable to verify eligibility, process a payout, issue required tax documentation, or permit participation in the Creator Payout Program.

Information We Receive from Other Sources

We may receive information from:

app stores and payment processors regarding purchases, subscriptions, refunds, and chargebacks;
Trolley, PayPal, banks, payment networks, and other Payout Providers regarding onboarding, verification, tax documentation, payout status, and returned payments;
identity-verification, fraud-prevention, sanctions-screening, accounting, and compliance providers;
parents, legal guardians, or authorized representatives;
tax authorities, government agencies, sanctions lists, and other legally available sources; and
other users or third parties who report fraud, policy violations, intellectual-property concerns, or safety issues.

Automatically Collected Information

When you use the Service, we may automatically collect:

device and browser type;
IP address and approximate location derived from IP address;
operating-system and application information;
usage patterns, gameplay history, interactions and similar activity;
log, crash, security, and diagnostic information; and
cookies and similar technologies, as described in Section 6.

Face-Tracking and Identity Verification

Castle offers optional features that use on-device face-tracking. For those features, Castle does not receive, process, store, or retain the face-tracking data on its servers, and the data does not leave your device.

That on-device feature is separate from payout-related age or identity verification. If you participate in payout identity verification, you may be asked to provide a government-issued ID, photograph, selfie, or liveness information to Castle or an identity-verification provider. Information submitted for identity verification may leave your device and may be processed and retained as described in this Privacy Policy, the notice provided at the time of verification, and the provider’s privacy notice.

3. Legal Bases for Processing for EEA and UK Users

Where the EU General Data Protection Regulation, UK General Data Protection Regulation, or a similar law applies, we rely on one or more of the following legal bases:

Performance of a contract or steps requested before entering into a contract. We process information to create and administer accounts, provide the Service, process purchases and subscriptions, administer the Creator Payout Program, review payout requests, and make approved payments.
Compliance with legal obligations. We process information when necessary to comply with applicable tax, accounting, reporting, sanctions, court-order, regulatory, and other legal obligations.
Legitimate interests. We process information to operate and improve the Service and Creator Payout Program, verify eligibility, prevent fraud and abuse, protect users and Castle, maintain accurate accounting and transaction records, investigate disputes and chargebacks, enforce our terms, comply with legal obligations applicable to our global operations, and establish or defend legal claims. We consider the impact of this processing on users’ rights and interests.
Consent. We rely on consent for optional marketing, nonessential cookies, certain optional camera or face-related features, and other processing where applicable law requires consent.

If processing is based on consent, you may withdraw consent at any time by using the applicable account or feature controls or by contacting support@castle.xyz. Withdrawal does not affect processing that occurred before withdrawal and does not affect processing that is based on another lawful ground. If information is required to provide a requested feature or process a payout, withdrawing consent may mean that the feature or payout process cannot continue.

4. How We Use Information

We may use information to:

provide, operate, maintain, personalize, and improve the Service;
create and administer accounts and provide account security and recovery;
personalize content, game, and creator recommendations within the Services.
process purchases of Bricks and other products;
administer Castle Dweller subscriptions, including billing, renewal, cancellation, and customer support;
administer the Creator Payout Program;
determine and verify payout eligibility;
calculate, review, approve, adjust, and pay Creator Fees;
verify identity, age, country, tax status, payment information, and, where applicable, parent or legal guardian authority;
collect and validate tax forms and information;
perform required tax reporting and withholding;
process payments and returned payments and reconcile accounting records;
perform sanctions, watchlist, fraud, security, and other compliance checks;
detect and prevent manipulation, self-dealing, chargeback abuse, account farming, unauthorized payments, and other fraudulent or prohibited activity;
investigate disputes, payment errors, policy violations, and suspected fraud;
issue receipts, tax documents, payout notices, and other service communications;
communicate with users, creators, parents, legal guardians, and authorized representatives;
moderate user-generated content and enforce our Terms of Service and Community Guidelines;
respond to support inquiries and parental requests;
comply with legal, regulatory, tax, accounting, audit, and recordkeeping obligations;
establish, exercise, or defend legal claims;
conduct internal research and improve the Service; and
measure and optimize the performance of ads.

We do not use government identification documents, taxpayer identification numbers, financial-account information, or payout identity-verification information for marketing.

We do not use children’s personal information to create advertising profiles or target children with ads. We may use account, device, transaction, age, and verification information for safety, fraud prevention, legal compliance, age-appropriate experiences, and protection of the Service.

5. Disclosure of Information

We may disclose information to the following categories of recipients:

Service providers. We use providers for hosting, infrastructure, analytics, customer support, content moderation, security, communications, and other operational services.
Payment and app-store providers. We may disclose information to app stores, payment processors, card networks, banks, and other providers that process purchases, subscriptions, refunds, or chargebacks.
Payout Providers. We may disclose information to payment providers, banks, payment networks, and other providers involved in creator onboarding, tax documentation, identity verification, compliance review, and payment processing.
Identity, fraud, and compliance providers. We may disclose information to providers that verify identity, age, documents, payment information, sanctions status, or suspected fraudulent activity.
Tax, accounting, and professional advisers. We may disclose information to accountants, auditors, tax advisers, legal advisers, and other professional advisers where reasonably necessary.
Government authorities. We may disclose information to tax authorities, courts, regulators, law-enforcement agencies, sanctions authorities, and other government bodies when required or permitted by law.
Parents, legal guardians, and authorized representatives. We may disclose information about a minor’s account or Creator Payout Program participation to a verified parent, legal guardian, legal payee, or authorized representative when appropriate and permitted by law.
Rights holders and affected parties. We may disclose relevant information when reasonably necessary to investigate or respond to an intellectual-property, fraud, safety, or legal complaint.
Business-transfer recipients. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction.
Recipients you authorize. We may disclose information with your consent or at your direction.

Castle does not provide a creator with a pass or other Creator Contribution purchaser’s legal name, billing address, card number, bank-account credentials, or other complete payment credentials. Castle may provide creators with limited information about activity involving their Creator Contributions, such as the number of Bricks used, associated creator earnings information, or aggregated engagement information.

Castle shares the username of a Creator Contribution purchaser with the creator.

Trolley, PayPal, and Other Third-Party Payment Services

Some payment, tax, identity-verification, or payout information may be collected directly by Trolley, PayPal, an app store, a bank, or another third-party provider. This may occur through an embedded or Castle-branded interface, a provider-hosted page, or a linked provider account.

Depending on the particular service and applicable law, a provider may process information as a service provider or processor acting for Castle, as a separate controller or business for its own legal and operational purposes, or in both capacities. Information processed independently by a provider is subject to that provider’s own terms and privacy notice.

Our current Creator Payout Program providers include:

Trolley — for creator onboarding, payment method management, tax documentation, identity or business verification, compliance review, and payout administration; and
PayPal — as an available payout rail or payment-account provider.

These providers may use banks, payment networks, identity-verification companies, fraud-prevention services, and other downstream providers. They may also retain information independently where required for payment, fraud-prevention, tax, sanctions, regulatory, or legal purposes. Trolley’s current product documentation covers payment, tax, and identity-verification modules; PayPal’s current privacy statement describes processing by payment networks, fraud and identity-verification agencies, authorities, and other financial participants.

We may receive information regarding the status or outcome of identity verification or tax verification, even where the underlying documents are collected directly by a Payout Provider.

We do not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws. If that changes, we will update this Privacy Policy and provide any legally required opt-out mechanism.

6. Cookies and Pixels

We use cookies and/or web beacons on web for:

Service functionality
Usage analytics via Google Analytics

You can disable cookies via your browser. Some features may be limited if cookies are disabled.

7. Children and COPPA

Castle is a general-audience service and is not directed to children under 13.

We do not knowingly collect personal information from a child under 13 without any consent required by applicable law. If we learn that a user is under 13 and that personal information has been collected in a way that requires action under applicable law, we may limit account functionality, request verifiable parental consent, delete personal information, disable or delete the account, or take other appropriate action.

The Creator Payout Program is available only to users who are at least 13 years old. We do not knowingly ask a child under 13 to provide a taxpayer identification number, government-issued identification, bank information, PayPal information, or other Creator Payout Program onboarding information.

If a creator is at least 13 but has not reached the age of legal majority where the creator lives, Castle may require a parent or legal guardian to:

review and accept the Creator Payout Program terms;
authorize the creator’s participation;
provide information necessary to verify the parent’s or guardian’s identity and relationship to the creator;
establish or approve an eligible payout arrangement; or
provide tax and payout information if the parent or guardian is the legal payee or taxpayer.

Castle and its Payout Providers may communicate with the parent or legal guardian about Creator Payout Program onboarding, verification, tax documentation, payment status, disputes, or compliance issues.

A Payout Provider may apply its own age and account-ownership requirements. A minor may not create or use a Trolley, PayPal, bank, or other payout account in violation of the provider’s requirements.

Parents or guardians who believe that their child has provided personal information to Castle without the parent or guardian’s consent or knowledge may contact us at support@castle.xyz.

We do not use children’s personal information to create advertising profiles or target children with ads.

8. User Rights

You may request to:

Access, correct, or delete your data
Port your data
Object to or restrict processing

To exercise your rights, email support@castle.xyz.

Privacy rights may be subject to exceptions. For example, Castle may retain tax, accounting, payout, fraud-prevention, security, or legal records after an account-deletion request where retention is required or permitted by law.

If a Payout Provider processes information solely on Castle’s behalf, Castle will address applicable privacy requests relating to that information as required by law. If Trolley, PayPal, a bank, or another provider processes information as a separate controller or business, you may also need to submit a request directly to that provider under its privacy notice.

We may need to verify your identity before completing a privacy request. A parent, legal guardian, or authorized agent may be required to provide information establishing their authority to make a request for another person.

Users may also appeal moderation decisions by contacting support@castle.xyz.

9. U.S. State Privacy Rights (Including California, Virginia, Colorado, Connecticut, and Others)

Residents of California, Virginia, Colorado, Connecticut, and other U.S. states may have the following rights where applicable law grants those rights:

The right to know what personal information we collect, use, and disclose
The right to access, correct, or delete personal information
The right to data portability
The right to opt out of certain uses of personal information (e.g., targeted advertising or profiling, where applicable)
The right to limit use and disclosure of sensitive personal information (where applicable)
The right not to receive discriminatory treatment for exercising these rights

We do not use or disclose sensitive personal information for the purpose of inferring characteristics about users.

Categories of Personal Information We Collect

Depending on how you interact with Castle, we may collect:

Identifiers and contact information, such as username, legal name, alias, mailing address, email address, phone number, IP address, account identifiers, taxpayer identification number, Social Security number, passport number, driver’s-license number, or other government-identification number;
Customer-record information, such as date of birth, signature, physical characteristics shown on an identity document, and financial information;
Characteristics, such as age, country of residence, tax residency, and, where required for verification or compliance, nationality or citizenship;
Commercial information, such as purchase history, Castle Dweller subscription information, Bricks transactions, refunds, chargebacks, Earned Bricks, payout requests, payout amounts, payment status, and payment history;
Financial information, such as payment method, bank-account details, PayPal account information, payment tokens, and masked payment information;
Internet or electronic-network activity, such as device, browser, log, usage, interaction, and security information;
Approximate geolocation information, such as location derived from IP address;
Audio, electronic, or visual information, such as identity-document images, photographs, selfies, or liveness information used for verification;
Professional or creator information, such as Creator Payout Program participation, creator contributions, payout eligibility, and tax or contractor classification; and
Sensitive personal information, such as government-identification numbers, taxpayer identification numbers, financial-account credentials, and identity verification information, including photographs, selfies, or liveness information, where applicable.

Sources of Personal Information

We obtain personal information:

directly from users, creators, parents, and legal guardians;
automatically from devices and use of the Service;
from app stores and payment processors;
from Trolley, PayPal, banks, and other Payout Providers;
from identity-verification, fraud-prevention, sanctions-screening, tax, and compliance providers; and
from government records, sanctions lists, tax authorities, and other legally available sources.

Purposes of Collection and Use

We collect and use personal information for the purposes described in Section 4, including to:

provide and improve the Service;
process purchases and subscriptions;
administer the Creator Payout Program;
verify identity, age, tax status, payout information, and guardian authority;
process payments and tax documentation;
perform fraud, security, and sanctions reviews;
protect the integrity of the Service;
resolve disputes and payment errors; and
comply with legal, accounting, tax, audit, and regulatory obligations.

We use sensitive personal information only as reasonably necessary to provide the requested services, administer payouts, verify identity, maintain account security, prevent fraud, and comply with law. We do not use sensitive personal information to infer characteristics for advertising or unrelated marketing.

Categories of Recipients

We may disclose the categories of personal information described above to the recipients identified in Section 5, including service providers, payment and payout providers, identity-verification and fraud-prevention providers, banks, app stores, tax authorities, government agencies, professional advisers, and parents or legal guardians where appropriate.

We do not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined by applicable U.S. state privacy laws.

Data Retention

See Section 11 for information about how long we retain personal information, including creator payout, tax, and identity-verification records.

Methods to Submit a Request:

You may exercise your privacy rights in-app (for deletion) or by emailing us at support@castle.xyz (for all requests). Please include the state you reside in to help us process your request in accordance with applicable laws.

10. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect information based on its nature and sensitivity. These safeguards may include encryption, access controls, authentication measures, logging, employee-access restrictions, vendor-security review, and secure infrastructure.

We limit access to government-identification information, taxpayer identification numbers, financial information, and Creator Payout Program records to personnel and providers that need the information for authorized purposes.

Payment and Payout Providers maintain their own security practices and are responsible for protecting information they process under their own systems and legal obligations.

No method of transmission or storage is completely secure. Users are responsible for maintaining the confidentiality of their passwords and account credentials and should promptly notify Castle of suspected unauthorized activity.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Service, administer accounts and subscriptions, process purchases and payouts, protect the Service, comply with law, resolve disputes, and enforce our agreements.

Retention periods vary based on the type of information and the context in which it was collected. For example:

account and profile information may be retained while an account is active and for a reasonable period afterward;
purchase, subscription, Brick-transaction, refund, and chargeback records may be retained as needed for customer support, accounting, fraud prevention, tax, and dispute-resolution purposes;
Creator Payout Program records—including payout requests, payment history, tax records, verification status, sanctions-screening results, fraud-review records, and parent or guardian authorization records—may be retained after account deletion for as long as required or permitted for tax, accounting, audit, payment-tracing, sanctions, fraud-prevention, regulatory, litigation, and legal-compliance purposes;
government-identification documents, selfies, liveness information, and other raw identity-verification materials will be retained only for as long as reasonably necessary for verification, fraud prevention, dispute resolution, and applicable legal requirements; and
security and fraud records may be retained for a reasonable period to detect repeated abuse, protect users, and defend against legal claims.

Creator payout, tax, accounting, and payment records may therefore remain after a Castle account is deleted. Account deletion does not necessarily delete a separate Trolley, PayPal, bank, or other provider account or information that such a provider independently must retain.

Where a Payout Provider collects identity, tax, or payment information directly, that provider may apply a separate retention schedule under its privacy notice and legal obligations.

We may retain information for a longer period if it is subject to a legal hold, investigation, audit, dispute, court order, or other legal requirement. When information is no longer reasonably necessary, we delete it, deidentify it, or restrict it from further use, subject to reasonable backup and technical-deletion processes.

12. International Data Transfers

Castle is based in the United States. We and our service providers may store, access, or process personal information in the United States and in other countries where Castle, Trolley, PayPal, banks, payment networks, identity-verification providers, and other vendors operate.

The privacy and data-protection laws in those countries may differ from the laws where you live. Where applicable law requires safeguards for an international transfer, we use legally recognized mechanisms, such as an adequacy decision, approved contractual protections, or another lawful transfer mechanism.

Trolley, PayPal, and other providers may make international transfers under their own privacy notices and legal obligations.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, including a material change to how we collect, use, or disclose sensitive Creator Payout Program information, we will provide notice by appropriate means before the change takes effect where required by law.

Notice may include an in-Service notice, an email to the address associated with an account, or another reasonably prominent communication.

The effective date is posted at the top of this Privacy Policy.

14. Contact Us

For privacy questions or to exercise an applicable privacy right, contact:

Monterey’s Coast, Inc.
Email: support@castle.xyz

Mailing address:
Monterey’s Coast, Inc.
101 Alma Street #101
Palo Alto, CA 94301

If you are seeking to exercise a right concerning information controlled independently by Trolley, PayPal, an app store, a bank, or another provider, you may also need to contact that provider using the process described in its privacy notice.