dash-b · Privacy
What we know about you is almost nothing.
Not a promise — a description. This page says what is collected, by whom, why, and how to make it stop. Where something is genuinely collected, it says so plainly instead of hiding it under a heading about improving your experience.
In one paragraph
You can use this without telling us who you are
Reading this website leaves a line in a web server's log, the same line every web server on earth writes, and a visit counted by our own analytics, described below. Designing a dashboard needs no account, and the design lives in your own browser until you decide otherwise. If you open an account, we hold the address you opened it with and the work you asked us to keep. If you start a chat, we hold that conversation too. There is no advertising here, no profiling, nothing sold to anybody, and no third party watching you read this.
No scripts from other companies. Every page loads scripts only from this website and from two services run by Castomo: Observer (observer.castomo.com) and the chat button (chat.castomapi.com).
No tag manager, no pixel, no session recorder, no A/B testing tool. Visitor numbers come from Observer, castomo's own cookie-less analytics, and from the server's access log read in totals — neither follows a person, which is why nobody here can answer the question "what did this person look at". Clicks and scrolling are counted only as totals.
This website
dash-b.com, and what it touches
The access log
The company that hosts this site writes one line per request: the time, the address asked for, the browser's own description of itself, the page you came from if any, and your IP address. An IP address is personal data and this one is collected — it is how a web server answers a request at all. It is used to count visitors and to see which pages are read. The tool that reads it keeps counts only; each address is hashed with a value invented for that run and thrown away afterwards, so the result cannot be turned back into a person even by us.
Visitor counts
Analytics: Observer. We count visits with Observer, our own analytics, run by Castomo on its own server in Frankfurt. It sets no cookies and stores nothing on your device. For each page you open it records: the page address (of any query only campaign tags such as utm_source) and title, the site you came from, your browser, device type and operating system, your browser language, a rough screen-size bracket, how long the page was actively open, how fast it loaded, any script error, and — as totals — where people click and how far they scroll. It takes no recording of your screen and reads no keystrokes.
Your IP address is used for a moment, together with your browser, to make a code that changes every day and is different on every site. The IP address itself is never stored, and the server that delivers Observer keeps no access log. The code lets us count one visitor once a day, and it cannot be used to link a visit to visits on other days or other sites. Raw records are deleted after 24 hours; only totals are kept, for 25 months. If your browser sends Do Not Track or Global Privacy Control, Observer sends no visit data.
We do this because we have a legitimate interest in knowing how our pages are used (Article 6(1)(f) GDPR). You can object at any time: hello@castomo.com.
What is stored in your browser
Choosing light, dark or high-contrast writes dashb-style into your browser's local storage, so the next page you open is already in the style you picked. That value never leaves your machine, and clearing your browser data removes it. It is not a cookie, and neither this site nor the services it uses set any — which is why you were not asked to accept any.
Only if you open the chat: castomo.chat.<widget id>.returning (the value 1) and, while the chat is open, castomo.chat.<widget id>.open, on this site; and castomo.chat.<widget id>.token and castomo.chat.<widget id>.visit on chat.castomapi.com. Nothing is written before you open it. Clearing your browser's site data removes them.
The chat button
Chat assistant. Every page has a chat button run by Castomo (chat.castomapi.com, servers in Amsterdam). Until you open the chat, the button stores nothing on your device and starts no conversation; loading the page only fetches the button's settings from our chat server, which, like any web server, records the request, including your IP address, in a rotating log that is overwritten as it fills.
When you open the chat, the chat window saves a visitor code and a few settings in your browser's local storage, and our server creates a visitor record: the code (kept only as a hash), a hash of your IP address, your browser type, language and time zone, the page you were on and where you came from, and everything you type — plus your name, e-mail or phone number only if you give them.
The assistant is an AI, and it says so. Its answers are written by AI models run by OpenRouter (Google Gemini) and OpenAI, which receive what you type in order to reply; after a conversation ends the same text is sent to a model again to write a short summary. A person on our team can read the conversation and take it over. These providers may process data outside the European Economic Area.
We keep a visitor's record and conversations until 180 days after their last visit, then delete them. You can ask us to delete them sooner: hello@castomo.com. Please do not type anything you do not want us to have.
The typeface
The page's font is fetched from Google's font servers, which means Google's servers see your IP address and which page requested the font. Nothing else on this site talks to anyone but us. We would rather it did not do that either, and the font is being moved onto our own servers; until it is, this sentence is here because you should not have to read the source to find that out.
The world board
The front page shows the current game leaderboard, fetched from social.castomapi.com — our own service, operated by the company named at the end of this page. The request leaves the page but not the company: it sets no cookie, sends nothing about you but the request itself, and the players it lists chose to be listed. Offline, the page simply shows no board.
Links that leave
Some pages link to the other castomo products, to our own media library, and to the licences the photographs on the front page were published under. Following a link puts you on somebody else's site under their rules, not ours.
The designer
app.dash-b.com is a different thing, and it holds more
The website sells; the designer is the product. It runs in your browser, and the amount it knows about you depends entirely on how far you go into it.
Designing, with no account
Nothing is sent anywhere. The design is held by your browser, on your machine. Close the tab and it is still yours; clear your browser storage and it is gone, including from us, because we never had it.
An account, if you make one
An account holds the email address you opened it with, whatever you choose to put in your own profile, and the designs you ask us to save. It exists so that work can follow you between machines and so a published page has an owner. Nothing in it is used for anything else.
Paying
Card details never reach us. A paid plan sends you to Stripe's own checkout page, Stripe takes the payment, and what comes back to us is that the payment happened. There is no card number in any system of ours to lose.
A bug report
The report form sends what you typed, and your email address if you gave one so somebody can answer. It offers to attach the design you were working on, because that is usually the fastest way to reproduce a fault — that attachment is a checkbox, it is off unless you turn it on, and a design can contain whatever you put in it.
Publishing
A published page is on the public internet because you published it. Anything you put on a board you publish is public with it, including anything a widget on it is reading. The designer tells you which tiles will be empty for a stranger and which will not, before you publish rather than after.
Connected services
If you connect your own database, a WordPress site or another account, dash-b reads from it to draw your tiles. Databases are connected read-only: nothing dash-b does can write to your production data, because the connection was never given the ability to. You can disconnect any of them whenever you like.
Your rights
Ask, and it happens
If you are in the EU or the UK, the law gives you the right to see what is held about you, to correct it, to have it deleted, to take it away in a portable form, and to object to a particular use. We would answer these anyway; the law simply means you do not have to ask nicely.
Write to hello@castomo.com from the address the account uses and say what you want. There is no form, no portal and no identity-verification ritual beyond that.
Deletion means deletion, across all of it.
Erasing an account does not just close a door on one service. It removes you from the services built on the same account — the shared boards, the collaboration rooms, the messages — in one operation, so there is no forgotten corner holding a copy. Published pages you made are taken down with it.
You also have the right to complain to a data protection authority in the country you live in, and you do not need our permission or our involvement to do it.
How long
Kept while it is doing something, then not
Your account and your designs
For as long as the account exists. Delete the account and they go with it.
Bug reports
Kept while the bug is open and for a while after, because the same fault comes back. Ask and yours is removed.
Chat conversations
A visitor's record and conversations in the chat are kept until 180 days after the visitor's last visit, then deleted. Ask, and yours is deleted sooner.
Server logs
Written and rotated by the hosting company on their own schedule, one file per day. We read them, we do not keep our own copy, and what we take out of them is counts.
Payment records
Invoices are kept as long as tax law requires them to be kept, which is longer than anything else on this page and is not a choice either of us gets to make.
Who this is
A named person answers this address
The controller of the personal data described above — the company that decides what is collected and why — is Castomo prosta spółka akcyjna, of ul. Powstańców Śląskich 5/212, 53-332 Wrocław, Polska, entered in the Polish register of entrepreneurs under KRS 0001188843 by the Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, VI Wydział Gospodarczy Krajowego Rejestru Sądowego, NIP 8993033031, REGON 542471636.
It is the company behind dash-b, and behind castomAPI, castomFlow, castomUI and ClickSomo. Questions about this page, about what is held, or about having it deleted go to hello@castomo.com and are read by the people who built the thing you are asking about. There is no separate privacy address, because there is no separate department.
Poland's supervisory authority is the President of the Personal Data Protection Office — the Prezes Urzędu Ochrony Danych Osobowych — and you may complain to them, or to the authority in the country you live in, without involving us at all.
If this page changes in a way that matters, the change is described in the changelog with its date, in the same place every other change to this product is described. Nothing here is altered quietly.
The shortest privacy policy is the one you can verify.
Open the developer tools on this page and watch the network tab. There is nothing on it this page has not already named.