Acceptable Use Policy

This policy explains what you may and may not do with Astrina.io. It applies to everyone who uses our analytics script, the session recorder, reviews, the catalog, blacklist and phone data, the SEO crawler, the API and "Login with Astrina" — on every plan, including the Free plan.

It sits alongside our Terms of Service and our Privacy Policy. In this policy, "we" and "us" mean Astrina.io. If you break these rules, we may remove content, suspend your access or terminate your account — see How we enforce this.

1. Track only sites you own or are allowed to track

You may install the Astrina tracking script only on a website that you own, or that you operate with the permission of the person or organisation that owns it.

Do not install the script on a site you do not control, and do not use it to monitor someone else's site or someone else's visitors without their knowledge.
Do not add a site to your panel in order to collect data about a competitor, an employer or any third party you have no permission to track.
You are responsible for telling your own visitors what you collect and for obtaining any consent your law requires. Astrina does not do this for you.

Please be aware of what our analytics actually stores, because you are the one disclosing it to your visitors: each hit includes the visitor's IP address in raw form — it is not anonymised or truncated — as well as the URL, page title, referrer, browser, OS, device, screen size, country, language and UTM parameters. The visitor id is a first-party id ("_astr") set on your own domain. Full detail is on our Privacy Policy and Data Retention pages.

2. Data you must not collect through Astrina

Our scripts are built for ordinary website measurement. Do not use them to collect:

Special categories of personal data — for example data about health, sex life or sexual orientation, religious or political beliefs, racial or ethnic origin, trade union membership, genetic or biometric data, or criminal offences.
Data from websites or sections of websites that are directed at children.
Financial account data, government identifiers, credentials or authentication tokens.

Because we store the URL, the page title, the referrer and your UTM parameters exactly as they arrive, do not put personal data into them. Names, email addresses, order details, session tokens or reset links placed in a query string will be stored in the hit row as ordinary text. Strip them on your side before the page is tracked.

3. Session recording: do not defeat the masking

The optional session recorder masks sensitive input by default, and that masking is enforced in the browser before anything is sent to us:

Password, email and telephone input fields never transmit a value — not even its length.
Payment-card fields are treated the same way.
All other input text is masked to bullets.
Any subtree you mark with [data-astr-mask] is redacted before it leaves the browser.

You must not work around this. Specifically, do not modify, patch, wrap or reimplement the recorder so that masking is weakened or disabled, and do not deliberately arrange your pages so that sensitive data escapes masking — for example by rendering card numbers, passwords, personal messages or identity documents as ordinary page text rather than inside an input field.

Masking covers input fields plus anything you mark yourself. If your page displays sensitive information outside an input, it is your responsibility to wrap it in [data-astr-mask]. Recordings are kept for 30 days by default; the operator can configure this.

4. Reviews and content you publish

The review system only works if what is in it is real. Do not post:

Fake reviews, or reviews of an experience you did not have.
Reviews you were paid, incentivised or instructed to write, and reviews you commission from others.
Reviews you write about your own business, or reviews written to damage a competitor.
Defamatory statements, or claims of fact you cannot support.
Illegal content, threats, harassment, or hate speech.
Material you have no right to upload, including evidence images or video belonging to someone else.

How review publishing works: reviews from signed-in members publish immediately, and guest reviews are published after moderation. We store the submitter's IP address with the review and use it only for abuse rate-limiting. Evidence images and video for some review types are stored outside the web root and are served only through a gated endpoint, which refuses the request unless the review is approved, or you are its author or an administrator.

5. Do not publish other people's personal data

Do not use Astrina to expose or harass a private individual. This is not permitted anywhere on the service — in reviews, in evidence uploads, in catalog entries, in support tickets or through the API.

No doxxing. Do not publish a private individual's home address, personal phone number, identity documents, workplace, family details or private messages.
Do not publish someone's contact details so that others can contact, pressure, shame or intimidate them.
Do not post photographs or video of a private individual taken without their knowledge, or intimate imagery of anyone.
Criticising a business, a service or a public-facing organisation is what the review system is for. Targeting the private life of the people behind it is not.

6. Blacklist and phone data

Do not use blacklist entries, phone lookups or any other subject data on Astrina to harass, threaten, stalk, intimidate or pressure anyone. Do not use them to build cold-call, spam or marketing lists, and do not bulk-harvest them to repackage as your own database or product.

7. SEO crawler and page monitoring

Submit only URLs you own or have permission to monitor. Do not point the crawler at illegal or malicious sites — including malware distribution, phishing, fraud, or child sexual abuse material.

Do not try to use the crawler as a proxy to reach systems you cannot reach yourself. The crawler is deliberately hardened against this: it accepts only http and https, refuses private, loopback and link-local address ranges, pins the resolved IP, re-validates every redirect hop and caps the response body. Attempting to bypass these protections is a violation of this policy and is treated as an attack on the service.

SEO reports and per-page monitoring history are kept for 180 days by default — see Data Retention.

8. API use

Each member gets one API key (prefixed ak_). Use it as intended:

Do not share, publish, sell or sublicense your key, and do not embed it anywhere it becomes public, such as client-side code or a public repository.
Do not exceed your plan's daily call quota, and do not try to evade it — for example by rotating keys, registering extra accounts or spreading calls across IP addresses. Exceeding the quota returns HTTP 429.
Do not scrape. Bulk-harvesting catalog, review, rating or phone data outside the API and its quotas is not permitted, whether by script, headless browser or any other means.
Do not attempt to read the private analytics method cross-origin, or to reach data belonging to another member.

For your own protection, keys are accepted only in a request header (X-Api-Key or Authorization: Bearer) and deliberately never in the URL query string, so they cannot leak into server logs, proxy logs, browser history or Referer headers. If your key is exposed, regenerate it at /my/api.php — this revokes the old key instantly — and tell us at support@astrina.io.

9. Do not attack, overload or probe the service

Do not attempt to break, degrade or gain unauthorised access to Astrina or to the data of other members. This includes bypassing authentication or role checks, tampering with sessions or CSRF tokens, injection attempts, and reading or modifying anything that is not yours.

Do not run denial-of-service, load, stress, vulnerability-scanning or penetration testing against the service without our written permission. Automated tools that generate abnormal load are treated the same way.

We do not operate a bug-bounty programme and we do not offer rewards for vulnerability reports. We would still very much like to hear about anything you find: please report it privately to support@astrina.io and give us a reasonable opportunity to fix it before disclosing it. Do not access, copy, retain or publish other people's data as part of any research.

10. Your account and credentials

You are responsible for what happens under your account. Keep your password to yourself and do not let others sign in as you.

Being straightforward about this: the Astrina panel does not currently offer two-factor authentication or SSO. Your password is the only thing protecting your account, so please use a strong, unique one. We store passwords only as a bcrypt hash and never in plaintext, but that does not help if the password itself is weak or reused. Contact us at support@astrina.io if you believe your account has been accessed by someone else.

11. Reselling and rebranding

Do not resell, rebrand, white-label or present Astrina as your own product or service unless we have separately agreed to it with you. If you would like an arrangement of that kind, write to support@astrina.io.

12. How we enforce this

If we believe this policy has been broken, we may take any of the following steps:

Remove or hide the content in question — for example a review, an evidence upload or a catalog entry.
Refuse or stop a crawl, or stop tracking a site.
Throttle requests, or revoke or regenerate an API key.
Suspend your access.
Terminate your account.

We generally start with the smallest step that resolves the problem. Serious violations — illegal content, attacks on the service, doxxing or harassment — may lead to immediate suspension or termination without prior notice.

You can delete your account yourself: My data & consents → Delete my account. It runs after a grace period, and you can cancel it until then. The same page downloads everything we hold about you. You can also delete an individual tracked site at any time, which removes its data, and regenerate or revoke your API key at /my/api.php.

13. Reporting abuse

If you see something on Astrina that breaks this policy — a fake review, doxxing, harassment, illegal content, or a site tracking visitors it should not be — report it to support@astrina.io. This is our only contact address, and it is also where privacy requests, data deletion requests and security vulnerability reports should go.

Please include a link to the content or subject, what specifically is wrong with it, and anything that helps us verify it. If you are the person whose personal data has been published, say so — we will prioritise it.

To be honest about expectations: we do not publish a target response time, and no service level agreement applies unless you have separately concluded an individual contract with us. See Contact.

14. Changes to this policy

We may update this policy as the service changes. The "Last updated" date at the top of this page always shows when it was last changed. Continuing to use Astrina after a change means the updated policy applies to you.

Terms of Service — the agreement this policy sits under.
Privacy Policy — what we collect and why.
Data Retention — how long we keep hits, recordings and SEO history.
Security — the measures that protect the service.
Cookies — what astrina.io and the analytics script set.
Subprocessors — who else processes data.
Data Processing Agreement — for customers who need one.