Cookie Policy

This page explains two separate things: the cookies we set on astrina.io when you visit the site or use your account, and what the Astrina analytics script stores in your visitors' browsers if you install it on your own website. They are different, and we keep them apart on purpose.

For the full picture of what data we collect, why, and how long we keep it, see our Privacy Policy.

1. Cookies we set on astrina.io

These are the only cookies Astrina sets on this website:

• astrsess — strictly necessary. This is the session cookie that keeps you signed in to your account. It is HttpOnly (JavaScript on the page cannot read it), Secure (sent only over HTTPS) and SameSite=Lax. There is no way to offer a signed-in account without it.
• astr_lang — remembers the interface language you picked, so the site stays in that language on your next visit. It holds nothing but the language choice.

astrina.io is served through Cloudflare, which provides our DNS, CDN and TLS. Cloudflare is listed on our Subprocessors page.

Your theme preference is not a cookie

Your light/dark theme choice is saved in your browser under astr-theme using localStorage, not a cookie. Unlike a cookie, it is not attached to requests, so it stays in your browser and is not sent to us.

2. No advertising or third-party tracking cookies

We do not set advertising cookies, third-party tracking cookies, cross-site tracking cookies or advertising pixels on astrina.io. We do not sell data, and we never share it with advertisers.

3. What our analytics script stores on your website

If you install the Astrina analytics script on a site you own, it stores a single identifier — _astr, a visitor id — in each visitor's browser. It is kept in localStorage, with a cookie as a fallback for browsers where localStorage is not available.

The important detail is where it lives: _astr is set on your own domain, not on astrina.io. That makes it a first-party identifier. Other websites cannot read it, it is not a third-party cookie, and it does not follow anyone from one site to another. We do not use it to build cross-site profiles.

If the identifier cannot be stored — for example when a visitor blocks browser storage — a fallback visitor id is instead derived from the visitor's IP address, browser user-agent and the date, so the visit can still be counted. Our analytics does store visitors' IP addresses in raw form, without anonymising or truncating them. That is set out in full, along with retention periods, in our Privacy Policy.

4. If you use Astrina analytics on your site, this part is your responsibility

You decide whether to install the script. Informing your own visitors about it, and obtaining their consent where the law that applies to you requires it, is your responsibility — including describing the _astr identifier in your own cookie or privacy notice. We cannot do this on your behalf, because we do not control your site and cannot know which rules apply to your visitors.

5. Controlling cookies and storage in your browser

You can delete or block cookies, and clear localStorage, in your browser settings. Two things are worth knowing before you do:

• Blocking astrsess will stop you signing in to astrina.io. It is the cookie that carries your session, so the account area cannot work without it.
• Clearing site data removes astr_lang and your saved theme. Nothing breaks — the site simply falls back to its defaults.

6. Questions

For any question about this policy, or any privacy or data deletion request, email support@astrina.io. It is our only contact address.