Privacy Policy

This policy explains what Astrina.io collects, why, how long we keep it, and what you can ask us to do about it. We have tried to write it plainly and to be specific where most analytics policies are vague — in particular about IP addresses, which we store in raw form. Where we do not yet have something, we say so instead of implying otherwise.

Who we are and how to contact us

This service is operated as “Astrina” at https://astrina.io. In this policy, “we” and “Astrina.io” mean the operator of the service.

We have one contact address, and it is the right address for everything — privacy questions, data deletion requests, and security vulnerability reports: support@astrina.io.

We do not publish a service level agreement, so we do not promise a response time here. An SLA exists only where a separate individual contract has been concluded.

Who controls the data: you or us

The distinction matters, because it decides who a visitor should talk to about their data.

• For your own account with us — your email address, plan, balance and support tickets — we decide how that data is handled. We are the controller.
• For the analytics, session recordings and SEO data collected from a website you track, our customer (the site owner) decides what is collected and why. The customer is the controller and Astrina.io acts as the processor, handling that data on the customer’s instructions.

This means that if you are a visitor to a website that uses Astrina, the site owner — not Astrina.io — is the party responsible for that collection, including for obtaining any consent their law requires. Our Data Processing Addendum sets out this relationship.

What we collect for your account

• Your email address.
• Your password — stored only as a hash, produced with PHP password_hash() (bcrypt, PASSWORD_DEFAULT) and checked with password_verify(). We never store or log plaintext passwords.
• Your role, plan, plan expiry, account balance and the date the account was created.
• Email verification and password reset tokens — stored as a SHA-256 hash of the token, single-use, with an expiry.

The Astrina panel does not have two-factor authentication and does not support SSO. We are stating this plainly rather than leaving it unsaid.

Plans are paid from an account balance topped up through Payora, our payment processor for cards and crypto. See our subprocessors.

What we collect as website analytics

For each page view on a site our customer tracks, we record a row in a “hit” table containing:

• The time of the visit.
• A visitor id — the first-party “_astr” id stored on the customer’s own domain, or, if that is unavailable, a fallback derived as md5(ip + user-agent + date).
• The visitor’s IP address, stored in raw form. This has its own section below, because it deserves one.
• The URL, the page title, the referrer and the referrer host.
• Browser, operating system, device and screen size.
• Country, taken from Cloudflare’s CF-IPCountry request header, and language.
• The utm_source, utm_medium and utm_campaign tags on the URL, if present.

Analytics uses only a first-party visitor id. We set no third-party cookies, do no cross-site tracking, and run no advertising pixels. We do not sell this data and we never share it with advertisers.

We also derive aggregated daily and dimension tables (agg_day, agg_dim) from these hits. Those aggregates are kept indefinitely.

IP addresses: exactly what we do

We store the visitor’s IP address in raw form. It is not anonymised and it is not truncated. We would rather say that clearly than describe ourselves as anonymous when we are not.

We use the IP address for two purposes, and no others:

• To derive the fallback visitor id, when the first-party “_astr” id is not available. The id is computed as md5(ip + user-agent + date).
• To detect probable bots, by classifying datacenter and hosting IP addresses through reverse DNS. A job runs every five minutes across the IP addresses seen in the last four days, and the results are kept in an “ip_intel” table.

How long we keep it: the IP address is retained for exactly as long as the raw hit row that holds it. That depends on the site owner’s plan — 33 days on Free, 180 days on Pro, 365 days on Business and 730 days on Business Plus. A daily job prunes expired rows, which removes the IP address with them.

We also store the IP address of anyone who submits a review, used only for abuse rate-limiting.

Session recording

Session recording is optional — it only runs if the site owner adds the recorder script. Masking is on by default, and it is enforced in the browser before anything is transmitted, not cleaned up afterwards on our side:

• Password, email and telephone input fields never transmit a value — not even its length.
• Payment card fields are treated the same way.
• All other input text is masked to bullets.
• Any part of the page marked with [data-astr-mask] is redacted before it leaves the browser.

Recordings are kept for 30 days by default. The operator can configure this.

Reviews

• We store the author (a signed-in member or a guest), the rating, the text, the submitter’s IP address for abuse rate-limiting, and the moderation status.
• Reviews from guests are published after moderation. Reviews from signed-in members publish immediately.
• Evidence images and video for some review types are stored outside the web root and served only through a gated endpoint, which returns 403 unless the review is approved, or you are its author, or you are an admin.

Phone-number signatures, and how to have yours removed

• Some people turn on contact sharing in our app. When they do, we receive pairs of “number + the name it is saved under” from their phone book — for example “Courier” or “Spam”.
• This means we may hold a signature for a number that belongs to someone who never used Astrina. We store the number, the saved name, and which member sent it — the last one only so that person can take their contribution back.
• Publicly we never show who saved a number. Only the count is shown: “Courier ×3”.
• If your number is in there, you can have it removed without an account: astrina.io/unlist/. We do not ask you to prove the number is yours — proving it would mean taking new data from you, and removal only deletes rows.
• A member who shared their contacts can withdraw everything they sent, at any time, from the app.

Support, SEO monitoring and the API

• Support desks: we store your tickets and the messages in them.
• SEO reports and per-page monitoring history are kept for 180 days by default.
• The API: one key per member (keys carry an ak_ prefix), plus a per-day call counter holding the member id, the date and the number of calls.

“Login with Astrina” identities

If you link an account from another provider through our OAuth broker, we store the provider, that provider’s user id for you, and whatever the provider returns to us — typically an email address, a display name and an avatar.

Why we process this data

Described in general terms, and grouped by purpose:

• To provide what you asked for — running your account, collecting statistics for the sites you add, producing reports, and taking payment from your balance. This processing is necessary to deliver the service to you.
• For our legitimate interests in keeping the service accurate and safe — filtering bots, rate-limiting review abuse, moderating submitted content, and protecting the service against attack.
• On the basis of consent, where consent is what the applicable law requires for analytics or session recording on a website. The site owner is the controller for that collection and is responsible for obtaining consent from their visitors.
• To meet legal obligations where they apply to us.

How long we keep data

Raw hits are pruned by a daily job. All of the periods above are defaults that the operator can change. More on retention.

One honest caveat about backups: a daily backup of files and the database is taken at approximately 05:12 UTC and stored on the same server. Roughly one daily copy is kept, and there is no off-site or geo-redundant replication. Data you have asked us to delete may therefore still be present in that most recent backup copy for a time after it is removed from the live database.

Who we share data with

We do not sell your data, and we do not share it with advertisers. The complete list of parties that process data on our behalf is:

• OVH — infrastructure hosting, in the EU. Processes everything stored on the server.
• Cloudflare — DNS, CDN, TLS termination and WAF. Processes request metadata and IP addresses.
• Payora — payment processing for balance top-ups, by card and crypto.
• Have I Been Pwned (Pwned Passwords) — password leak checking. Only the first five characters of a SHA-1 hash are sent, using k-anonymity. The password itself never leaves the browser or our server, and no personal data is sent.

We also pull public catalog data from CoinGecko, SteamSpy, Open Food Facts and IMDb datasets. These are one-way: they receive no personal data from us.

Outbound email is sent from our own Exim mail server as noreply@astrina.io, with DKIM configured. We do not use a third-party email provider, so your address is not handed to one.

See the full subprocessor list.

Cookies and local storage

On astrina.io itself:

• astrsess — the session cookie. Strictly necessary. HttpOnly, Secure and SameSite=Lax.
• astr_lang — remembers your chosen interface language.
• astr-theme — your theme preference, kept in localStorage rather than in a cookie.

We set no advertising or third-party tracking cookies on astrina.io.

On a customer’s website, the analytics script stores “_astr”, a first-party visitor id, in localStorage with a cookie fallback. It is set on the customer’s own domain, cannot be read across sites, and is not a third-party cookie.

Full cookie details.

How we protect data

The measures we actually have in place:

• TLS on all traffic — Cloudflare in Full (strict) mode with a Let’s Encrypt certificate on the origin.
• Passwords hashed with bcrypt; never stored or logged in plaintext.
• The session cookie is HttpOnly, Secure over HTTPS, and SameSite=Lax.
• CSRF tokens on state-changing form submissions.
• API keys are accepted only in a request header (X-Api-Key, or Authorization: Bearer). We deliberately do not accept them in the URL query string, so they cannot leak into server logs, proxy logs, browser history or Referer headers. You can regenerate a key at any time from /my/api.php, which revokes the old one instantly.
• The private analytics API method sends no Allow-Origin header, so a browser cannot read it cross-origin. Public API methods are intentionally open.
• The SEO crawler is hardened against SSRF: only http and https, private, loopback and link-local ranges are refused, the resolved IP is pinned, every redirect hop is re-validated, and the response body is capped.
• Per-IP submission limits and moderation on reviews; bot filtering by user-agent rules and datacenter-IP classification.
• The admin area is gated by a role check.

Equally, here is what we do not have, so that you are not left to assume it: no two-factor authentication, no published penetration tests, no ISO, SOC 2 or other certification, no bug bounty programme, and no off-site backup.

Report a security vulnerability to support@astrina.io. More on security.

Your rights and how to use them

Where data protection law gives you rights over your personal data — such as access, correction, deletion, or objecting to processing — you can exercise them by writing to support@astrina.io. That is the only channel, and we will not pretend otherwise.

Specifically, on deletion: there is no self-service account deletion button in the panel today. Account deletion is done on request by emailing support@astrina.io.

Two things you can do yourself right now, without asking us:

• Delete an individual tracked site from your panel, which removes that site’s data.
• Regenerate or revoke an API key at any time from /my/api.php.

If you are a visitor to a website that uses Astrina and you want that site’s data about you removed, the site owner is the controller and is the right party to contact. If you reach us instead, we will handle it on their instructions as their processor.

Changes to this policy

If we change how we handle personal data, we will update this page and the “last updated” date above. Where a change is significant, we will describe what changed rather than quietly replacing the text. See the changelog.

Questions about anything on this page: support@astrina.io. Contact us.