Privacy Policy

This policy explains what Astrina.io collects, why, how long we keep it, and what you can ask us to do about it. We have tried to write it plainly and to be specific where most analytics policies are vague — in particular about IP addresses, which we store in raw form. Where we do not yet have something, we say so instead of implying otherwise.

Who we are and how to contact us

This service is operated as “Astrina” at https://astrina.io. In this policy, “we” and “Astrina.io” mean the operator of the service.

We have one contact address, and it is the right address for everything — privacy questions, data deletion requests, and security vulnerability reports: support@astrina.io.

We do not publish a service level agreement, so we do not promise a response time here. An SLA exists only where a separate individual contract has been concluded.

Who controls the data: you or us

The distinction matters, because it decides who a visitor should talk to about their data.

• For your own account with us — your email address, plan, balance and support tickets — we decide how that data is handled. We are the controller.
• For the analytics, session recordings and SEO data collected from a website you track, our customer (the site owner) decides what is collected and why. The customer is the controller and Astrina.io acts as the processor, handling that data on the customer’s instructions.

This means that if you are a visitor to a website that uses Astrina, the site owner — not Astrina.io — is the party responsible for that collection, including for obtaining any consent their law requires. Our Data Processing Addendum sets out this relationship.

What we collect for your account

• Your email address.
• Your password — stored only as a hash, produced with PHP password_hash() (bcrypt, PASSWORD_DEFAULT) and checked with password_verify(). We never store or log plaintext passwords.
• Your role, plan, plan expiry, account balance and the date the account was created.
• Email verification and password reset tokens — stored as a SHA-256 hash of the token, single-use, with an expiry.

Account security includes optional two-step verification and supported social sign-in. When you use social sign-in or Login with Astrina, the identity data involved is described below.

Website balance top-ups and service invoices use Payora. Approved cryptocurrency reward payouts may also be sent through Payora. Where offered in the mobile app, purchases and subscriptions use Apple App Store or Google Play billing. We use store purchase records to verify payment and apply the corresponding balance or subscription to your Astrina account. See our subprocessors.

If you submit identity verification, Astrina receives your full name, the country that issued your document, date of birth, document type and number, and an image of the document. A supported verification flow may also accept a selfie if you provide one. These submissions are linked to your account and reviewed by authorized staff to verify identity and eligibility for monetary rewards.

Verification documents are stored privately and can be viewed by you and authorized moderators. The structured profile stores only the last four characters of the document number; the document image can still show the full number. Account deletion removes the verification profile and document files, while payment-related verification decision records are handled with retained financial records.

A reward withdrawal request includes the amount, payout method, selected asset or network, destination wallet address and any destination tag or memo. We associate the request, fee, net amount and status with your account. When an approved payout is sent to Payora for processing, Payora receives the selected asset, destination address, payout amount, any tag, and payout references. Sending the request for processing does not itself mean that a payout has been completed.

What we collect as website analytics

For each page view on a site our customer tracks, we record a row in a “hit” table containing:

• The time of the visit.
• A visitor id — the first-party “_astr” id stored on the customer’s own domain, or, if that is unavailable, a fallback derived as md5(ip + user-agent + date).
• The visitor’s IP address, stored in raw form. This has its own section below, because it deserves one.
• The URL, the page title, the referrer and the referrer host.
• Browser, operating system, device and screen size.
• Country, taken from Cloudflare’s CF-IPCountry request header, and language.
• The utm_source, utm_medium and utm_campaign tags on the URL, if present.

Analytics uses only a first-party visitor id. We set no third-party cookies, do no cross-site tracking, and run no advertising pixels. We do not sell this data and we never share it with advertisers.

We also derive aggregated daily and dimension tables (agg_day, agg_dim) from these hits. Those aggregates are kept indefinitely.

IP addresses: exactly what we do

We store the visitor’s IP address in raw form. It is not anonymised and it is not truncated. We would rather say that clearly than describe ourselves as anonymous when we are not.

We use the IP address for two purposes, and no others:

• To derive the fallback visitor id, when the first-party “_astr” id is not available. The id is computed as md5(ip + user-agent + date).
• To detect probable bots, by classifying datacenter and hosting IP addresses through reverse DNS. A job runs every five minutes across the IP addresses seen in the last four days, and the results are kept in an “ip_intel” table.

How long we keep it: the IP address is retained for exactly as long as the raw hit row that holds it. That depends on the site owner’s plan — 33 days on Free, 180 days on Pro, 365 days on Business and 730 days on Business Plus. A daily job prunes expired rows, which removes the IP address with them.

We also store the IP address of anyone who submits a review, used only for abuse rate-limiting.

Session recording

Session recording is optional — it only runs if the site owner adds the recorder script. Masking is on by default, and it is enforced in the browser before anything is transmitted, not cleaned up afterwards on our side:

• Password, email and telephone input fields never transmit a value — not even its length.
• Payment card fields are treated the same way.
• All other input text is masked to bullets.
• Any part of the page marked with [data-astr-mask] is redacted before it leaves the browser.

Recordings are kept for 30 days by default. The operator can configure this.

Reviews

• We store the author (a signed-in member or a guest), the rating, the text, the submitter’s IP address for abuse rate-limiting, and the moderation status.
• Reviews from guests are published after moderation. Reviews from signed-in members publish immediately.
• Evidence images and video for some review types are stored outside the web root and served only through a gated endpoint, which returns 403 unless the review is approved, or you are its author, or you are an admin.

Phone-number signatures, and how to have yours removed

• Some people turn on contact sharing in our app. When they do, we receive pairs of “number + the name it is saved under” from their phone book — for example “Courier” or “Spam”.
• This means we may hold a signature for a number that belongs to someone who never used Astrina. We store the number, the saved name, and which member sent it — the last one only so that person can take their contribution back.
• Publicly we never show who saved a number. Only the count is shown: “Courier ×3”.
• If your number is in there, you can have it removed without an account: astrina.io/unlist/. We do not ask you to prove the number is yours — proving it would mean taking new data from you, and removal only deletes rows.
• A member who shared their contacts can withdraw everything they sent, at any time, from the app.

Support, SEO monitoring and the API

• Support desks: we store your tickets and the messages in them.
• SEO reports and per-page monitoring history are kept for 180 days by default.
• The API: one key per member (keys carry an ak_ prefix), plus a per-day call counter holding the member id, the date and the number of calls.

“Login with Astrina” identities

If you link an account from another provider through our OAuth broker, we store the provider, that provider’s user id for you, and whatever the provider returns to us — typically an email address, a display name and an avatar.

Using the mobile app

• We associate an installation identifier, platform, app version and sign-in records with your account to manage sessions and registered devices. The app keeps session tokens and preferences on your device; the server stores hashes of its access and refresh tokens.
• For push notifications, we send a device or installation identifier and notification content, including any links, to Apple Push Notification service on iOS or Google Firebase Cloud Messaging on Android. Existing Expo registrations may use Expo as an intermediary. You can control notification permissions in your device settings and available categories in Astrina.
• Store purchase data includes product and transaction identifiers, receipts or purchase tokens, subscription status and expiry, and refund information. We associate these records with your account to validate purchases, restore access and handle renewals or refunds. Apple and Google process payment data under their own policies; their purchase verification APIs do not provide us with your full card details.
• Release versions can send limited error diagnostics to Astrina while you are signed in: app version and build, platform, error category, and locations in Astrina source code. These reports exclude exception messages, arbitrary stack text, URLs, device identifiers and user content. The request is authenticated; this is not an anonymous reporting channel. Normal server request logs may also contain network metadata.
• Some app versions can send exact latitude and longitude in location-related requests. Nearby contributions can also include an area encoded as a geohash or a selected place. These requests can be linked to your signed-in account. You can control access to device location through the device permission settings.
• When you choose dictation, the app requests microphone or speech permission and uses the device's system speech-recognition service. This service may process audio remotely, for example through Apple's speech-recognition service on iOS. Recognized text is inserted into the active field and handled by that feature like typed text, for example as a review or a search query. You can refuse permission and type instead.

Contact sharing is described in the phone-number section above. Optional Pulsar node operation has a separate privacy notice. Device permission prompts and feature controls explain the access requested by those features.

Pulsar privacy notice.

Why we process this data

Described in general terms, and grouped by purpose:

• To provide what you asked for — running your account, collecting statistics for the sites you add, producing reports, and taking payment from your balance. This processing is necessary to deliver the service to you.
• For our legitimate interests in keeping the service accurate and safe — filtering bots, rate-limiting review abuse, moderating submitted content, and protecting the service against attack.
• On the basis of consent, where consent is what the applicable law requires for analytics or session recording on a website. The site owner is the controller for that collection and is responsible for obtaining consent from their visitors.
• To meet legal obligations where they apply to us.

How long we keep data

Raw hits are pruned by a daily job. All of the periods above are defaults that the operator can change. More on retention.

One honest caveat about backups: a daily backup of files and the database is taken at approximately 05:12 UTC and stored on the same server. Roughly one daily copy is kept, and there is no off-site or geo-redundant replication. Data you have asked us to delete may therefore still be present in that most recent backup copy for a time after it is removed from the live database.

Account deletion does not automatically erase financial history, including store transaction and subscription records and payment-related verification decision records retained for accounting and payment reconciliation. Contact support for details about records retained after deletion.

Who we share data with

We do not sell your data or share it with advertisers. The following services process data for the features described here; mobile delivery and purchase services are also listed below.

• OVH — infrastructure hosting, in the EU. Processes everything stored on the server.
• Cloudflare — DNS, CDN, TLS termination and WAF. Processes request metadata and IP addresses.
• Payora — payment processing for website balance top-ups, service invoices and approved cryptocurrency reward payouts.
• Have I Been Pwned (Pwned Passwords) — password leak checking. Only the first five characters of a SHA-1 hash are sent, using k-anonymity. The password itself never leaves the browser or our server, and no personal data is sent.

For push notifications, we send a device or installation identifier and notification content, including any links, to Apple Push Notification service on iOS or Google Firebase Cloud Messaging on Android. Existing Expo registrations may use Expo as an intermediary. You can control notification permissions in your device settings and available categories in Astrina.

Apple App Store and Google Play: handle purchases and subscriptions on their platforms. Astrina exchanges purchase and transaction identifiers, receipts or purchase tokens, product identifiers and purchase status with the relevant store to validate purchases and process renewals, restoration and refunds.

We also pull public catalog data from CoinGecko, SteamSpy, Open Food Facts and IMDb datasets. These are one-way: they receive no personal data from us.

Outbound email is sent from our own Exim mail server as noreply@astrina.io, with DKIM configured. We do not use a third-party email provider, so your address is not handed to one.

See our subprocessors.

Cookies and local storage

On astrina.io itself:

• astrsess — the session cookie. Strictly necessary. HttpOnly, Secure and SameSite=Lax.
• astr_lang — remembers your chosen interface language.
• astr-theme — your theme preference, kept in localStorage rather than in a cookie.

We set no advertising or third-party tracking cookies on astrina.io.

On a customer’s website, the analytics script stores “_astr”, a first-party visitor id, in localStorage with a cookie fallback. It is set on the customer’s own domain, cannot be read across sites, and is not a third-party cookie.

Full cookie details.

How we protect data

The measures we actually have in place:

• TLS on all traffic — Cloudflare in Full (strict) mode with a Let’s Encrypt certificate on the origin.
• Passwords hashed with bcrypt; never stored or logged in plaintext.
• The session cookie is HttpOnly, Secure over HTTPS, and SameSite=Lax.
• CSRF tokens on state-changing form submissions.
• API keys are accepted only in a request header (X-Api-Key, or Authorization: Bearer). We deliberately do not accept them in the URL query string, so they cannot leak into server logs, proxy logs, browser history or Referer headers. You can regenerate a key at any time from /my/api.php, which revokes the old one instantly.
• The private analytics API method sends no Allow-Origin header, so a browser cannot read it cross-origin. Public API methods are intentionally open.
• The SEO crawler is hardened against SSRF: only http and https, private, loopback and link-local ranges are refused, the resolved IP is pinned, every redirect hop is re-validated, and the response body is capped.
• Per-IP submission limits and moderation on reviews; bot filtering by user-agent rules and datacenter-IP classification.
• The admin area is gated by a role check.

This policy does not claim a published penetration test report, ISO or SOC 2 certification, a bug bounty programme or off-site backups.

Report a security vulnerability to support@astrina.io. More on security.

Your rights and how to use them

Where data protection law gives you rights such as access, correction, deletion or objection, contact support@astrina.io. You can also export your account data and request account deletion through the self-service controls below.

Open My data in the app or My data & consents on the website to export data or request deletion. The screen shows the scheduled date and any available cancellation period. You can cancel only before that period ends; a scheduled request is not a confirmation that deletion has already finished.

Open account data and deletion controls.

Deleting your Astrina account does not cancel an App Store or Google Play subscription. Manage or cancel that subscription in the store that bills you. You can still contact support@astrina.io if you cannot access your account or need help with a data request.

Other controls available in your account:

• Delete an individual tracked site from your panel, which removes that site’s data.
• Regenerate or revoke an API key at any time from /my/api.php.

If you are a visitor to a website that uses Astrina and you want that site’s data about you removed, the site owner is the controller and is the right party to contact. If you reach us instead, we will handle it on their instructions as their processor.

Changes to this policy

If we change how we handle personal data, we will update this page and the “last updated” date above. Where a change is significant, we will describe what changed rather than quietly replacing the text. See the changelog.

Questions about anything on this page: support@astrina.io. Contact us.