Privacy

Last updated: September 2026.

What we process

• Account identity. When you sign in with Google we receive your Google account ID, email address, name, and avatar from Google, and store them as your Astraea account.
• Sessions. Sign-in mints a random session token, valid 30 days across *.astraeatech.dev. Only a hash of the token is stored; the token itself lives in your browser cookie.
• Sign-in flow. Short-lived cookies (state and return address, 10 minutes) protect the OAuth exchange, then are cleared.
• No analytics. These pages run no analytics and no advertising trackers.

Why we process it

To log you in once and recognize you on every Astraea product, to keep your sessions secure, to prevent abuse, and to comply with legal obligations. Product-specific data (plans, API keys, usage, billing) is governed by each product's own privacy policy.

Sharing

We share data only with our infrastructure provider (Cloudflare, hosting), with Google as part of the OAuth sign-in flow, and with Astraea products you visit — which receive your account identity when validating your session. Data is also disclosed when required by law. We do not sell personal data.

Retention

Sessions expire automatically after 30 days (sooner if you sign out) and expired rows are deleted. Your account record is kept while your account exists; request deletion anytime (below) and it — plus your sessions — is removed.

Your rights

You may request a copy or deletion of your account data at any time by emailing admin@astraeatech.dev.

Security

Traffic is encrypted in transit (TLS). Session tokens are stored only as hashes, and production data access follows least privilege.

Changes

We will post any changes to this policy on this page.