Privacy policy

Summary

We do not sell data, show ads or use third-party analytics or trackers.
The content of your traffic and the addresses of pages you open are not recorded.
To run and protect the services we keep account data, traffic counters, the time and address of connections and a security event log. Details and retention periods are below.
Questions, copies and deletion of your data: privacy@astralnet.io.

"astral", "we" — the operator of the astral services. This policy covers the astralnet.io site, astral ID single sign-on (id.astralnet.io), the secure connection and astral mail.

The astralnet.io site

The site is static pages with no analytics, counters or third-party scripts; fonts and images load from our own server.

The edge proxy that serves all our addresses keeps a technical request log: IP address, time, site and page address, response code, size, browser (User-Agent) and referring page (Referer). It is used to defend against attacks and to diagnose failures, and it is kept for up to 30 days.

Request and waitlist forms

When you send a form we receive your email address, your name and message (if given), the page language, the time and your IP address — the last one only to protect against spam and abuse.

An access request is kept while we review it and for up to 12 months after we reply. A waitlist address is kept until the subscription launches: we write once and remove the address from the list unless you subscribe. To have it removed earlier, write to privacy@astralnet.io.

astral ID

astral ID is your account and single sign-on for every astral service. It stores:

Profile: email address and whether it is verified, display name, interface language, roles and organisation memberships.
Sign-in methods: the password only as a hash (argon2id); the authenticator secret encrypted; recovery codes as one-way check values; for passkeys, the public key, a name and the time of last use. A passkey's private key never leaves your device.
Sessions: sign-in and last activity time, sign-in method, IP address and browser (User-Agent), so that you can see active sessions and end the ones you do not need.
Security event log: sign-ins and failed attempts, changes to the password, second factor and other settings, administrator actions — with time, IP address and browser. A failed sign-in counter is used to lock an account temporarily against password guessing.
Applications: which astral services you have allowed and the tokens issued to them (stored as hashes).

Sign in with Google

If sign-in with Google is enabled in astral ID and you use it, Google gives us your email address, whether it is verified, your name and your Google account identifier. The identifier links the Google account to your astral ID account. We get no access to your Gmail, contacts, files or other Google data. To unlink the Google account, write to privacy@astralnet.io.

Secure connection

Not recorded: the content of your traffic, the addresses of pages you open, and the IP addresses and ports your devices connect to. Site names are recorded only in the cases described under DNS below.

Kept so that the connection works, limits can be counted and problems can be investigated:

What	Why	How long
Device profile: name, owner, connection keys, internal network address, settings (DNS filter, limits, schedule)	Running the connection	While the profile exists
Device traffic counters: bytes received and sent per minute; monthly totals	Load charts, monthly limits	Per minute — 7 days; monthly totals — while the profile exists
Connection history: session start and end, the IP address the device connected from, the provider's network name (from public registry data), protocol, volume per session	Troubleshooting, detecting use of a profile by someone else	The last 100 sessions of each device
Traffic that went directly and through the astral network, as a monthly total	Load accounting	While the profile exists
Speed test results, if you ran one: speed, latency, provider	Troubleshooting	The last 50 tests of each device
Administration log: administrator actions and control panel sign-ins, with IP address	Security	Rotated by size: the current and the previous file, usually several months

DNS

Devices use the astral DNS server. If filtering (ads, malicious sites) is on for a device, the DNS server keeps a temporary query log. Every 30 seconds the log is processed and emptied, and only this is kept:

the number of queries blocked by the filter, per device and day — 31 days;
the most frequent site names with query counts — only if DNS statistics are turned on for the device (off by default, turned on at the request of the device owner) — 7 days.

To investigate a problem, an administrator can turn on a 10-minute diagnostic mode for a device: during it the site names the device looks up and the path its traffic takes are visible. These entries are held in server memory only, never written to disk and not kept across a restart.

Service logs

The connection software writes only warnings and errors to the system log; these can include technical details of failed connections. The system log is limited in size and overwritten.

A daily backup contains device profiles and server settings (no connection history or counters); it is encrypted and stored off the server.

Mail

Messages and folders are stored on our mail server until you delete them or the mailbox is closed. The server keeps a delivery log (sender, recipient, time, mail server addresses, SPF, DKIM and DMARC results), which is needed for delivery and spam control and is kept for a limited time. Incoming mail is checked by an automatic spam filter; we do not read your mail or use it for advertising.

Cookies and browser storage

astral ID uses only necessary cookies: the session cookie (keeps you signed in) and technical cookies that protect forms and sign-in. There are no advertising or analytics cookies.
The astralnet.io site sets a lang cookie (the chosen language, for a year) only when you switch the language. The chosen theme is kept in your browser's localStorage and is never sent to the server.

We do not sell data or share it for advertising. Access to it may be had by:

the hosting providers our servers are rented from, as far as their operation requires;
Cloudflare, as the DNS provider of astralnet.io (only DNS lookups of our names, none of your traffic);
Google, if you sign in with Google;
recipients' mail servers, when you send a message;
public authorities, only where applicable law requires it and only to the extent of the request.

Retention

Data	Period
astral ID account	While the account exists; on a deletion request it is deleted together with its sign-in methods and sessions
astral ID sessions	Deleted 30 days after they expire or are ended
astral ID security event log	Cannot be altered after the fact; currently cleared manually, we aim to keep no more than 12 months
astral ID backups	The last 14 daily copies
Edge proxy request log	Up to 30 days
Secure connection data	See the table under "Secure connection"
Access requests and waitlist	See "Request and waitlist forms"

How we protect data

All connections to the services use HTTPS/TLS only; secure connection traffic is encrypted.
Passwords are stored only as hashes; second-factor secrets and signing keys are encrypted.
Administrators sign in through astral ID with a second factor; server access is key-based only.
Important actions are written to a log that cannot be altered after the fact.

Your rights

You can find out what data about you is kept, get a copy, correct inaccuracies, delete your account and data, withdraw consent and object to processing. Some of this is available in your astral ID account settings; for the rest write to privacy@astralnet.io. We reply within 30 days. Some records (for example the security event log) may be kept longer where needed to protect the service or required by law.

Changes

If this policy changes we will update this page and the date at the top. We will warn account holders by email in advance of significant changes.

Contact

Data questions: privacy@astralnet.io. General questions: hello@astralnet.io.