Privacy Policy
Last updated 2026-07-08
This Policy explains what information Astarter AI processes, why, who it is shared with, and the choices you have. It applies to the Astarter AI website and app.
1. Information we process
Prompts and content you submit. To generate a response, the content you send is transmitted to third-party AI model providers that produce the output. Before it is processed, we apply automated redaction to reduce obvious secrets, such as key-like strings, in your input.
Web searches and links. When answering needs current information, the assistant may send a search query to a third-party search service, or fetch a web page or link you ask it to read. The query or web address, and whatever is needed to load that page, is shared with the relevant search provider, a third-party page-reading service, or the website itself to return the result.
Account information (only if you sign in). With Google: your email address and a Google account identifier. With email sign-in: your email address and a password stored only as a salted, one-way hash, never in plain text. We also store a basic profile and the data you choose to sync.
Data you sync. If you sign in, the chats, settings, and preferences you choose to sync are stored so they are available on your devices. You can clear them.
On-device data. On the free tier, your chat history and settings are stored locally in your browser and are not sent to us unless you sign in to sync.
Operational and security data. We use a signed cookie identifier and your network (IP) address to enforce fair-use limits and protect the Service from abuse, and we keep minimal security logs. We do not record your prompts, passwords, or full account identifiers in those logs.
2. How we use information
We use information to provide and secure the Service, generate responses to your prompts, sync your data when you sign in, enforce fair-use limits, prevent abuse and fraud, and comply with the law.
3. Third-party processors
We share the minimum necessary with providers that help us run the Service: third-party AI model providers, to generate responses (we do not list them individually here, and can identify them on request under a confidentiality agreement); Cloudflare, for hosting, storage, and content delivery; Google, to serve fonts, and for sign-in if you choose it; Resend, only if you use email sign-in, to send verification and reset messages; and, when the assistant searches the web or opens a link you request, the DuckDuckGo search service, a third-party page-reading service, and the destination website itself. They process data on our behalf or under their own terms.
4. What we do not do
We do not sell your personal information. We do not share it with third parties for their own advertising. We do not use the content of your chats to build advertising profiles. We do not use your inputs to train AI models. We send your inputs to our third-party AI model providers to generate your response; they process them under their own terms.
5. Data retention
On-device data stays until you clear it. If you create a share link for a conversation, that snapshot is viewable by anyone with the link for 30 days, then is deleted automatically. Account and synced data are kept while your account is active and are permanently deleted when you delete your account, subject to short backup and legal-retention windows. Signed-in sessions expire after 7 days, and free-tier limits reset daily. Operational and security records are kept only as long as needed, then removed or aggregated.
6. Security
We protect data with measures including encryption in transit, encrypted server secrets, salted one-way password hashing with a high iteration count, single-use sign-in challenges, and session controls including sign-out-everywhere. No method is perfectly secure, but we work to protect your information and keep our defenses current.
7. Cookies
We use a small number of strictly necessary, first-party cookies: a signed session cookie when you sign in, a signed guest identifier to apply fair-use limits, and a short-lived state cookie during Google sign-in. We do not use advertising, analytics, or cross-site tracking cookies.
8. Your choices and rights
You can clear local history in your browser at any time, sign out (including sign-out-everywhere), and, if you have an account, permanently delete it and all its synced data yourself from Settings, under Data controls, with Delete account. Depending on where you live, you may have rights to access, correct, export, or delete your personal data. You can also contact us at contact@astarter.io to exercise them.
9. Links and content you share
When you ask the assistant to open a link or search the web, the web address or query is shared with the destination site or search provider to fulfill your request, as described above. If you create a share link for a conversation, the snapshot you share becomes viewable by anyone who has the link for 30 days, then is deleted automatically, so do not create a share link for a conversation that contains personal or confidential information. Do not paste other people's personal or confidential information you are not allowed to share.
10. Children
The Service is not directed to, and may not be used by, anyone under 18, or the age of majority where they live. We do not knowingly collect data from children.
11. International users
Astarter AI runs on globally distributed cloud infrastructure, so your information may be processed and stored on servers outside the country where you live. Where the law requires it, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.
12. Changes and contact
We may update this Policy; we will change the "last updated" date and, for material changes, give reasonable notice. Astarter AI operates this Service; privacy questions and data requests can be sent to contact@astarter.io.