Privacy Policy

01Overview

This Privacy Policy explains what information Astrea ("Astrea," "we," "us") collects when you use our website, desktop application, and gateway (together, the "Service"), how we use it, and the choices you have.

Privacy by design is core to how Astrea works: the desktop workflow reads your project locally. When you make an AI request, the context included in that request is sent through Astrea's gateway to the provider serving the model you selected.

02Information we collect

• Account information. Email address, a salted hash of your password (never the password itself), and your account creation date.
• Authentication and device records. API keys, the list of IDE devices linked to your account, and session metadata used to keep you signed in.
• Usage and billing records. Model requests, token counts, charges, top-ups, and balance history, kept so we can meter usage and bill you accurately.
• Support and security communications. Anything you send us through the contact form, by email, or through a support ticket.
• Website interaction data. Your session, theme preference, and language preference, stored locally in your browser (see "Cookies and Local Storage" below).

03Information we do not collect

Astrea does not receive a separate repository upload or index your project as a background import. The gateway does receive the prompt and context included in each model request so it can route the request and account for usage.

We do not use request content to train our own models. Provider-side processing and retention are governed by the current policy for the provider and model you select; do not treat this policy as a blanket provider no-training guarantee.

04How model requests are handled

When you send a request through the gateway, the content of that request (for example, your prompt and any code you have chosen to include in it) is forwarded to the third-party model provider that serves the model you selected, so the request can be completed.

• Providers process and may retain request content under their own privacy policies. We encourage you to review the terms of any provider you use.
• Where possible, we route through providers that commit not to use submitted content to train their models, but this varies by provider and model, and you should confirm the current terms for the specific model you choose.
• Our gateway does not intentionally copy incoming prompt/code content into request metrics or accounting rows. Settled provider response JSON is stored for idempotent replay, and usage, billing, security, logs, backups, and provider-side retention may follow separate deployment policies. We do not publish a single no-retention duration until those paths are verified.

05Payments

Payments are processed by Stripe, a third-party payment processor. We receive confirmation of the payment amount and outcome, but we never store your full card number on our servers. Stripe's handling of your payment details is governed by Stripe's own privacy policy (https://stripe.com/privacy).

06Cookies and local storage

The website stores a small amount of data in your browser, specifically:

• your login session,
• your preferred theme, and
• your preferred language.

07How we use information

We use the information described above to:

• operate, maintain, authenticate, and secure the Service;
• meter usage and process billing;
• provide customer and technical support;
• communicate with you about your account, updates, or changes to our policies; and
• investigate and prevent abuse, fraud, or violations of our Terms of Service (https://getastrea.com/terms).

08Sharing of information

We share information only as needed to run the Service:

• Third-party AI model services receive request content to fulfill the request you initiate.
• Stripe receives payment information needed to process transactions.
• Service providers who host our infrastructure or help us operate the Service, bound by confidentiality and data-protection obligations.
• Legal and safety disclosures, where required by law, legal process, or to protect the rights, property, or safety of Astrea, our users, or others.

09Data retention

We retain account and billing records for as long as your account is active, and for a reasonable period afterward to comply with legal, tax, and accounting obligations.

Incoming model request content is not selected by the request metrics or token ledger, but the gateway stores usage/billing records and may retain a provider response for idempotent replay. The exact retention period for logs, backups, replay rows, and provider records depends on the deployment and provider terms; contact privacy@getastrea.com for the current schedule.

You may export your account data or request deletion from the signed-in dashboard. Deletion revokes active sessions, IDE devices, API keys, and Discord links and anonymizes the account identity; payment and usage records that must be retained for legal, tax, fraud-prevention, or accounting reasons remain subject to those obligations.

10Your rights

Depending on where you live, you may have the right to access, correct, export, restrict, or delete the personal information we hold about you.

To exercise any of these rights, contact privacy@getastrea.com. We will respond to verifiable requests within the timeframe required by applicable law.

• EU, EEA, and UK residents have rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.
• California residents have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected and to request its deletion.

11International data transfers

Astrea and the providers we work with may process information in countries other than your own. Where we transfer personal information internationally, we rely on appropriate safeguards, such as standard contractual clauses, as required by applicable law.

12Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us at privacy@getastrea.com and we will delete it.

13Security

• Provider API keys and account secrets are stored only on our servers, never in the browser or the desktop application.
• All traffic between the IDE, the website, and our servers is encrypted in transit.
• Access to production systems is limited to authorized personnel and is logged and audited.

14Changes to this policy

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but we work to protect your information using industry-standard practices.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will post the updated policy here with a new "Last updated" date, and we will notify you of material changes through the Service (for example, by email or an in-app notice).

15Contact us

For questions about this Privacy Policy or our privacy practices, contact us at:

privacy@getastrea.com

or via our contact page (https://getastrea.com/contact).