Legal

Privacy policy

Draft for owner and legal review. This page sets out the policies Astrix proposes to adopt. It has not been reviewed by a lawyer and is not yet the final binding text. Several processes needed to carry out these policies are still being built; until they are, current practice differs in the ways listed under “Current status”.

Who is responsible: [LEGAL OPERATOR NAME: to be verified and inserted by the owner], [BUSINESS MAILING ADDRESS: to be verified and inserted by the owner]. Contact: astrixsupport@gmail.com.

This policy covers the Astrix website, Acastus Intelligence and Astrix Tweaks. Acastus AI (the chat workspace, its web version at astrixz.com/ai and the Sidekick browser extension) has its own details, including what Sidekick sends, in the Sidekick privacy policy; a fuller Acastus AI section is still to be written. MEGA's detailed list of every connection it makes is in legal & privacy and still applies to MEGA.

Short version

  • No ads, no selling or renting your data, and no third-party analytics or advertising trackers on the marketing pages.
  • Acastus keeps your research and reports with your account so you can revisit them. You can export your data, and delete your account in the Android app or by email.
  • Card details go to Stripe, never to us.

This website

  • Cloudflare serves astrixz.com and processes your IP address and request details to deliver pages and protect the site.
  • The site counts clicks on download buttons as a single running number with nothing about who clicked.
  • The Acastus pricing page loads Google Sign-In only when you open it, and reads public plan information from the Acastus service. Acastus stores nothing about you until you sign in.

Google sign-in and your Acastus account

  • You sign in with Google. Google gives Acastus an identity token containing your Google account identifier, your email address (which must be verified by Google) and your name. We request only the openid, email and profile scopes. We never see your Google password.
  • We create an Acastus account from that, and sign you in again with the same account on the website, the Windows app and the Android app. An email address already linked to a different Google account is refused.
  • Sessions use random tokens. The server stores only a hash of each token, tokens expire, and signing out revokes the session. The website keeps your token in your browser's session storage only; it is cleared when the tab closes. The Windows app keeps it in Windows Credential Manager.

Research data and report history

  • When you start research, we store your question and settings, the plan the system made, the web pages it read (including the text it extracted from them), the claims and citations it produced, and the resulting report, all attached to your account on the Acastus server operated by Astrix.
  • Only your account can open your research. Requests for another account's research are answered as "not found".
  • Research leaves the Acastus server only to fetch public web pages, to query search providers (for example Wikipedia and, where enabled, Brave or Tavily), and to reach the AI model endpoints Acastus is configured to use. Search queries derived from your question are therefore sent to those search providers.
  • Acastus models are intended to run on infrastructure operated by Astrix. If a third-party model provider is ever enabled, the app and your reports say so.
  • We do not use your private research to publish public research pages. Public showcase reports are published only when deliberately approved, and never include private prompts or user identifiers.
  • We do not include research content in marketing analytics.

Billing through Stripe

  • Subscriptions are paid through Stripe Checkout. Stripe collects and processes your card details; we do not receive them.
  • We keep your plan, its status and renewal period, and the identifiers Stripe gives us so we can match payments and portal sessions to your account. Your plan changes only after Stripe's confirmed payment events reach our server, never because a browser was redirected to a "success" page.
  • Change plan, update payment details or cancel in the Stripe billing portal (Manage subscription).

Usage records

We record how much of your rolling (5-hour on Free, 3-hour on paid plans) and weekly allowance each research run uses, so limits can be enforced. We use it for limits and for diagnosing faults, not for advertising.

Retention, export and deletion

  • Account and research data (your account, research, sources, reports and usage records): we keep it until you ask us to delete it or you delete your account. Our policy is then to delete or anonymize it within 30 days, unless the law requires us to keep something longer.
  • Security logs: our policy is to keep server security logs for 30 days. Our content-delivery provider, Cloudflare, keeps its own request logs under its own policies. The audit log described below is kept separately.
  • Billing records (payments, invoices and subscriptions) are held mainly by Stripe, our payment processor. Our policy is that these records are kept for up to 7 years where the law requires it, and not longer than needed.
  • In the Android app you can delete your account with a typed confirmation; on Windows or the web, email us and we will delete it for you. Deletion immediately removes your account, research, reports, sources, uploads, usage records and sign-in identity from the live Acastus database and server storage. Copies in server backups are not yet removed automatically (see Current status). Deleting your account does not by itself cancel a Stripe subscription: cancel first with Manage subscription, or email us.
  • After deletion, some records remain: our tamper-evident audit log keeps an internal account number, research identifiers and research titles, usage events and payment event identifiers, but not your email address or name. These audit records are currently kept without a time limit while we design a way to shorten that period; payment records are kept as described above.
  • You can export your account details, your research questions and reports, and your usage records from the app. For a fuller copy of your data, email astrixsupport@gmail.com.

Current status (draft)

Account deletion removes your data from the live Acastus database immediately, but server backup copies do not yet expire automatically; automatic 30-day removal of security logs is not yet in place; the administrator audit log is currently kept without a time limit; and we do not yet ask you to confirm your age at sign-up. We will update this page as each of these is put in place.

Age

Acastus is for people who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it, delete its data and cancel any subscription.

Astrix Tweaks and MEGA

  • MEGA has no analytics or crash reporting and does not report what you do. It goes online only for the connections listed in its privacy policy: licence activation, update checks, optional Google sign-in and cloud backup, and speed tests.
  • When you buy, Stripe gives us your email address. We store it with your licence key and use it to email the key to you.
  • Licence records also hold the Windows machine ID of each PC the key is activated on, the apps that used the key and when they were last used, and a count of uses. The Key Manager keeps an audit trail of administrator changes that includes a salted hash of the administrator's IP address, and the licence service keeps salted hashes of IP addresses for abuse limits.
  • If a modified (tampered) copy of an Astrix app detects that its own integrity check failed, it can send a small report with the app name, version and a hash of the machine ID. It never blocks the app and contains no personal details.

Security

We limit access to each account's data, hash session tokens, restrict which websites may call the Acastus API from a browser, and rate-limit sign-in and billing requests. No system is perfectly secure; report suspected problems to astrixsupport@gmail.com.

Contact

Privacy questions and requests: astrixsupport@gmail.com or the support page.