Privacy Policy

1. Scope and contact

ASTRAEA processes information to provide and operate its website, accounts, AI chats and inquiry service. Requests for legally required operator information or concerning personal information can be submitted through our contact form, published email or telephone number. We respond in accordance with applicable law.

2. Information we process

Account information: login and display names, registration email, password verification data, email verification and authentication records, profiles, avatars, preferences and invitation information.

Service information: your inputs and AI responses, chat histories, selected characters, personas and conversation settings, saved variables and summaries, coin balances, grants and consumption, generation usage, token counts and error records.

Contact information: optional name, reply email, subject, message, language, privacy notice acknowledgment, receipt number, timestamps and handling status. A submitted email is a reply address, not a verified account identity. We do not accept attachments.

Technical and security information: IP addresses, browser information, access times and authentication, operation and error logs. Anti-abuse limits use keyed hashes derived from IP addresses and email addresses. Server and delivery infrastructure logs may record IP addresses.

3. Purposes

We use information for account creation and authentication, generating, storing and summarizing chats, applying settings, managing coins, replying to inquiries, preventing abuse, investigating faults, maintaining and improving the service, and meeting legal obligations. Include only information needed to handle your inquiry. Do not include passwords, payment card numbers or identity documents.

4. External services

Conversation content, character settings and other information needed for AI responses, summaries and related processing are sent to the configured model providers and API or proxy services used to reach them. A fallback connection may send a request to another provider. Their retention and use depend on the applicable provider terms or contracts; we do not make a blanket promise that every provider performs no storage or training.

We use hosting, delivery and security providers including AWS and Cloudflare, and Resend for account verification and recovery emails. Manual inquiry replies use the email services supporting our published contact address. Information necessary for these functions is processed by these providers.

We use PayPal for paid top-ups. We send information needed for payment, including the amount, currency, product description and order reference, and receive transaction IDs and payment or refund status to credit coins, reconcile transactions and provide support. Card numbers and PayPal login credentials are entered on PayPal pages and are not stored on ASTRAEA servers. PayPal handles information under its own privacy policy.

Providers may process information outside your country. We may also disclose information to the extent necessary to comply with law, protect rights or address fraud and abuse.

5. Cookies and browser storage

We use cookies for sessions and protection against forged requests, localStorage and sessionStorage for language, display settings and related preferences, and browser storage for recovery of pending or unsaved chats. You can clear or restrict this storage in your browser, but sessions, preferences or recovery of unsaved content may stop working. Sign out on shared devices and clear stored data when appropriate.

6. Retention and security

We retain accounts and chats to support continued use. Inquiries, operational records and backups are retained as needed for handling requests, recovery, fraud prevention and legal obligations. There is no single fixed automatic deletion period for all data. Information no longer needed is subject to deletion or anonymization; deletion from active records may not immediately remove backup copies.

We use access controls, authentication, encrypted transport and request security measures. Operators may inspect records as needed for support or fault investigation. We do not guarantee absolute security or encryption that prevents all access by the operator.

7. Your requests

Contact us to request access, correction, deletion or restriction of processing under applicable law. We may need to identify the records and verify your identity to prevent disclosure to another person. An email entered in the contact form alone does not prove ownership of an account. If legal retention obligations, fraud investigations or other lawful reasons prevent full compliance with a request, we will explain.

8. Minors and updates

Children under 13 may not use the service. Minors need consent from a parent or guardian under applicable law. Please tell us if you believe information from an ineligible child has been registered. We will announce material policy changes with the revision date and obtain consent where required.

9. Google sign-in

If you choose Google sign-in for Astraea (ASTRAEA), we receive your Google account identifier, verified email address, name, and email-verification and domain information. We use these for account creation, authentication and linking an existing account. We do not receive your Google password or request access to your email messages, contacts or Drive files.

We link an existing account with the same email and preserve its invitation relationship. An inviter is recorded only when a new account is created from an invitation link. For email addresses not managed by Google, we send a verification code through Resend before the first account creation or link.

We store the Google identifier and account link, email address and display name in our account records. Temporary authentication context remains in server memory for at most ten minutes, with a browser cookie binding the flow. Google tokens used for authentication are not stored in account records. Necessary processing by our hosting, delivery and email providers is covered by the external-services section above.

You can revoke access through the connections settings in your Google account. Revocation does not automatically delete your Astraea account or saved data. Contact [email protected] to request deletion of your Google link or account information. We verify ownership and handle the request under the retention and user-request provisions above.

10. LINE sign-in

If you choose LINE sign-in, we receive your LINE account identifier, display name and email address when available. We use these to create, authenticate and link your account. We do not receive your LINE password, conversations or friends list.

For the first sign-in, we use the email supplied by LINE to link an existing account or create a new one. If LINE does not supply an email, you enter one and we send a verification code through Resend. We use the existing account with the same email and preserve its invitation relationship. An inviter is recorded only when a new account is created.

We store the LINE identifier and account link, but do not store authentication tokens in account records. Temporary authentication context remains in server memory for at most ten minutes, with a browser cookie binding the flow. Once linked, LINE signs into that same account even if the LINE email changes.

Revoking access in LINE does not automatically delete your Astraea account or saved data. Contact [email protected] to request deletion of your link or account information. We verify ownership and handle requests under this policy.