Astra Privacy Policy

We collect information directly from you, automatically when you use the Services, and from third-party services that you choose to connect.

Information you provide

Account information, such as your name, email address, authentication identifiers, Firebase user identifier, profile information, and settings.

Communications with us, including support requests, feedback, survey responses, product questions, and other messages you send to Astra.

Preferences and user-controlled data, including memory profile entries, notification preferences, category controls, feedback signals, dismissed or snoozed items, and other settings you create or adjust.

Information from connected accounts

If you connect Google or another third-party account, we collect and process the information needed to provide the features you authorize. This may include Google sign-in profile data, OAuth tokens, refresh tokens, Gmail message and thread metadata, sender and recipient information, subject lines, snippets, message bodies, labels, attachment metadata, timestamps, and related identifiers.

For Calendar features, we may process calendar names, event titles, descriptions, locations, conference links, attendees, RSVP status, reminders, start and end times, availability information, and sync metadata.

For task and assistant features, we may process tasks, reminders, suggested actions, proposal records, run history, source references, conversation summaries, and other app-owned records generated from your use of Astra.

Information collected automatically

We may collect device, usage, and diagnostic information such as IP address, device type, operating system, app version, browser type, feature usage, request identifiers, crash information, logs, and approximate network information.

If you grant location permission, Astra may process your location while the app is open to support commute timing, weather, travel windows, and similar context-aware planning features.

If you enable notifications, we process notification tokens, delivery status, and notification preferences so we can send timely reminders and updates.

Astra is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Astra is currently a free public beta and does not collect payment card or billing information through the Services. If we introduce paid plans, we will update this Privacy Policy and use payment providers that process billing information under their own terms and privacy notices.

We do not intentionally collect protected health information, financial account numbers, government identifiers, biometric identifiers, or other highly regulated data unless that information appears inside content you choose to connect, import, or send through the Services.

We use personal information for the following purposes:

• To provide, operate, maintain, and secure the Services.
• To authenticate users, manage accounts, maintain sessions, and support connected-account access.
• To sync, read, classify, summarize, search, rank, and display email, calendar, task, memory, and assistant context.
• To generate Today plans, calendar preparation, task suggestions, relationship reminders, discovery opportunities, travel or deadline prep, and other user-facing assistant features.
• To provide AI-powered features, including summarization, classification, recommendation, chat, source-aware explanations, and suggested next steps.
• To personalize the Services based on your settings, explicit feedback, memory controls, and source context.
• To communicate with you about beta access, account status, support, security, updates, and product announcements.
• To troubleshoot, debug, analyze reliability, prevent abuse, enforce our terms, and comply with legal obligations.

Astra uses artificial intelligence provided by Astra and service providers such as OpenAI to deliver features you request. AI features may process User Content, including email, calendar, task, memory, chat, and source-reference data, when that context is necessary to provide a user-facing feature.

We do not use your User Content to train generalized AI models. We also do not allow AI Service Providers to use your User Content to train generalized AI models except if you separately and explicitly opt in to that provider's training program outside Astra.

Some AI features may create outputs that are incomplete, inaccurate, or unexpected. AI output is designed to assist you, not replace your judgment. You should review AI-generated output before relying on it or using it outside the Services.

Normal Ask Astra chat may use provider-side continuation features to maintain conversation context. Incognito chat turns are designed to use current context for the answer without advancing Astra's normal conversation summary or requesting provider-side continuation storage for that turn.

Astra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request Google permissions only for user-facing features that are visible in Astra, such as sign-in, Gmail reading, Gmail draft assistance, calendar preparation and event changes you approve, Today planning, source-aware recommendations, and Ask Astra answers.

Astra stores Google access and refresh tokens in encrypted form where token persistence is required to keep authorized features working. You can revoke Astra's Google access through Astra controls where available, through Google's account-permissions settings, or by contacting us.

Gmail and Calendar features are designed around projections, drafts, and proposed changes that require your explicit approval before they affect your Google account. In-app dismissals, snoozes, rankings, summaries, and recommendations do not archive, label, unsubscribe from, send, delete, or edit Gmail messages or Calendar events unless a separate approved action expressly says so.

We do not transfer, sell, or use Google user data for advertising, retargeting, personalized ads, data broker services, credit-worthiness, lending, or surveillance. We do not allow humans to read Google user data unless you ask us to review specific content for support, it is necessary for security or abuse investigation, it is required by law, or the data has been aggregated for internal operations in accordance with applicable law.

Astra uses automated processing to classify, rank, summarize, and suggest actions from email, calendar, task, memory, and assistant context. These systems are intended to help you understand and manage information.

Astra is not designed to make legal, financial, employment, housing, insurance, healthcare, credit, or similarly significant decisions about you. Do not rely on Astra for decisions that require professional advice or independent verification.

We disclose personal information only in limited circumstances:

• Service providers and subprocessors: vendors that help us host, secure, operate, analyze, support, and improve the Services, including cloud hosting, database, authentication, logging, analytics, email delivery, security, and AI providers.
• Third-party integrations you authorize: providers such as Google when you connect, revoke, or use an integration, or when the Services need to exchange information to provide the connected feature.
• Legal and safety reasons: if we believe disclosure is required by law, legal process, or a valid government request, or is necessary to protect the rights, safety, property, or security of Astra, users, or others.
• Business transfers: in connection with a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, subject to appropriate confidentiality and user notice where required.
• With your consent or direction: when you instruct us to disclose information or otherwise agree to the disclosure.

No sale or targeted advertising

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We do not use email, calendar, task, memory, or chat content for targeted advertising.

The website uses local storage to remember your light or dark theme preference and may use similar technologies for security and performance. We do not currently use third-party advertising cookies on the landing page.

The public website uses Vercel Web Analytics to understand aggregate page views, routes, referrers, device categories, and approximate regions. Vercel Web Analytics does not use third-party advertising cookies or create cross-site advertising profiles.

We do not send email addresses, connected-account content, or other Astra account data to Vercel Web Analytics. If we add materially different analytics or preference-management tools in the future, we will update this Privacy Policy and provide controls where required by law.

We retain personal information for as long as reasonably necessary to provide the Services, maintain your account, operate connected features, comply with legal obligations, resolve disputes, prevent abuse, and enforce agreements.

Connected-account data may be retained while your account or integration remains active and for a limited period afterward for backup, security, audit, and legal purposes. Some records may remain in backups or logs until they expire through ordinary retention cycles.

Astra memories, feedback signals, task records, analysis records, projections, and conversation summaries may be retained while needed to personalize the Services, explain recommendations, maintain reliability, or honor your controls. Where controls are available, disabling or deleting a memory affects future personalization even if limited audit or backup copies remain temporarily.

If you delete your account or request deletion, we will make reasonable efforts to delete or de-identify associated personal information from active systems, subject to legal, security, fraud-prevention, and backup retention requirements.

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information. You may also have the right to withdraw consent where processing is based on consent.

You can revoke connected-account access through Astra settings where available and through the relevant provider's account-permissions page. You can also adjust memory, notification, and category preferences in the app where those controls are available.

To request access, correction, deletion, account deletion, or help with connected-account revocation, contact us at mail@heyastra.xyz from the email address associated with your account. We may need to verify your identity before completing a request.

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), may give you specific rights regarding personal information, subject to exceptions under law.

• Right to know and access the categories and specific pieces of personal information we have collected about you.
• Right to delete personal information we collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing. Astra does not sell personal information or share it for cross-context behavioral advertising.
• Right to limit the use and disclosure of sensitive personal information. Astra uses sensitive personal information only for purposes permitted by law, including providing the Services, security, and compliance.
• Right to non-discrimination for exercising your privacy rights.

How to exercise California rights

Email mail@heyastra.xyz with the subject line "CCPA Request." You may use an authorized agent where permitted by law. We may require proof of authorization and may still ask you to verify your identity directly.

Because Astra does not sell personal information or share it for cross-context behavioral advertising, Global Privacy Control signals do not change a sale or sharing status for the Services at this time.

We use commercially reasonable technical and organizational safeguards designed to protect personal information, including encryption in transit, access controls, environment-separated secrets, logging controls, and provider security measures.

No system is completely secure. You are responsible for protecting your account credentials and for promptly telling us if you believe your account or connected service has been compromised.

Astra is operated from the United States. If you use the Services from outside the United States, your information may be transferred to, stored in, or processed in the United States and other jurisdictions where we or our service providers operate.

Those jurisdictions may not provide the same level of data protection as your home jurisdiction. Where required, we rely on appropriate safeguards for international transfers.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to Astra, contact us at mail@heyastra.xyz so we can take appropriate action.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the Services, by email, or by another reasonable method. The updated policy will be effective as of the date posted unless a later date is stated.

If you have questions, concerns, or requests about this Privacy Policy or Astra's privacy practices, contact us at mail@heyastra.xyz.