Privacy notice
Draft pending legal review · translations also require review.
Draft prepared: 2026-11-01
Information used
Features use your account identifier, display name and role; recommended URLs and submission details; uploaded images; likes, views and entry-click records; and contact or report messages. Hashed identifiers help deduplicate views and entries. Raw IP addresses are not stored in activity records.
Storage and retention
Operational data uses Cloudflare D1 and uploaded images use the connected R2 bucket. Ordinary rejected applications become eligible for cleanup after 30 days; holds, reports and activity relationships protect records. Additional duplicate URL restrictions last 30 days, spam restrictions 90 days, and cleanup logs 90 days. Specific contact/report retention rules still require operator review.
Requests and open review items
Use the contact form for access, correction, deletion or privacy questions. Requests affecting other participants, reports or disputes require review. The operator’s legal identity and address, processing arrangements, international transfers and jurisdiction-specific notices and retention duties still require verification. This draft does not certify legal compliance.
Support account details
Bank name, account holder and account number, consent and authorization-review state are stored separately to offer optional support details and copying. They are private by default. Anyone can see operator details with publication consent, or creator details after consent, authorization verification and separate approval. Private details are managed only by their submitter, an authorized creator or an administrator. Stopping publication or withdrawing publication consent immediately hides them; deleting the account details removes the bank data. Data linked to rejected submissions follows their 30-day retention and preservation rules. Copies already made outside ASTRA cannot be recalled. Bank data is excluded from general search/list responses, structured data, sitemaps and analytics. Authorization records retain only account identifiers, verifier, time and evidence type; contact us for review or deletion requests. Specific legal retention duties remain for operator/legal review.