Privacy Policy

Astryx ("Astryx", "we", "us") provides an astrophotography planning and observatory-orchestration platform at astryx.space and app.astryx.space. This Privacy Policy explains what personal data we collect, why, and the choices you have. It applies to the Astryx web app, API, and the optional local agent you run on your own machine.

Account information you provide when you sign up:

• Your email address and display name.
• A password, which we store only as a salted scrypt hash — never in plaintext.
• Email-verification and password-reset state.

Content you create in your workspaces:

• Equipment (rigs, optical trains), observing sites and horizons, imaging projects and goals.
• Image metadata and quality metrics indexed from your captures (filenames, filters, exposures, FWHM/HFR, plate-solve coordinates, small preview thumbnails). Your full image files stay on your own storage — Astryx does not upload or host your light frames.
• Workspace membership, roles, invitations, and an audit log of administrative actions.

Telemetry from the optional local agent, if you run it:

• Read-only status from your acquisition tools and devices (e.g. guiding RMS from PHD2, camera temperature, mount and focuser state, ASCOM/Alpaca and INDI device discovery, N.I.N.A. session status).
• The agent reports status only. Astryx does not send commands that move or operate your hardware.

Technical data needed to run the service: a session cookie, IP address and user-agent (for security, rate-limiting, and abuse prevention), and basic request logs.

AI features are bring-your-own-key. If you choose to use them, you provide your own Anthropic API key. We encrypt it at rest with AES-256-GCM and use it solely to make Anthropic API calls on your behalf when you invoke an AI feature. We never display it back to you, never share it, and you can remove it at any time from your account settings.

When you use an AI feature, the relevant request data is sent to Anthropic under your key and is subject to Anthropic's terms and privacy policy.

• To provide and operate the service — authentication, planning, scheduling, and showing your observatory telemetry.
• To send transactional email (email verification, password resets, and workspace invitations).
• To secure the service — rate-limiting, brute-force protection, and abuse prevention.
• To maintain an audit trail of administrative actions within a workspace.

We do not sell your personal data, and we do not use it for third-party advertising.

We send transactional emails through Cloudflare's email-sending service. These are limited to messages necessary to operate your account (verification, password reset, workspace invitations, and important account notices such as confirmation that your account was deleted). We do not send marketing email without your consent.

We use a single, strictly-necessary cookie to keep you signed in: an httpOnly, Secure session cookie. We do not use third-party advertising or cross-site tracking cookies. Because the session cookie is essential to the service, it is not used for analytics or profiling.

We share data with the service providers ("subprocessors") that help us run Astryx, only as needed to provide the service:

• Cloud hosting and managed PostgreSQL for storing your account and workspace data.
• Cloudflare for DNS, edge security, and transactional email delivery.
• Anthropic, only when you use an AI feature with your own API key, for the content of that request.

Within a workspace, your content and membership details are visible to other members of that workspace according to their role (owner, admin, operator, or viewer). We may also disclose information if required by law, to protect the rights and safety of users, or as part of a business transfer, in which case we will notify you.

We keep your account and workspace data for as long as your account is active. When you delete your account or a workspace, the associated data is permanently deleted from our primary systems. Encrypted database backups are retained on a rolling basis (currently up to 14 days) and then automatically removed; deleted data ages out of backups within that window. Some minimal records may be retained where required for legal, security, or accounting purposes.

You have control over your data directly in the app:

• Access and portability — export your account data and any workspace you administer as JSON from your account settings ("Danger zone" and per-workspace export).
• Correction — update your display name and account details at any time.
• Deletion — permanently delete your account, or delete a workspace you own, from your account settings.

Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA (including the right to access, correct, delete, or restrict processing of your personal data, and to lodge a complaint with a supervisory authority). To exercise any right that isn't already self-service, contact us at [email protected].

We protect your data with measures including encrypted transport (HTTPS), hashed passwords (scrypt), encryption of your stored Anthropic key (AES-256-GCM), httpOnly session cookies, rate-limiting and brute-force protection on authentication, role-based access control within workspaces, and regular database backups. No system is perfectly secure, but we work to protect your information and to respond promptly to any issue.

Astryx is not directed to children. You must be at least 16 years old (or the age of digital consent in your jurisdiction) to create an account. We do not knowingly collect personal data from children.

Astryx may process and store data in countries other than your own. Where required, we rely on appropriate safeguards for international transfers. By using Astryx, you understand that your data may be processed in the locations where we and our subprocessors operate.

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date above and, where appropriate, notify you. Your continued use of Astryx after an update means you accept the revised policy.

Questions about this policy or your data? Email [email protected].