Privacy Policy

Who Is Responsible

Astral is run by a single independent developer, pov, who decides how your information is used and is responsible for it. In this policy, "I", "me", and "my" refer to that developer.

What I Collect

Only what is needed to run your account, deliver scripts, and keep the service secure:

• Account details: your username, your email address if you add one, and your password, stored only as a one-way hash.
• Discord details when you sign in with or link Discord: your Discord user ID, username, display name, avatar, and whether you boost the Astral server.
• Keys and purchases: the keys you own, their status and expiry, and each purchase's amount, currency, date, payment method, payment reference, and any discount code used. Card and bank details go to the payment provider and never reach me.
• Loader and script data: when the loader runs, it sends the technical information needed to deliver the right script and check your key, such as a device identifier (stored hashed), the game you are in, the loader version, and account and session identifiers. Daily usage totals per game are kept.
• Security data: your IP address is used briefly to rate-limit requests and is stored only as a one-way hash. Signals that help detect key sharing, tampering, and abuse are also recorded.
• Support messages you send me in Discord tickets.

Why I Use It

• To create and run your account, issue and check keys, and deliver scripts. This is necessary to provide what you signed up for or bought.
• To send password-reset emails you ask for.
• To prevent fraud, key sharing, and abuse, protect the service, and enforce the Terms of Service. This is my legitimate interest in keeping Astral working and paid keys meaningful.
• To keep purchase records required by tax and accounting law.

What I Do Not Do

I do not sell or rent your information, share it for advertising, use advertising or cross-site tracking cookies, or run third-party analytics on this site.

Cookies & Local Storage

The site sets two strictly necessary cookies: one that keeps you signed in for up to 7 days, and a short-lived one that protects Discord sign-in. Your browser may also keep small preferences, such as a prompt you dismissed, in local storage on your device, and the key and discount code you picked before signing in, until checkout opens. None of these track you across other sites, so no consent banner is needed.

Who Processes It

These services handle data on my behalf or when you use them through Astral:

• Vercel: hosts the website and API, and keeps short-lived request logs.
• Supabase: hosts the database, in the United States.
• Resend: sends password-reset emails.
• Discord: sign-in, the Astral server, boost status, support tickets, and a private staff channel where each sale is logged with the buyer, key, amount, and payment method.
• Lanyard: the site footer shows my Discord status, so your browser loads it from api.lanyard.rest, which sees your IP address.
• YouTube: the showcase page loads video thumbnails from YouTube, and pressing play loads YouTube's player in privacy-enhanced mode. YouTube sees your IP address when either happens.
• Payment providers such as Stripe or PayPal, when you buy a key on the site. They act under their own privacy policies.

International Transfers

These providers may process data in the United States or other countries. Where the law requires it, transfers rely on safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.

How Long It Is Kept

• Account, Discord, key, and usage data: while your account exists, and deleted within 30 days of a deletion request.
• Purchase records: as long as tax and accounting law requires, usually up to 7 years.
• Records of revoked keys and blacklisted accounts: as long as needed to enforce the ban.
• Sign-in sessions, password-reset links, and rate-limit records: they expire on their own within days.

Security

Passwords are hashed, keys are encrypted at rest, sign-in tokens are stored hashed, and all traffic uses HTTPS. No system is perfectly secure, and the details of how abuse is detected are deliberately kept private.

Your Rights

Depending on where you live, including under the GDPR, UK GDPR, and California law, you can ask to access, correct, delete, or receive a copy of your information, and object to or restrict how it is used. You can also complain to your local data protection authority.

To make a request, open a ticket in the Astral Discord from the Discord account linked to your Astral account, so I can confirm it is you. I answer within 30 days. Deleting your account revokes your keys and cannot be undone.

I do not sell or share personal information as California law defines those terms.

Children

Astral is not meant for children under 13, and I do not knowingly collect their information. If you believe a child under 13 has an account, contact me and it will be deleted.

Changes to This Policy

When this policy changes, the new version is published here with an updated "Last Updated" date. Significant changes are also announced in the Discord server.

Contact

Privacy questions and requests go through a ticket in the Astral Discord or through yourpov.dev. See also the Terms of Service.