Last updated: 16 June 2026
The short version
AstroSat is built to keep your data on your device wherever possible. The forecasting and coordinate maths run in your browser, not on our server. We don't use analytics, advertising, or third-party trackers, and we never sell your data. You can use the tools without an account at all. This page explains the few things we do store when you choose to use accounts or share links.
What we store
If you use AstroSat without signing in, we hold nothing that identifies you, with one exception: if you create a share link (below).
If you create an account, we store your email address and a secure hash of your password (using Argon2id). We never store your password itself, and we can't recover it, only reset it.
If you sign in and use sync, we store the items you save so they can follow you between devices: your equipment ("gear"), your observing sites (which include their coordinates), and any forecasts you save (which include the site coordinates, target, and times). We treat this as your data; to us it's an opaque record tied to your account.
If you create a share link with the "Copy share link" button, we store that forecast's inputs, including the observing site's coordinates, under a short random code so the link can reopen it. Share links are anonymous (not connected to any account), anyone who has the link can open it, and by default they don't expire. Don't create a share link for a location you'd rather not make public.
Cookies
AstroSat sets a single cookie: a session cookie when you log in, so the site knows you're signed in. It's marked HttpOnly, Secure, and SameSite, and on the server we store only a hash of its token. We use no analytics or advertising cookies, so there's no consent banner to click through.
Server logs
Like almost all websites, our web server keeps standard access logs (which include IP addresses) for security and troubleshooting. These are not linked to your account and are not used to track you.
Who else is involved
Two third parties are necessarily in the loop:
- Our hosting provider runs the server the site lives on.
- When you request a password reset, the email (your address and the reset link) is sent through our email provider.
How long we keep things
Accounts and their synced data are kept until you delete them. Sessions and password-reset tokens expire automatically. Share links are kept until they expire or are removed; by default they don't expire.
Your choices
You can use both tools without an account. You can delete a saved item at any time from within the app, and it's removed from your synced devices. To delete your whole account and everything synced with it, email us at hello@astrosat.org and we'll remove it. If you're in a jurisdiction with formal data rights (for example the EU or UK under GDPR, or Australia under the Privacy Act), those rights, such as access, correction, and deletion, apply, and the same address is the way to exercise them.
Security
Passwords are hashed with Argon2id; session and reset tokens are stored only as SHA-256 hashes, so a database leak can't be replayed to seize an account; and the site is served over HTTPS. No system is perfectly secure, but we keep what we store deliberately minimal.
Children
AstroSat isn't directed at children and we don't knowingly collect data from them.
Changes
If we change what we collect, we'll update this page and its date.
Contact
Questions about privacy? Email hello@astrosat.org.