Privacy Policy

Astra is a developer portfolio tool. To generate your portfolio, we need to read structural signals from your GitHub repositories. This policy explains exactly what we access, what we store, how we use it, and what we never touch. We keep this language plain because you should be able to read and understand it without a lawyer.

When you sign in with GitHub, we receive your GitHub username and the email address associated with your GitHub account via OAuth. We store a read-only access token scoped to public repository metadata. We do not request write permissions. We do not access private repositories.

• GitHub identity — username and public email, used to authenticate you and set your portfolio URL.
• Repository structural data — for repositories you select: name, description, topics, language breakdown, exported symbol structure (AST-level), dependency manifests (package names and versions), commit count and frequency, star and fork counts, and licence type. Raw source code is never stored.
• Generated portfolio content — AI-generated project narratives and summaries stored and served from your public portfolio page at useastra.tech/u/your-username.
• Webhook events — if auto-sync is enabled, GitHub sends push event metadata (repository name, ref, timestamp) to Astra when you push new code. Commit messages, diffs, and file contents are not included.
• Usage logs — standard server logs (request timestamps, IP address, browser user-agent) retained for 30 days to maintain service quality and diagnose errors. These are not linked to individual user profiles.

This is explicit because it matters. Astra's AST analysis reads the shape of your code — exported identifiers, import patterns, file structure — not the logic inside functions or the content of your commits. We never access or store:

• Raw source code content (function bodies, business logic, algorithms)
• Commit messages or commit diffs
• Pull requests, issues, or code review comments
• Any data from private repositories
• Environment variables, secrets, or configuration files
• GitHub Actions workflows or CI/CD outputs

• To authenticate you and maintain your session.
• To generate and publish your developer portfolio at your public URL.
• To automatically update your portfolio when you push new code (auto-sync).
• To improve AI narrative quality using aggregate, anonymised structural patterns — never linked to individual accounts.
• To send transactional notifications (portfolio ready, sync updates) if you have enabled email notifications in your account settings.

Astra uses Google Gemini to generate portfolio narratives. Curated repository summaries (structural signals and metadata, never raw source code) are sent as prompt inputs to Gemini's API. Under our data processing agreement with Google, your data is not used to train Gemini models. Processing occurs within Google's infrastructure under their enterprise data handling terms.

We do not sell your data. We do not share your data with third parties for advertising or marketing purposes. Data is shared only in the following limited circumstances:

• AI inference providers — as described above, repository summaries are sent to Google Gemini for narrative generation.
• Infrastructure providers — our hosting, database, and CDN providers process data as part of operating the service. All providers are under data processing agreements.
• Legal requirements — if required by law or a valid legal process, we may disclose data. We will notify you where legally permitted to do so.

Account data, generated portfolio content, and repository structural data are retained while your account is active. Usage logs are retained for 30 days then automatically deleted. If you delete your account, all associated data is purged within 14 days. You can request deletion at any time without deleting your account by emailing support@useastra.tech.

You have the right to access a copy of the data we hold about you, correct inaccuracies, request deletion, and withdraw consent for optional data uses (such as email notifications). To exercise any of these rights, email support@useastra.tech. We will respond within 14 days.

GitHub OAuth tokens are stored encrypted at rest. All data in transit is encrypted via TLS. Repository structural data is processed ephemerally during analysis and only the derived summaries (not raw data) are stored. We conduct periodic security reviews and will notify affected users promptly in the event of a data breach.

We may update this policy as the product evolves. The date at the top of this page reflects when it was last revised. We will notify you of material changes via the email associated with your GitHub account at least 14 days before they take effect.