What we collect.

Astor signs you in with Google. Google sends us a stable identifier for your account, your email address, and your first and last name if your Google profile has them. We store the identifier to recognise you when you return, your email so we can reach you about your account and help you if you write to us, and your first and last name so the press can greet you by name. We also record which provider you signed in with and when. Google’s reply includes a little more than that — a profile-photo address, a locale — which we neither read nor keep. We never receive your Google password, and we ask for no other access to your Google account — no Drive, no Gmail, no contacts, no calendar. A Google account whose email address is not verified cannot sign in.

The macOS application signed in with Sign in with Apple instead, and those sessions continue to work. Apple sends us a stable, opaque identifier that does not include your real Apple ID; if you chose to share an email, Apple may have given us a relay address ending in privaterelay.appleid.com. That application is no longer being developed.

Your account is identified internally by a random identifier, not by your email; the email is stored alongside it rather than used as the key. The signed session is kept in a secure, HTTP-only cookie for up to thirty days. Signing out clears that cookie and asks our server to revoke every session token already issued to you, so other browsers are signed out too. While a sign-in is in progress we also set a second, short-lived HTTP-only cookie — ten minutes — holding the one-time security values for that sign-in; it is discarded as soon as you return.

Before sign-in existed, the web press assigned each browser a random pseudonymous identifier and kept a signed recovery credential in Astor’s local storage. That credential is no longer issued. Where one still exists, it is offered once, when you sign in, so your new account can inherit the essays that browser already made. We remove it from local storage the next time you open your shelf; clearing Astor’s site data removes it immediately. It represents only the random identifier and contains no name, email, or essay text.

Clearing Astor’s full site data removes both the browser-local library and that recovery credential; clearing cookies alone does not remove local storage. When a new account is created, the server uses a keyed digest of the network address for a short-lived abuse-limit bucket; the raw address is not placed in that Redis key.

If you submit the Fellowship form, we store the name, email, work, and optional first commission you deliberately enter, together with a keyed pseudonymous digest of the submitting network for abuse control. The raw network address and browser user-agent are neither stored with the application nor written to our application logs.

We do not read your contacts, calendar, photos, location, or other documents. The public production site does not request microphone access.

When you ask Astor to write an essay, the topic, your level, voice, lecture-edition choice, and the chapter text it generates pass through our HTTPS proxy at marginalia-api-three.vercel.app. The proxy sends only the material required for each step to these model providers:

• Anthropic — for safety review, prose, chapter structure, lecture plans, and bounded feedback on written lecture checks.
• OpenAI — for generated illustrations and, when the primary narration service is unavailable or explicitly bypassed, lecture narration and word timing.
• Inworld — for the primary lecture narration and word timing.
• Google — for visually grounded lecture choreography and the optional realtime lecture used only in private testing builds.

Browser-local highlights, margin notes, and scratchpad text are not sent to a model provider. When you prepare a lecture, the finished essay and up to eight rendered figure plates are sent to Anthropic to compose its objectives, explanations, examples, checks, and visually grounded annotations. The plan and figure images needed for visual cues may be sent to Google for choreography. Each narration section is sent to Inworld; if that request falls back, OpenAI produces the narration and word timing.

Newly prepared web lectures include server-signed bindings for their authored checks. When you submit a written answer for feedback, Astor sends that answer to Anthropic together only with the bound objective, check, rubric, retry hint, and immediately preceding lesson context. The full essay is not included in that feedback request, and the request cannot become an open-ended conversation. Older and hand-authored lecture printings keep the written answer on the page and offer their authored hint and follow-up without claiming adaptive evaluation.

Experimental voice office hours are disabled on the public production site. In a private testing build that enables them, microphone audio, a transcript, the full open essay, and the current lecture place are sent to Google through a single-use realtime session. Choosing Just listen keeps the microphone off; a typed question or tap on a lecture mark in that testing build still sends the full essay and current context, but no microphone audio unless you explicitly enable it.

We do not send your name, email, or account identifier to these model providers. OpenAI requests carry a stable, pseudonymous safety code derived from your account so abuse can be investigated without revealing who you are.

Product analytics. Astor measures how its own pages are used with PostHog, processing data in the United States on our behalf. The measurement runs on the React pages of astor.press and reports through our own subdomain, e.astor.press. What it sends is the page address you are on, the address you arrived from, your browser, language, screen size and time zone, a random identifier stored in this browser, how quickly the page loaded, and which links and buttons you press — recorded as the label of the control, clamped to the length of a label. PostHog derives an approximate country, region and city from the network address; we do not receive a precise location. Signing in associates that random identifier with your account so we can tell a returning reader from a new one; a visitor who never signs in is counted without a profile.

Four things it deliberately does not do. There is no session recording or replay — nothing captures a picture of your screen, your reading, your margin notes, or your questions to the tutor. It does not read the text of an essay, and clicks are attributed only to the control you pressed, never to the prose around it. It reads nothing from Astor’s local storage: not your browser-local library, not the recovery credential. And it never receives your name, email, or the words you typed. The analytics code is compiled into Astor’s own JavaScript and pinned to a reviewed version, so no outside script runs on this origin — the strict content-security policy on every page enforces that. Analytics does not run on the plain pages of this site, including the one you are reading.

PostHog sets one cookie and a small group of local-storage entries under the astor.press origin, all prefixed ph_, to keep that random identifier stable for up to a year. Clearing Astor’s site data removes them. If you prefer not to be measured, a tracker-blocking extension, or your browser’s “do not track” setting where Astor can see it, is respected — and nothing about Astor stops working without it.

Your library lives in the browser you made it in, in that browser’s local storage. (Volumes made in the discontinued macOS application live on that Mac.) Before a public-link request is sent, the browser also journals that one exact request in IndexedDB so a timeout or reload can retry the same bytes under the same operation identifier. Because a timed-out request may still commit, the journal remains through unsuccessful or ambiguous replies and is removed only after the link result is safely written back to your shelf, or when you clear Astor’s site data. The web recovery credential described above is no longer issued or renewed; where one still exists we remove it the next time you open your shelf after signing in, and clearing Astor’s site data removes it immediately. Apart from material you deliberately share or submit through the Fellowship form, we hold the small server-side pseudonymous record needed to sign you back in, plus quota and aggregate cost counters used to prevent abuse. Fellowship applications remain in our application inbox until reviewed or deleted; repeat submissions from the same email are not inserted as new rows.

To make lecture preparation and retries idempotent, short-lived backend caches retain the validated lecture plan — including narration and check text — and per-beat timing and audio-URL metadata for seven to eight days. The source essay is represented in those caches by a cryptographic digest used to bind the request and result; the essay request itself is not kept there as a durable copy.

A written lecture-check answer is processed transiently by Anthropic. Astor does not place the raw answer in cache keys or application logs. A keyed one-way digest of the exact answer and its bounded verdict may remain in a short retry cache for up to one hour, so a timeout or exact retry does not pay for or process the same answer twice.

Generated plates and lecture narration are placed in Vercel Blob storage under long, unlisted public URLs so the reader can display and play them without exposing a provider key. Lecture audio is removed on a rolling schedule within ninety-two days; Astor refreshes an older local lecture before its audio is due for removal. A plate successfully placed in your browser library is receipt-claimed and retained so the illustration does not disappear from that local volume. Uploads that are never claimed by a local volume or public share are removed after about eight days. Deleting a volume from your local shelf removes its local essay and lecture plan immediately, but it does not currently delete that volume’s claimed plate blobs; short-lived retry caches expire on their own schedule.

Choosing Share is different: Astor stores a frozen, full essay snapshot in Neon Postgres, including the public Blob URLs for its plates. Receipt-verified plates claimed by that committed public share are retained; there is currently no automatic deletion of claimed plate blobs when a share is revoked. Anyone who has the link can read the snapshot. Shares do not expire automatically. You can use Revoke link in the local reader’s Share panel; the public endpoint then returns Gone. The database keeps the soft-revoked snapshot and revocation timestamp, and deleting the local volume by itself does not revoke a link.

Anthropic, OpenAI, Inworld, and Google process the content sent to them under their API terms and retention policies. We do not use your prompts, reading, or conversations to train our own model. See:

• Anthropic privacy policy
• OpenAI privacy policy
• Inworld privacy policy
• Google privacy policy

• No advertising SDKs and no cross-site advertising profiles. Astor measures its own pages with PostHog, as described above, and loads no other outside script: the analytics code is bundled into Astor’s own JavaScript at a reviewed version, and the content-security policy on every page refuses any script from anywhere else. Nothing on this origin reads the browser-local library or the recovery credential. Our hosting and API providers still process the ordinary request metadata needed to deliver and protect the service, as described above.
• No session recording, no replay, no screen capture, no heatmaps of what you read.
• No advertising identifiers (IDFA, IDFV). Astor does not request them and does not link them.
• No selling of personal information.
• No reading of your other documents. Astor never asks the system for files outside the volumes it wrote.
• No training on your reading. Astor does not use your prompts or reading activity to train a model.

You can ask us, by writing to yask@astor.press, to:

• Show you everything we hold about your account.
• Correct anything that looks wrong.
• Delete your account and the server-side record entirely. We will do this within fourteen days and confirm by email.

If you ask us to delete your record, clear Astor’s site data as well: your volumes live in your browser, and deleting the record on our side does not remove them.

If you are in the EU, UK, or California, the rights afforded by GDPR, the UK GDPR, and the CCPA apply to your data. We treat every reader as if those rights applied, regardless of where they read.

Astor is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has registered an account, write to us and we will delete the record.

If the policy materially changes — if we ever begin collecting something we don't collect today — we will say so on this page and, for changes that affect existing accounts, by email before they take effect. The effective date at the top of this page reflects the current version.