Platform Privacy Policy

Last updated: July 22, 2026 · text version 2026-07-22.1

This Policy explains, in clear terms, what personal data the Astarojna Platform processes, for what purpose, on what basis, and what your rights are. It covers the astarojna.com website, your account, payments, communications, and the social integrations module (TikTok, Meta, and YouTube). Specific products may have their own privacy notices that complement it — such as the Astarojna Telemetry app. We seek compliance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, for users outside Brazil, with the European General Data Protection Regulation (GDPR).

1. Who the controller is

The controller of the personal data processed here is Gilberto Ehlke, an individual, who operates the Platform under the Astarojna Studios brand (company in formation), Araucária–PR, Brazil. For any privacy matter, contact us at contato@astarojna.com.

2. Who this policy applies to

It applies to the website (hosted on Vercel), your Astarojna account, and the Platform modules you enable, including the social integrations. We serve users in several countries; this is the English version and we provide a Portuguese version too.

3. Data protection officer

The point of contact for data protection matters (the officer, under art. 41 of the LGPD) is Gilberto Ehlke, at contato@astarojna.com.

4. What data we collect

• Account: email, password (stored only as a hash, never in plain text), display name, and the two-step verification setting (2FA/TOTP). If you choose social login via Discord, we receive the identifier and email that Discord provides.
• Usage and security: session data, IP address, and browser/client identification in requests to our servers, to operate the service and prevent unauthorized use. From the installed app we also record an identifier for your machine (derived from your operating system and converted into a non-reversible code), the app version, and which flight simulator it is reading.
• Payments: the order/subscription status and the transaction identifiers returned by the processors. We do not store your card data — the card is processed directly by Mercado Pago or Lemon Squeezy.
• Support and email: the content of messages you exchange with us and the transactional and (if you opt in) marketing emails we send.
• Website analytics: aggregate usage metrics via Vercel Web Analytics, cookieless and without building an individual profile.
• Where your visit came from: when you reach the site through a campaign or ad link, we record in a first-party cookie (never a third-party one) information such as utm_source/medium/campaign/content/term, paid-ad click ids (fbclid, gclid, ttclid), the referring page, and the landing page — see section 12 (Cookies) for details and section 13 (Advertising) for what this does NOT mean today.
• Social integrations (optional): if you connect TikTok, Meta, or YouTube (Google) accounts, we process the data described in the next section.

5. Social integrations — TikTok, Meta, and YouTube

This section only applies if you, as the account administrator, choose to connecta TikTok, an Instagram/Facebook (Meta), or a YouTube (Google) account. The connection always happens through each network's official authorization (OAuth) flows, via the Astarojna Connect module. Below, what we process for each network and, at the end, the rules common to all of them.

TikTok

Connection via the Astarojna Connect app, through the TikTok Display API, within the scope you authorized (for example, listing your videos and their statistics). We collect the access tokens issued on authorization, the metrics of your own videos— views, likes, comments, and saves — and basic profile information the API returns (such as username and account identifier). You can revoke access at any time in TikTok's settings (Settings and privacy → Security and permissions → Manage app permissions), in addition to disconnecting in the Platform.

Instagram / Facebook (Meta)

Connection through the Meta Graph API, for the accounts you administer. We collect the access tokens issued on authorization, the metrics and insights of your own content — reach, views, likes, comments, and saves — and basic profile information the API returns. You can revoke access at any time in Meta's settings (Settings → Business integrations or Apps and websites), in addition to disconnecting in the Platform.

YouTube (Google)

Optional connection by the account administrator, through Google OAuth, using the YouTube Data API to import the metrics and insights of your own videos and Shorts — such as views, likes, and comments — and basic channel information. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable. You can revoke access at any time at myaccount.google.com/permissions, in addition to disconnecting in the Platform.

Rules common to all networks

• What for: solely to show you the performance analysis of your own content inside the Platform.
• Legal basis: your consent when you connect the account and our legitimate interest in providing the analysis you requested — always weighing the impact on you.
• Where we store it: in Supabase, with encryption in transit and at rest; tokens are encrypted and never appear in the front-end, in logs, or in URLs.
• What we do NOT do: we do not sell or share this data; we do not use it for advertising; we do not collect third-party data beyond what the API itself returns about your content.
• Retention and revocation: we keep it while the social account stays connected. When you disconnect(in the Platform or in the network's settings), we revoke access and discard the tokens; the linked metrics are deleted as described on the data deletion page.

6. What we do NOT collect

The War Thunder telemetry that the desktop app reads through the game's official interface on your own machine stays on your computer and is not sent to Astarojna. The app does notcapture the screen, read the game's memory, inject code, or intercept its network traffic. The social integrations read only your own content data, within the scope you authorized.

7. Purposes and legal bases

We process each piece of data for a specific purpose, with the corresponding legal basis:

8. Who we share with

We do not sell your data. We share the minimum necessary with operators that provide services to us, under contract and following our instructions:

• Supabase — authentication, database, and encrypted storage of social tokens.
• Vercel — website hosting and cookieless analytics.
• Mercado Pago, Lemon Squeezy, Gumroad, and PayPal — payments.
• Resend and Cloudflare — email delivery and infrastructure.
• Discord — optional social login.

For the social integrations, TikTok, Meta, and YouTube (Google) are the sources of the data you authorize us to import — we do not send your analysis data to third parties. We may also disclose data when required by law or by order of a competent authority.

9. International transfer

Some of the operators above process data outside Brazil (typically in the United States). These transfers occur for the performance of the contract at your request and/or are supported by contractual clauses and adequate safeguards under the LGPD — including the standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 — and, where applicable, GDPR mechanisms (such as the Standard Contractual Clauses).

10. How long we keep data

• Account and usage data: while your account is active.
• Social integration data: while the social account stays connected; deleted on disconnect or on request.
• Backups: up to 60 days after account closure.
• Session and security logs: about 90 days.
• Payment data: for the period required by applicable tax law.

When you close your account, we delete or anonymize your data, except for what we must keep due to a legal obligation.

11. Security

We adopt technical and organizational measures to protect your data: hashed passwords, two-step verification (TOTP), encryption in transit (HTTPS/TLS), integration tokens encrypted at rest, row-level access control in the database (RLS), and the principle of least privilege. No system is 100% impenetrable, but we work to reduce risks.

12. Cookies

These are the cookies the website uses today. None of them is third-party — all are set by astarojna.com itself:

If you are in the European Union, the European Economic Area, or the United Kingdom, arj_attr is only set after you authorize marketing; without that authorization (or while you have not decided), it is simply not created. In other regions it is set by default, but stops being set as soon as you decline. We do not use Google Analytics, Meta Pixel, Hotjar, or any other third-party tool that sets a cookie in your browser; the Vercel Web Analytics we use for aggregate site metrics is cookieless by design.

13. Advertising

Today we do not send any of your data — not even your email, not even hashed — to advertising platforms such as Meta (Facebook/Instagram), Google, or TikTok. The arj_attr cookie described above stays only in our own database and is used solely so that we, internally, know which channel each visitor came from.

If this ever changes— for example, if we start using Meta's Conversions API to tell an ad platform that a purchase happened — this will only be done for visitors who have given specific marketing consent, recorded as a separate decision (never bundled into a generic acceptance or into the social integrations of section 5). You can withdraw that consent at any time, with one click— in the panel opened from the “Cookie preferences” link in the site footer, or in your account settings — without having to write to anyone; the email contato@astarojna.com remains available as an additional channel. We will update this section before any real data sharing begins, explaining whom the data is being shared with.

14. Your rights

You may, at any time: confirm whether we process your data and access it; correct incomplete or outdated data; request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; request portability; withdraw consent (including by disconnecting social integrations or by separately withdrawing the marketing consent behind the arj_attr cookie); obtain information about whom we share with; and object to processing based on legitimate interest. To exercise any of these, write to contato@astarojna.com. If you are outside Brazil, the equivalent GDPR rights (access, rectification, erasure, objection, portability, and restriction) also apply.

15. Data deletion

You can request the deletion of your data, including social integration data, at any time. Step-by-step instructions and the response time are on the data deletion page.

16. Children and adolescents

The Platform is not intended for those under 18. We do not intentionally collect data from children and adolescents; if a guardian identifies that this has occurred, they may contact us for deletion.

17. Complaint to the authority

If you believe your rights have not been met, you may file a complaint with the National Data Protection Authority (ANPD) in Brazil and, if you are in the European Economic Area, with the data protection authority of your country.

18. Changes to this policy

We may update this Policy. When there is a relevant change, we will notify you through our channels (website, app, or email) and update the date and text version at the top of this page.

19. Contact us

Questions about privacy or your data: contato@astarojna.com.