Platform Privacy Policy

Last updated: July 10, 2026

This Policy explains, in clear terms, what personal data the Astarojna Platform processes, for what purpose, on what basis, and what your rights are. It covers the astarojna.com website, your account, payments, communications, and the social integrations module (TikTok, Meta, and YouTube). Specific products may have their own privacy notices that complement it — such as the Astarojna Telemetry app. We seek compliance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, for users outside Brazil, with the European General Data Protection Regulation (GDPR).

1. Who the controller is

The controller of the personal data processed here is Gilberto Ehlke, an individual, who operates the Platform under the Astarojna Studios brand (company in formation), Araucária–PR, Brazil. For any privacy matter, contact us at contato@astarojna.com.

2. Who this policy applies to

It applies to the website (hosted on Vercel), your Astarojna account, and the Platform modules you enable, including the social integrations. We serve users in several countries; this is the English version and we provide a Portuguese version too.

3. Data protection officer

The point of contact for data protection matters (the officer, under art. 41 of the LGPD) is Gilberto Ehlke, at contato@astarojna.com.

4. What data we collect

• Account: email, password (stored only as a hash, never in plain text), display name, and the two-step verification setting (2FA/TOTP). If you choose social login via Discord, we receive the identifier and email that Discord provides.
• Usage and security: session data, IP address, and browser/client identification in requests to our servers, to operate the service and prevent unauthorized use.
• Payments: the order/subscription status and the transaction identifiers returned by the processors. We do not store your card data — the card is processed directly by Mercado Pago or Lemon Squeezy.
• Support and email: the content of messages you exchange with us and the transactional and (if you opt in) marketing emails we send.
• Website analytics: aggregate usage metrics via Vercel Web Analytics, cookieless and without building an individual profile.
• Social integrations (optional): if you connect TikTok, Meta, or YouTube (Google) accounts, we process the data described in the next section.

5. Social integrations — TikTok, Meta, and YouTube

This section only applies if you, as the account administrator, choose to connecta TikTok, an Instagram/Facebook (Meta), or a YouTube (Google) account. The connection always happens through each network's official authorization (OAuth) flows, via the Astarojna Connect module. Below, what we process for each network and, at the end, the rules common to all of them.

TikTok

Connection via the Astarojna Connect app, through the TikTok Display API, within the scope you authorized (for example, listing your videos and their statistics). We collect the access tokens issued on authorization, the metrics of your own videos— views, likes, comments, and saves — and basic profile information the API returns (such as username and account identifier). You can revoke access at any time in TikTok's settings (Settings and privacy → Security and permissions → Manage app permissions), in addition to disconnecting in the Platform.

Instagram / Facebook (Meta)

Connection through the Meta Graph API, for the accounts you administer. We collect the access tokens issued on authorization, the metrics and insights of your own content — reach, views, likes, comments, and saves — and basic profile information the API returns. You can revoke access at any time in Meta's settings (Settings → Business integrations or Apps and websites), in addition to disconnecting in the Platform.

YouTube (Google)

Optional connection by the account administrator, through Google OAuth, using the YouTube Data API to import the metrics and insights of your own videos and Shorts — such as views, likes, and comments — and basic channel information. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements where applicable. You can revoke access at any time at myaccount.google.com/permissions, in addition to disconnecting in the Platform.

Rules common to all networks

• What for: solely to show you the performance analysis of your own content inside the Platform.
• Legal basis: your consent when you connect the account and our legitimate interest in providing the analysis you requested — always weighing the impact on you.
• Where we store it: in Supabase, with encryption in transit and at rest; tokens are encrypted and never appear in the front-end, in logs, or in URLs.
• What we do NOT do: we do not sell or share this data; we do not use it for advertising; we do not collect third-party data beyond what the API itself returns about your content.
• Retention and revocation: we keep it while the social account stays connected. When you disconnect(in the Platform or in the network's settings), we revoke access and discard the tokens; the linked metrics are deleted as described on the data deletion page.

6. What we do NOT collect

The War Thunder telemetry that the desktop app reads through the game's official interface on your own machine stays on your computer and is not sent to Astarojna. The app does notcapture the screen, read the game's memory, inject code, or intercept its network traffic. The social integrations read only your own content data, within the scope you authorized.

7. Purposes and legal bases

We process each piece of data for a specific purpose, with the corresponding legal basis:

8. Who we share with

We do not sell your data. We share the minimum necessary with operators that provide services to us, under contract and following our instructions:

• Supabase — authentication, database, and encrypted storage of social tokens.
• Vercel — website hosting and cookieless analytics.
• Mercado Pago and Lemon Squeezy — payments.
• Resend and Cloudflare — email delivery and infrastructure.
• Discord — optional social login.

For the social integrations, TikTok, Meta, and YouTube (Google) are the sources of the data you authorize us to import — we do not send your analysis data to third parties. We may also disclose data when required by law or by order of a competent authority.

9. International transfer

Some of the operators above process data outside Brazil (typically in the United States). These transfers occur for the performance of the contract at your request and/or are supported by contractual clauses and adequate safeguards under the LGPD — including the standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 — and, where applicable, GDPR mechanisms (such as the Standard Contractual Clauses).

10. How long we keep data

• Account and usage data: while your account is active.
• Social integration data: while the social account stays connected; deleted on disconnect or on request.
• Backups: up to 60 days after account closure.
• Session and security logs: about 90 days.
• Payment data: for the period required by applicable tax law.

When you close your account, we delete or anonymize your data, except for what we must keep due to a legal obligation.

11. Security

We adopt technical and organizational measures to protect your data: hashed passwords, two-step verification (TOTP), encryption in transit (HTTPS/TLS), integration tokens encrypted at rest, row-level access control in the database (RLS), and the principle of least privilege. No system is 100% impenetrable, but we work to reduce risks.

12. Cookies

The website uses only essential session cookies (to keep you authenticated). The analytics we use is cookieless. We do not use marketing or third-party tracking cookies. If this changes, we will ask for your consent where required.

13. Your rights

You may, at any time: confirm whether we process your data and access it; correct incomplete or outdated data; request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; request portability; withdraw consent (including by disconnecting social integrations); obtain information about whom we share with; and object to processing based on legitimate interest. To exercise any of these, write to contato@astarojna.com. If you are outside Brazil, the equivalent GDPR rights (access, rectification, erasure, objection, portability, and restriction) also apply.

14. Data deletion

You can request the deletion of your data, including social integration data, at any time. Step-by-step instructions and the response time are on the data deletion page.

15. Children and adolescents

The Platform is not intended for those under 18. We do not intentionally collect data from children and adolescents; if a guardian identifies that this has occurred, they may contact us for deletion.

16. Complaint to the authority

If you believe your rights have not been met, you may file a complaint with the National Data Protection Authority (ANPD) in Brazil and, if you are in the European Economic Area, with the data protection authority of your country.

17. Changes to this policy

We may update this Policy. When there is a relevant change, we will notify you through our channels (website, app, or email) and update the date at the top of this page.

18. Contact us

Questions about privacy or your data: contato@astarojna.com.