Privacy Policy

In effect since August 22, 2026 · text version 2026-07-22.1

This Policy explains, in clear terms, what personal data Astarojna processes on the astarojna.com website and in the Astarojna Telemetrydesktop application, for what purpose, on what basis, and what your rights are. It reflects our current practices and seeks compliance with Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, for users in the European Economic Area, with the General Data Protection Regulation (GDPR).

1. Who the controller is

The controller of the personal data processed here is Gilberto Ehlke, an individual, who operates the Service under the Astarojna Studios brand (company in formation), Araucária–PR, Brazil. For any privacy matter, contact us at contato@astarojna.com.

2. Who this policy applies to

It applies to the website (hosted on Vercel) and to the Windows desktop application. We serve users in several countries; this is the English version and we may provide versions in other languages. Where there are versions in other languages, the Portuguese version prevails.

3. Data protection officer

The point of contact for data protection matters (the officer, under art. 41 of the LGPD) is Gilberto Ehlke, at contato@astarojna.com.

4. What data we collect

• Account: email, password (stored only as a hash, never in plain text), display name, and the two-step verification setting (2FA/TOTP). If you choose social login via Discord, we receive the identifier and email that Discord provides to us.
• License and app usage: device identifier/label, application name and version, and session data (a rotating token and periodic activity checks) to ensure a single active session per license. IP address and browser/client identification may be logged in requests to our servers. We also record which flight simulator the app is reading, so we know which ones are actually used.
• Payments: the order/subscription status and the transaction identifiers returned by the processors. We do not store your card data — the card is processed directly by Mercado Pago or Lemon Squeezy.
• Support and email: the content of the messages you exchange with us and the transactional emails we send.
• Where your visit came from: when you reach the site through a campaign or ad link, we record in a first-party cookie (never a third-party one) information such as utm_source/medium/campaign/content/term, paid-ad click ids (fbclid, gclid, ttclid), the referring page, and the landing page — see section 11 (Cookies) for details and section 12 (Advertising) for what this does NOT mean today.
• App diagnostics (black box), only when you send them: the application keeps, on your computer only, a continuous technical record of the last ~10 minutes (CPU, memory and GPU usage, and the app's own internal health). If the app closes abnormally — or whenever you choose — it can assemble a diagnostic package and offer to send it to our support. That package contains: the last minutes of metrics; a technical inventory of the machine (processor, memory, graphics card and driver version, monitors, disks, Windows version, and power/display settings); the error records Windows itself kept about the crash; the name, size and date of any Windows dump files (never their contents); the final portions of the app's and the simulator's log files; identifiers of your account and machine in hashed form; and whatever you write in the two optional fields. Before sending, the package goes through automatic redaction (your Windows username is removed from file paths and anything that looks like a password or key is masked), and the "see what will be sent" button opens the folder with the exact contents, in readable files, for you to review. Nothing is sent without a click from you, on every send. If the upload fails, the package stays saved on your computer and never leaves it.

5. What we do NOT collect

This point is central to our project. The War Thunder telemetry that the application reads through the game's official interface on your own machine stays on your computer and is not sent to Astarojna. The application does notcapture the War Thunder screen, does not read the game's memory, does not inject code into the game, and does not intercept its network traffic. The DCS World display capture (a feature you enable by choice) is likewise processed and shown only on your own devicesand is never sent to Astarojna. The black box's continuous technical record described in section 4 follows the same rule: it lives only on your computer, in a fixed-size space that overwrites itself, and only reaches us inside a diagnostic package that you decided to send — a package that never includes passwords, license keys, game screenshots, or the contents of memory dump files. Today the website also does not send any data to advertising platforms (Meta, Google, TikTok, or any other) and does not load any third-party tracking pixel, tag, or script — the only visit-origin cookie that exists (section 11) is ours, stays only in our own database, and is not shared with anyone.

6. Purposes and legal bases

We process each piece of data for a specific purpose, with the corresponding legal basis:

The legitimate interest above is specific: preventing piracy and unauthorized use and ensuring a single active session per license, always weighing the impact on you.

7. Who we share with

We do not sell your data. We share the minimum necessary with operators that provide services to us, under contract and following our instructions:

• Supabase — authentication and database.
• Vercel — website hosting.
• Mercado Pago — payments in Brazil.
• Lemon Squeezy — international payments.
• Gumroad and PayPal — alternative international payments (Base plan in US dollars).
• Resend — email delivery.
• Discord — optional social login.
• Cloudflare — email-system infrastructure.
• GitHub— hosting of the installers and the app's update manifest.

We may also share data when required by law or by order of a competent authority. To reiterate: we do not share card data, because we do not store it.

8. International transfer

Some of the operators above process data outside Brazil (typically in the United States). These transfers occur for the performance of the contract at your request and/or are supported by contractual clauses and adequate safeguards under the LGPD — including the standard contractual clauses of ANPD Resolution CD/ANPD No. 19/2024 — and, where applicable, GDPR mechanisms (such as the Standard Contractual Clauses).

9. How long we keep data

• Account and usage data: while your account is active.
• Backups: up to 60 days after account closure.
• Session and security logs: about 90 days.
• Payment data: for the period required by applicable tax law.
• Support: as long as needed for the service and the defense of rights.
• Diagnostic packages: while the related ticket is being handled and for up to 12 months after it is closed, in case the problem returns; after that, they are deleted. You can request early deletion at any time via the contact email, and we will comply unless a legal obligation says otherwise.

When you close your account, we delete or anonymize your data, except for what we must keep due to a legal obligation.

10. Security

We adopt technical and organizational measures to protect your data: hashed passwords, two-step verification (TOTP), encryption in transit (HTTPS/TLS), row-level access control in the database (RLS), and the principle of least privilege. No system is 100% impenetrable, but we work to reduce risks.

11. Cookies

These are the cookies the website uses today. None of them is third-party — all are set by astarojna.com itself:

If you are in the European Union, the European Economic Area, or the United Kingdom, arj_attr is only set after you authorize marketing; without that authorization (or while you have not decided), it is simply not created. In other regions it is set by default, but stops being set as soon as you decline. We do not use Google Analytics, Meta Pixel, Hotjar, or any other third-party tool that sets a cookie in your browser; the Vercel Web Analytics we use for aggregate site metrics is cookieless by design.

12. Advertising

Today we do not send any of your data — not even your email, not even hashed — to advertising platforms such as Meta (Facebook/Instagram), Google, or TikTok. The arj_attr cookie described above stays only in our own database and is used solely so that we, internally, know which channel each visitor came from.

If this ever changes— for example, if we start using Meta's Conversions API to tell an ad platform that a purchase happened — this will only be done for visitors who have given specific marketing consent, recorded as a separate decision (never bundled into a generic acceptance). You can withdraw that consent at any time, with one click— in the panel opened from the “Cookie preferences” link in the site footer, or in your account settings — without having to write to anyone; the email contato@astarojna.com remains available as an additional channel. We will update this section before any real data sharing begins, explaining whom the data is being shared with.

13. Your rights

You may, at any time: confirm whether we process your data and access it; correct incomplete or outdated data; request the anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance; request portability; withdraw consent — including the marketing consent behind the arj_attr cookie, separately from other processing —; obtain information about whom we share with; and object to processing based on legitimate interest. To exercise any of these, write to contato@astarojna.com.

14. Children and adolescents

The Service is not intended for those under 18. If a minor uses it, they must do so with the authorization and supervision of a legal guardian. We do not intentionally collect data from children and adolescents; if a guardian identifies that this has occurred, they may contact us for deletion.

15. Complaint to the authority

If you believe your rights have not been met, you may file a complaint with the National Data Protection Authority (ANPD) in Brazil and, if you are in the European Economic Area, with the data protection authority of your country.

16. Changes to this policy

We may update this Policy. When there is a relevant change, we will notify you through our channels (website, app, or email) and update the effective date and text version at the top of this page.

17. Contact us

Questions about privacy or your data: contato@astarojna.com.