Privacy notice

Who is responsible

The person who runs this instance of AstraMentis (the “operator”) is responsible for your data. Their contact appears at the end of this page; if it is missing, write to whoever invited you. If you run your own copy of the app, you are the operator of that copy.

What is stored

Account: your username, display name, a password derived with scrypt (the password itself is never stored), the email address you gave for password recovery, the date you joined and who invited you.

Learning history: every card shown to you and when, your answers with whether they were right and how long they took, swipes, explanations opened, audio played, stories read, cards saved, and the rating of each skill. This is what makes the feed adapt to you.

Things you write: notes, wishes for later, collections and their items, and the name you choose for duels.

Settings: topic weights, switched-off rungs, interface language, and, if you turn on the daily reminder, the push subscription your browser issues (an endpoint URL and keys, no phone number).

Technical: a session cookie (random token, 30 days), a language cookie, and standard server logs kept by the hosting provider for a short time. There is no analytics, advertising or tracking script.

On your device only: reader preferences and reading position, the duel name and the installed-app shell are kept in your browser's local storage and never sent anywhere.

What it is used for

To pick the next card at your level, keep your streak and stats, remember what you saved, send you the reset link if you forget your password, and, if you asked for it, send one daily notification. Nothing else. Your data is not sold, shared with advertisers, or used to train models.

Other people in the same instance can see the display name and username you chose when you share a collection or a duel with them. They never see your email, history or notes.

Where it lives

The app runs on Vercel and stores data in a Supabase (PostgreSQL) project chosen by the operator, in the region they selected. Password-reset emails, if enabled, are sent through Resend. If you become a patron, the payment is handled by Stripe: the app never sees your card, and only keeps the subscription identifier, its status and the amount you chose. Each of these providers processes data under its own terms and acts on the operator's instructions.

Some of these providers are established in the United States (Vercel, Stripe, Resend). Transfers there rest on the EU–US Data Privacy Framework and on the European Commission's standard contractual clauses, which each provider offers in its data-processing terms. The database itself stays in the region the operator chose; an operator in the EU should pick an EU region.

When the app fetches public content (Lichess puzzles, Project Gutenberg texts, museum images) it does so from the server; your identity is not sent to those services.

How long

For as long as your account exists. Sessions expire after 30 days or when you sign out. Password-reset links expire after one hour. When you delete your account, everything listed above is removed at once; server logs at the hosting provider expire on their own schedule (days, not months).

Your rights

Export: from Profile → Your account → Export my data you get a JSON file with everything the app holds about you.

Delete: from the same place, Delete my account removes your account, history, notes, collections and subscriptions immediately. This cannot be undone.

Correct: you can change your name, email and password yourself in the app.

If you live in a place with a data-protection law (the EU, the UK, Chile, Mexico and many others), you also have the right to ask the operator for access, correction, deletion or portability, and to complain to your local authority. Write to the operator's contact and they will answer within a month.

When the operator is in Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se). You can also complain to the authority of the country where you live.

Age

AstraMentis is meant for people aged 16 or older. If you are younger, ask a parent or guardian before creating an account; the operator may remove accounts that do not meet this rule.

Changes

If this notice changes in a way that matters, the date at the top changes and the app shows the new text the next time you open your profile. The history of the text is in the public source repository.

Operator contact

Not set on this server yet (OPERATOR_CONTACT). Write to the person who invited you.