DRAFT for review. This text has not been checked by a lawyer. Before launch it must name the data controller (a person or a company) and a contact address, as the GDPR requires.
Last updated: 9 November 2026
Astrolab-io is a fan project for players of Star Citizen. It has three parts: a free desktop app, this website (astrolab-io.space) and a Discord bot. This policy explains what personal data each part handles, why, and for how long.
In short: we collect as little as we can, we never collect information about other players, we do not sell data, and we do not use analytics or advertising.
Who is responsible
The data controller is [name or company and postal address: to be added]. Questions and requests: [privacy contact email: to be set up].
What we collect and why
- Signing in with Discord. Discord gives us your Discord user ID, username, display name and avatar, and we use them to create and run your account. Discord also sends your email address: our sign-in provider always asks for it, and we cannot switch that off. It stays only in the sign-in system, is never copied into our own tables, and is not used to contact you.
- Your account. Its name and picture, the orgs (teams) you belong to, and your role in each.
- Friends. Who you have asked, accepted, declined or blocked. Your invite code, stored only as a one-way fingerprint. A count of your friend-request attempts over the last 24 hours, to stop abuse. Waypoints you send to a friend are held only until their app collects them, or for 7 days, and are then deleted.
- The desktop app. A random install ID that names one installation; it is never a hardware ID and says nothing about your PC. It is used for the passes that let the app work offline. Everything the app reads from your screen and the game’s log stays on your PC, unless you use a feature that shares it (sending waypoints to a friend now, and later sync and org features).
- The Discord bot. When you use one of its commands, Discord sends us your Discord user ID, the server and channel, and the command. We use them to answer, and we keep only what a feature you use needs to store.
- Technical data. Our hosting providers record IP addresses and request details in their server logs, for security and to keep the service running.
Legal bases
- Contract: to provide the account and the features you ask for.
- Legitimate interests: security, and preventing abuse (for example, the limit on friend requests).
- Your choice: anything you decide to share, such as waypoints sent to a friend.
Who processes data for us
- Supabase: the database and sign-in, with servers in Frankfurt, Germany.
- Vercel: website hosting. Our server code runs in Frankfurt; Vercel’s network carries requests worldwide.
- Discord: sign-in and the bot.
- Some of these are US companies. Transfers are covered by their data processing terms (EU standard contractual clauses, or the EU–US Data Privacy Framework where it applies). A payment provider will be added here before any paid plan starts.
How long we keep it
- Your account: until you delete it.
- Friend requests: until answered, or 30 days.
- Waypoints sent to a friend: until collected, or 7 days.
- Friend-request attempt counts: 24 hours.
- Invite codes: 7 days, or until you replace or revoke yours.
- Server logs: as long as the hosting provider keeps them.
Your rights
You can ask to see, correct, export or delete your data, and you can object to or restrict how it is used. You can delete your account yourself in your profile settings, which removes your account data, friendships, requests and waiting waypoints. For anything else, write to [privacy contact email: to be set up]. You can also complain to your data protection authority.
Age
You must be old enough to use Discord, and to consent to this processing in your country: 16 in some EU countries.
Changes
If this policy changes, the date above changes. Significant changes will also be announced on the website.