Privacy Policy

Data controller
박민준 (Minjun Park)
Address
Gyeongju, Gyeongsangbuk-do, Republic of Korea
Contact
support@astrylstudio.com
Effective date
26 September 2026
Version
1.2

This policy covers the AstrylStudio desktop application and the AstrylStudio website. It explains what we store, why, for how long, and how you get it deleted.

  • Your images never leave your computer. We do not upload them, and image processing does not require an account.
  • Run reports are your choice. If you turn them on, the application sends us a report after each processing run (the log, the settings used, some FITS header entries of each frame, timings and system details) so that faults can be found and fixed. A release build asks before sending anything; a beta build sends them by default and says so. A release installed where a beta build ran before keeps the beta's setting. No image pixels are ever sent, and you can turn reports off in Settings > Account > Run reports.
  • An account is needed only to use paid features. Everything the free tier does works without one.
  • If you write to us through a form on the website, we keep what you typed so we can answer it. That is the only thing the website stores about you.

Only if you create an account:

Account

  • email address — sign-in, receipts, service notices
  • display name (optional) — shown in the application
  • avatar image URL (optional) — shown in the application
  • account creation date

Licence

  • plan, status, and source of your licence
  • licence period end, where applicable
  • number of device slots
  • payment-provider customer reference

Activated devices — one record per device you activate

  • a one-way hash of a machine identifier. The raw identifier NEVER leaves your computer; only the hash is sent (core/machine_id.py).
  • a device name, so you can tell your own devices apart
  • when the device was activated and last seen

Purchases

  • payment events received from the payment provider, for reconciliation

We do not store card numbers. Payment details are handled entirely by the payment provider and are never sent to us.

Whether or not you have an account — if you submit a form on the website (beta access, support, a bug report):

Website requests

  • the email address you enter, so that a reply can reach you
  • the message you write
  • which page the form was on, and the page you arrived from
  • when it was sent, and whether it has been answered yet

Nothing else is taken from the page: the form sets no cookie, runs no

analytics, and does not record your IP address. One hidden field exists to

catch automated submissions; a person never sees or fills it.

These entries are readable only by us. The website itself cannot read them

back — it holds a key that may add a request and nothing more.

Only if run reports are on (see section 2):

Run reports

  • your account email, if you are signed in
  • the application version and build, and which components it used
  • the run's log, the parameters used, and stage timings
  • for each frame: its file name, the measurements the run made, and these FITS header entries — object, filter, exposure, gain, sensor temperature, binning, camera and telescope names, focal length, pixel size, observation time, image type, colour pattern and image size. Other header entries, such as an observing site or an observer name, are not sent.
  • system details: operating system, memory, processor
  • warnings and errors, and the log lines before a crash

Not sent: image pixels, folder paths above the file name, your sign-in

session, or your licence file.

The desktop application makes network requests only for:

(a) signing in and checking your licence, to

sqkonfpgdoxyisyvzbdt.supabase.co;

(b) fetching the current plan catalogue, release notes and plugin list,

from https://astrylstudio.com;

(c) looking up stars and object names when you ask it to — downloading a

Gaia star catalogue from the ESA Gaia archive, or resolving a target name through the CDS services in Strasbourg. These send the sky position or name you asked about, nothing about you;

(d) run reports, only when they are on (sections 2 and 3), to the same

address as (a).

It sends no image data in any of these.

  • Your consent — given when you create an account. You may withdraw it at any time by deleting the account (section 8). Run reports in a release build also rest on consent: they start only after you choose to send them, and stop when you switch them off.
  • Beta testing — in a beta build, run reports are on by default, because finding faults on other people's equipment is what the beta is for. The build tells you before the first report goes, and you can switch them off. A release build installed on the same computer keeps that setting rather than asking again; it stays switchable in the same place.
  • Performing our contract with you — account, licence, and device records exist to deliver the paid features you bought.
  • Legal obligation — transaction records kept for tax and accounting.
  • Legitimate interests — preventing licence sharing and abuse.
  • Supabase — account, licence, website-request and run-report storage. The database for this service runs in Supabase's ap-southeast-2 region (Sydney, Australia).
  • Cloudflare — domain, DNS and website hosting; it serves the pages you read and routes mail sent to our support address.
  • Resend — delivers mail we send from the support address, and the notices we receive when a website request arrives or a run report needs attention. Its sending domain for this service is registered in the ap-northeast-1 region (Tokyo, Japan).
  • Google (Gmail) — the mailbox where mail to the support address and those notices are read.
  • No payment provider. The software is not sold yet, so nothing about you reaches one. When a store opens, the provider will be named here before it processes anything.
  • Account, licence and device records — until you delete your account.
  • Website requests — until the matter is closed and no longer useful as a record of what was agreed, and in any case deleted on request.
  • Run reports — deleted 30 days after they arrive. A notice about a report that needed attention is deleted from our mailbox when the matter is closed.
  • Transaction records — none exist; the software is not sold yet. Once it is, they will be kept for the period Korean law requires and this line will state it.
  • Deleted accounts — removed within 30 days of the request.

You may ask us to show you what we hold, correct it, export it, or delete it. Write to the Contact address above; we reply within 10 days.

Deleting your account removes your profile, licence records and device activations, and the run reports sent under your email address. It does not remove transaction records we must keep by law, and it does not remove data held independently by the payment provider.

If you are in the EU/EEA or the UK you may complain to your national data protection authority. If you are in Korea you may complain to the Personal Information Protection Commission.

Account, licence, website-request and run-report data is stored in Australia (Supabase ap-southeast-2). Mail we send is handled in Japan (Resend ap-northeast-1), and our mailbox is hosted by Google. We are based in South Korea. None of these are in the EEA or the UK.

Where this involves personal data of people in the EEA or the UK, the transfer rests on the Standard Contractual Clauses contained in each processor's data processing terms.

AstrylStudio is not directed at children, and we do not knowingly collect data from anyone under 14. Where local law sets a higher age for consent to data processing — 16 in parts of the EEA and the UK — that age applies instead.

We will post any change to this policy at https://astrylstudio.com/privacy and update the effective date. Material changes will be notified by email to account holders.

Copyright (c) 2026 박민준 (Minjun Park). All rights reserved.