How we protect your data.

• HTTPS everywhere. All traffic to and from Astroniq is encrypted in transit using TLS 1.2+. HSTS is enforced; HTTP requests redirect to HTTPS.
• Encryption at rest. User databases are encrypted at rest by our infrastructure provider.
• HttpOnly, SameSite=Strict session cookies. Your session cookie is inaccessible to JavaScript and isn't sent with cross-origin requests - neutralising the two most common session-theft attack classes.
• Content Security Policy. Every page ships a CSP that restricts script sources to Astroniq's own origin, Razorpay/Stripe checkout, and FCM web-push - nothing else.
• No third-party trackers. We don't ship Google Analytics, Facebook Pixel, or any ad-network beacon. Internal product telemetry uses self-hosted PostHog with PII scrubbed.
• Secrets in vaults. API keys (LLM providers, payment gateways, push) are stored in our infrastructure secret store and rotated on a quarterly schedule. Never committed to source.

• No password storage by default. Sign-in uses Google OAuth or an email magic-link - neither of which requires Astroniq to store a password. If you set a password later, it's stored as a bcrypt hash.
• Session revocation. Signing out invalidates the session server-side, not just client-side. Logging out of one device doesn't affect others - each session is independent.
• Sensitive routes are server-only. Birth-data writes, billing actions, and account deletion go through the dashboard-api with explicit auth checks - not via client-side route guards alone.

Some user-facing features call third-party services. We've picked providers whose contractual terms align with our privacy stance - but you should know who's in the chain:

• LLM providers (Google Gemini, Groq) for chat replies. Enterprise terms prohibit training on API requests. No PII is sent - only the chart context Astroniq computed and your message text.
• Payment gateways (Razorpay for India, Stripe internationally). Both are PCI-DSS Level 1 certified. Astroniq never sees your card details - they go straight to the gateway's hosted form.
• Push delivery (FCM / Apple Push). Used only when you opt in to notifications. Payload contents are not logged on our side.
• Authentication (Google OAuth, email magic-link). Used only at sign-in time; tokens are exchanged once and not retained beyond their TTL.

If you've found a vulnerability, we'd love to hear from you. Please:

• Email astroniq.app@gmail.com with a clear proof-of-concept.
• Give us a reasonable window (typically 30 days) to fix before publicly disclosing.
• Don't access, modify, or delete data that isn't yours. Don't run automated scanners that generate user load.

We don't currently run a paid bug-bounty program, but we credit reporters in the security advisory we publish for each fix, and we send a small thank-you for first-time valid reports. We commit to acknowledging your report within 48 hours.

We publish a public status page once the user base warrants it. For now, any incidents that affect signed-in users are communicated via email + an in-app banner on the affected tab. Historic incident reports will live at status.astroniq.app once the page exists.