Legal

Privacy policy

Last updated 23 October 2026

Astrid reads your business’s own material and writes marketing from it. This page says what we collect, what we do with it, where it lives and what you can ask us to do. We write it in plain words and we keep it short.

Who is responsible

Astrid is run by Primo Techworks, of India, which develops and owns it and is responsible for your information. In this policy, “we” and “us” mean Primo Techworks. HJachi Solutions Inc., of British Columbia, Canada, takes payments for paid plans on our behalf, and handles your information only for that, on our instructions and under this policy.

What we collect

• Your account: your email address and a password (stored only as a salted hash). If you add them, a passkey (only its public part; the private key never leaves your device) and a two-factor secret with backup codes. To keep your account safe we also record when and from which browser you sign in.
• If you sign in with another account: with Google, Apple, Microsoft, Facebook, LinkedIn, GitHub or X, that service shares your name, email address, profile picture and an identifier for your account there, once you agree on its own screen. We use them only to sign you in and to address you; nothing is posted and nothing else is read. You can disconnect it on your account page.
• What you give Astrid: your website address, the descriptions, files, brand material and photos you add, and the details you confirm about your business.
• What Astrid reads and makes: the public pages of the website you point it at, and the posts, newsletters, visuals, reels, voiceovers and other pieces it writes for you, with your edits and approvals.
• If you add a social profile: with a handle or link, what the platform shows publicly (name, bio, picture, posts). If you connect the account through the platform’s own consent screen, read-only access to your profile, your posts, their captions and how they performed. Never your password, messages, other people’s comments or ads.
• If you connect an account to post: on Instagram, Facebook, TikTok, LinkedIn or YouTube, permission to publish on that account, granted on the platform’s own consent screen. Astrid uses it only to post what you approved, when someone in your business presses Post or schedules it, and keeps a record of each post it made. For LinkedIn this includes your name and profile identifier. You can remove access in Astrid or at the platform at any time.
• If you connect a code host: read-only access to commit messages, tags, releases and the changelog of the repositories you choose. Astrid never reads or stores your code, and never writes to a repository.
• Billing details, if you pay for a plan: handled by our payment provider, Stripe. We keep only the plan, its state and Stripe’s reference numbers. We do not store card numbers.
• Basic usage records: sign-ins, exports and deletions, so you can see what happened on your account.

What we do not collect

Astrid never asks for your social media passwords, and never posts anything you haven’t approved and asked it to post. This website does not use advertising or tracking cookies, and we do not sell or share your content or your details for advertising.

YouTube and other Google services

If you connect a YouTube channel, Astrid uses YouTube API Services to read your channel (its name, description, picture, videos and their public numbers) and, if you allow posting, to upload the Shorts you approve. By connecting YouTube you agree to the YouTube Terms of Service, and Google’s use of your information is covered by the Google Privacy Policy.

We use what we read only to write your posts and show how they did. We never sell it, never use it for advertising and never share it with anyone else. Astrid’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Access tokens are kept encrypted. While your channel is connected, what Astrid read is refreshed at least every 30 days.

You can end Astrid’s access at any time: remove the account in Astrid, or at Google’s third-party access page. To have what Astrid read from YouTube deleted, write to us and we delete it within 30 days.

Emails we send

We only send email that your account needs, from noreply@goastrid.com:

• Confirm your email, when you create an account: your account opens once you click it.
• Password resets, when you ask for one on the sign-in page. Each link works once and expires after 15 minutes.
• Sign-in links, when you ask to sign in without a password. Each link works once and expires after 15 minutes.
• Posting reminders: a note shortly before an approved post is due (30 minutes by default), with a link back to it. They go to the workspace’s owners and editors, and can be turned off at any time in the workspace.
• Trial emails: two days before a workspace’s two-week trial ends, and on the day it ends, saying what the trial made and what changes. They go to the workspace’s owners, once each.

We keep a record of each email we send (the address, the subject and whether it was delivered, never its contents) for 90 days, so we can fix delivery problems. If an address bounces for good or marks our email as spam, we stop writing to it. We do not send marketing or newsletters, we do not share your address, and our emails have no tracking pixels or tracked links. Replies to noreply@goastrid.com are not read; write to contact@goastrid.com instead.

How your content is used

We use your content to do what you asked: to learn your brand and voice and to write your marketing. It is processed on our own servers by our own AI model. It is not sent to outside AI companies, and it is not used to train anyone else’s model. Anything fetched from a website is treated as information to read, never as instructions. Your edits and approvals are used to make Astrid’s writing for your workspace better.

Where it lives and who can see it

Your data is stored on our servers in Canada, and each workspace is kept separate from every other. The people in your workspace can see it, and so can the people you give access to, such as clients who use an approval link. We use a small number of service providers to run Astrid, and they receive only what they need for that purpose:

• Hosting: our servers in Canada run on Amazon Web Services.
• Email delivery: Amazon Web Services (Amazon SES) sends our emails from its servers in the United States, so your email address and the message pass through it.
• Our own mailbox: messages you send to an @goastrid.com address are held by our email provider, Purelymail.
• This website: served by Cloudflare.
• Payments, if you pay for a plan: HJachi Solutions Inc., in Canada, which takes payments for us, and Stripe, which processes them. They receive your email address, your workspace’s name and your plan; only Stripe receives your card details.

The people who run Astrid see how the service is doing: accounts, workspace names, counts, errors and the records above, never your posts, pages or files. They can open your workspace only if an owner turns on support access in Settings, Privacy: read-only, for the time the owner chooses, with each visit shown in the workspace’s activity.

When you choose a password, we check it isn't one known from a data breach by sending only the first five characters of a one-way hash of it to Have I Been Pwned; your password itself never leaves our server. Your workspace content (your material, and what Astrid writes from it) is not sent to any of them, apart from the opening line of a post in its reminder email.

Your information is stored in Canada, handled from India by us, and passes through the United States for email. Wherever it is handled, it is protected by this policy and our agreements with those providers, and it is also subject to the laws of that country, whose courts and authorities may be able to require access to it.

How long we keep it

We keep your content while your account is open. Raw copies of crawled pages and technical logs are removed on a schedule. Approved posts stay until you delete them. If you delete a workspace or your account, we delete its content, files, approval links and queued jobs, and keep only a short record that the deletion happened.

Your choices

• Take a copy: “Export everything” in Settings gives you a download of everything in a workspace, and your account page does the same for your account.
• Delete it: you can delete a workspace or your account yourself, from the same pages.
• Disconnect: remove a social profile or code host connection at any time. Astrid drops its access at once and, where the platform allows, revokes it there too.
• Stop reminders: turn posting reminders off in your workspace.
• Ask us: to see, correct or remove anything we hold about you, write to us at privacy@goastrid.com.

We follow India’s Digital Personal Data Protection Act, 2023, and, because your information is stored in Canada, Canadian privacy law (PIPEDA) where it applies. If you are somewhere else, your local rights still apply and you can use the choices above.

Cookies and local storage

This website remembers your light or dark choice in your browser’s storage, and nothing else. The Astrid app uses a sign-in cookie to keep you signed in, and a cookie for your theme and sidebar choices. Neither is used for advertising.

Changes and contact

If we change this policy in a way that matters, we will say so in the app and update the date above. Questions are welcome at privacy@goastrid.com, which reaches our grievance officer, or by post to Primo Techworks, [address], India. If we cannot resolve a concern, you may complain to the Data Protection Board of India or, where Canadian law applies, the Office of the Privacy Commissioner of Canada.