Privacy Policy

Last updated: November 12, 2026

Aster is a personal AI assistant that works inside Telegram (and later other messaging apps). This policy explains what we collect, why, and what you can do about it. It's a beta product — we'll update this page as it grows.

What we collect

• Account identity — your Telegram user ID and display name, or your Firebase sign-in identity if you register on the website.
• Messages and voice notes — everything you send the assistant is stored so it can keep context. Voice notes are transcribed by OpenAI before being stored as text.
• Memories and conversation summaries — facts and running summaries the assistant keeps to remember you across chats.
• Reminders, tasks, approvals — the operational records of what you asked it to do.
• Contact profile — name, email and phone number you provide for bookings and confirmations.
• Connected account tokens — OAuth tokens for Google and Microsoft, and CalDAV credentials for iCloud, stored encrypted at rest.
• Payment metadata — Stripe customer ID, card brand and last four digits. Full card numbers never touch our servers; they go directly to Stripe.
• Call transcripts — if the assistant places a phone call on your behalf via Twilio, the transcript and outcome are stored.
• Beta request form — name, email, Telegram handle and note submitted on this website, stored in Firestore.

How we use it

• To run the assistant: remember your preferences, deliver reminders, search your connected accounts, and complete tasks you approve.
• Externally consequential actions (sending email, calendar changes, purchases, phone calls) require your explicit approval first.
• We do not sell your data, use it for advertising, or share it between users.

Who processes your data

• OpenAI — chat responses, tool execution, transcription, speech, realtime voice
• Google — Gmail and Calendar when you connect them; Firebase and Google Cloud host the site and backend
• Microsoft — Outlook and Calendar when connected
• Apple — iCloud Calendar via CalDAV when connected
• Stripe — payments and saved cards
• Twilio — outbound phone calls and SMS when configured

Your controls

• Send /forget to clear saved memories; /privacy for an in-app summary.
• The dashboard lets you export everything we hold (Settings → Export), disconnect providers, remove a saved card, or delete your entire account and data.
• You can revoke Google or Microsoft access at any time in your account security settings.

Retention and security

• Data persists until you delete it or delete your account. One-time login links expire in 5 minutes; sessions expire in 90 days.
• Provider credentials are encrypted at rest. Conversations travel over encrypted connections to our providers.
• No system is perfectly secure; a beta doubly so. Don't send passwords, card numbers or sensitive secrets in chat.

Children

Aster is not directed at children under 13 and requires a Telegram account.

Contact

Questions or deletion requests outside the app: reach out through the beta contact channel where you signed up.