Astrario is an Android application for talking to language models using the user's own API keys. It has no server of its own and requires no registration. The developer receives no data automatically: no conversations, no keys and no usage information. The only data received is what the user chooses to send by email, in the cases described in section 7.
This policy describes the processing of personal data carried out by the Astrario application for Android. It does not cover processing carried out by the language model providers a user chooses to connect to, which is governed by their own policies.
1. Data controller
Yasser Rosas, independent developer.
Contact: soporte@astrario.dev
A postal contact address is published on the application's Google Play listing, as that platform requires of individual developer accounts.
2. Data processed and where it is stored
The following data is stored solely in the application's private storage on the user's device, where it is not accessible to other applications:
- Conversations and any images the user attaches.
- API keys entered by the user, encrypted with AES-GCM under a key generated and held by the Android Keystore. That key does not leave the device and, on most handsets, is hardware-backed.
- Configuration preferences: aspect, language, models per provider, skills and any MCP servers the user has configured.
The application declares allowBackup="false", so this data is
not included in Android's backup and is not transferred to Google Drive.
The developer operates no servers and no databases, and receives no copy of any of this data, other than what the user sends by email under section 7.
3. Data that leaves the device
The following transmissions occur only at the user's instigation:
| Data | Recipient | When |
|---|---|---|
| Message text and attached images | The model provider selected by the user, using their key | On sending a message |
| A request for the model catalogue | That same provider | On opening the model picker or verifying a key |
| Data the model sends to a remote action | An MCP server configured by the user | Only if the user has enabled that server |
| A request to download a skill | The web address supplied by the user | On installing a skill from a link |
| A content report or a crash report | reportes@astrario.dev | Only if the user sends the email |
| A copy of the conversations | The destination chosen by the user | On export, or with automatic backup enabled |
API keys are not included in any backup. After restoring, the user has to enter them again.
4. Purpose and legal basis
The purpose of the processing is to provide the application's functionality: holding the user's conversations, keeping their preferences, and transmitting their messages to the provider they have chosen.
The legal basis is performance of a contract with the user (GDPR Article 6(1)(b)), understood as delivering the service requested. No processing is carried out on the basis of legitimate interest for analytics, advertising or profiling.
Voluntarily sending a content report or a crash report rests on the user's consent (Article 6(1)(a)), given by sending the email and withheld by discarding it.
5. Recipients and international transfers
The only recipients of data are the language model providers and MCP servers the user configures. Each provider acts as an independent controller in respect of the data it receives, under the contract the user holds with it.
Most of these providers are established outside the European Economic Area, principally in the United States, so using them involves an international transfer of data. The applicable safeguards are those each provider sets out in its own terms. Reading the privacy policy of whichever provider's key is in use is recommended.
The developer discloses data to no other recipient.
6. Device permissions
A model may ask the application to carry out an action on the device. None of these actions runs without the user's express authorisation at the time of the request, one at a time:
- Calendar: creating and reading events. The permission is requested at the time of the action, not during installation.
- Alarms: creating alarms in the system clock application.
- Files: reading and writing files the user selects in the system picker. The application cannot specify paths or reach files that were not expressly selected.
- Notifications: indicating that an operation is still running.
- Internet: communicating with the selected provider and with any configured MCP servers.
These actions can be disabled entirely from each conversation's settings.
7. Data the user sends to the developer
There are two cases, and only two, in which the developer receives data. Both require the user to write and send an email from their own account; the application sends nothing by itself.
Content report. If the user considers a model's answer inappropriate, the application prepares a draft email containing the text of that answer, up to 2,000 characters, the provider and model that produced it, and the reason the user writes. The user can read and edit the draft before sending it.
Crash report. If the application closes unexpectedly, it stores a technical report on the device containing the point in the code at which the failure occurred, the application version, the Android version and the device model. It contains no conversation content and no API key. On the next launch the application offers to send it by email or delete it; if it is not sent, it is deleted from the device.
In both cases, because this is an email, the developer also receives the sender's email address, together with any personal data the user chose to include in the text.
Purpose: handling the report or fixing the failure. Legal basis: the user's consent, given by sending the email (GDPR Article 6(1)(a)). Not sending it, or discarding the report, amounts to withholding that consent, with no effect whatsoever on how the application works.
Retention: these emails are deleted once dealt with and, in any event, within twelve months of receipt. They are not added to any database, are not used for any other purpose, and are not disclosed to third parties.
The user may request the deletion of an email they sent at any time, by writing to soporte@astrario.dev.
8. Retention and erasure
Data is retained on the user's device until the user deletes it. Retention of emails sent to the developer is governed by section 7.
A conversation can be deleted from the list, a key from the keys screen, and all data at once by uninstalling the application. As the developer holds no copies, deletion on the device is final.
Backups exported by the user remain under their control and must be deleted wherever they were saved.
9. User rights
Because the data resides only on the device, the user exercises the rights granted by the GDPR directly and without intermediation:
- Access and portability: exporting conversations to a readable JSON file, from the list menu.
- Rectification: editing or deleting any message.
- Erasure: deleting conversations, keys, or all data by uninstalling.
- Objection and restriction: disabling device actions from each conversation's settings.
For data residing on the device there is no need to contact the developer, as no copy exists in their possession.
If the user has sent a content report or a crash report (section 7), a copy does exist in the developer's possession. Rights of access, rectification and erasure over that data may be exercised by writing to soporte@astrario.dev.
Rights concerning data already transmitted to a model provider must be exercised with that provider.
The user has the right to lodge a complaint with the competent data protection supervisory authority in their country of residence. In Spain, the Agencia Española de Protección de Datos (aepd.es).
10. Security
API keys are encrypted with AES-GCM under a key managed by the Android Keystore. Communications with providers and with MCP servers use HTTPS. Data resides in the application's private storage, isolated from other applications by the operating system.
11. Processing that is not carried out
- Personal data is not sold and is not disclosed to data brokers or advertisers.
- No profiling is carried out and the user is not tracked across applications or websites.
- User content is not used to train models. What each provider does with the content it receives is governed by its own terms.
- The application carries no advertising, no analytics and no third-party SDK that collects information.
12. Children
Astrario is not directed at children under 14 and does not knowingly collect data from children of that age. Using it requires an account held with a language model provider.
13. Changes to this policy
Any change will be published at this same address, with the date at the top updated. Changes affecting what data leaves the device will additionally be announced in the release notes for the version concerned, before that version is available.