With no account, nothing leaves the device
Until you sign in, your notes, their coordinates, your photos, your recordings and the files you attach exist only in the app’s storage on your phone. No server is involved and we have no access to any of it.
Your operating system may include those files in the device’s own backup (iCloud on iOS, Android backup) because they live in the app’s documents area. That backup is yours and is governed by Apple’s or Google’s policy, not this one.
What we store once you have an account
An account is what lets the same note appear on two devices and a folder reach another person. To do that, we begin storing on the server:
- Identity: your email address, if you signed in by email; an opaque identifier issued by Apple or Google, if you signed in with one of those (never your password, which never passes through us); your display name; your handle, if you choose one; and your profile photo, if you upload one.
- Content: each note’s title and body, the coordinate and accuracy of the spot it was written, the folder it sits in, its created and edited dates, and any files you attach.
- Sharing: who you gave access to, to what, and in which role: reading or editing.
- Operational: active sessions, the sequence numbers that let syncing know what has already arrived, any reminders you created, which notes you have opened (to mark them as read) and, if you allow notifications, each device’s push token.
- Steps in the portal, generic data only: to understand why some people do not finish buying a group, we keep, per account, the name of a step from a fixed list (for example “reached the payment”) and the date it was first reached. That is all. We do not keep what you read, where you clicked, how often you came back, or the content of any note, and no coordinate goes into this record. It is not sent to anyone else, it appears to our team only as counts, never per person, and it is deleted with the account. It exists only in the portal: the app sends none of it.
Google user data (Sign in with Google)
Signing in with Google is optional. When you use it, Google hands our server an identity token carrying these details from your Google account, and nothing beyond them: your email address, your name, the URL of your profile picture and an opaque account identifier. We request only the basic identity scopes (openid, email and profile). We do not ask for access to your Gmail, Google Drive, Calendar, Contacts, Photos or any other Google service, and we read nothing from your Google account after you sign in.
- What we use it for: the email and identifier recognise your account the next time you sign in; the name and picture appear on your notes and to the people you share a folder with, so they know who wrote what.
- Where it lives: in our PostgreSQL database, hosted on Railway, alongside the rest of your account.
- Who we share it with: no one. This data is not sold, rented, used for advertising or transferred to third parties, other than the hosting infrastructure listed below, which stores it on our behalf, or when the law requires it.
- How to delete it: deleting your account in Settings deletes your email, name, picture and Google identifier along with the rest of your data. You can also revoke Asterisco’s access on your Google account permissions page (myaccount.google.com/permissions), or ask for deletion at contato@asterisco.app.
Asterisco’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this data only to provide and improve Asterisco’s user-facing features. We do not use it for advertising, we do not use it to train models, and no human reads it except with your consent, for security purposes, to comply with the law, or when the data is aggregated and anonymised.
Location
Location is read only while the app is open in front of you. The app does not follow you in the background.
The one exception is reminders: if you turn a reminder on for a specific note, the system has to wake the app when you pass near it, and only then is background location permission requested, with an explanation on screen, at the moment you flip the switch. Turning reminders off ends it. Somebody who does not use reminders is never asked.
Coordinates never appear in page addresses or in log lines. They travel in request bodies, and the server strips any coordinate before writing a line of log.
What we do not do
- No product analytics, attribution or advertising SDK is bundled in the app, the portal or the API; the steps described under Operational are recorded by our own server, with no third-party library. The public pages of the website (home, features, teams, pricing, download, blog, help and these texts) count visits with Vercel Web Analytics, without cookies: it receives the page address, where the visitor came from, the country and the kind of browser, and nothing else. It does not run in the app or in the portal. The only third-party library that contacts its vendor from the phone is Google’s sign-in library, and only if you choose Sign in with Google. That is checkable in the project’s code.
- No coordinate is sent to a third party for measurement, not bucketed, not “anonymised”.
- We do not sell, rent or share your data. We do not work with location data brokers.
- There are no public notes and no “people nearby”. Nobody finds you on a map. Somebody who knows your handle can look it up and see only your name and picture, never an email address or a place; you can turn that off in Settings.
- We build no behavioural profile: the only record of use is the few generic steps described above, the first time of each. And we do not use your content to train models.
Who else can see your notes
Only the people you choose. Sharing is always an explicit act: you open a folder or a note and grant access to a named person. Before a note is moved into a shared folder, the app names the people who will gain access.
When you take access away, the server announces the revoke and the content is removed from the other person’s device on their next sync. Anything they copied out of the app before that is, of course, beyond our reach.
When you write about other people
A note can end up holding data about somebody who does not use Asterisco, such as the address of a house, the name of whoever answered the door or something they said. That is your content, written by you, and we do not inspect it.
You decide what gets written down, and responsibility for that data is yours. The simplest principle applies: keep the minimum your purpose needs. An address marked “do not come back” serves that purpose; the name, religion, opinion or health of whoever lives there does not, and does not belong in a note.
If somebody approaches us asking that personal data inside another person’s notes be deleted, the request goes to whoever wrote the note, because that is who decides what stays recorded. Our contact for this is contato@asterisco.app.
Who the data travels through
To work with an account, the service leans on a few suppliers, each with a narrow job:
- Railway: hosts the API and the PostgreSQL database your notes live in.
- Vercel: hosts the website and the portal, and counts visits to the website’s public pages, without cookies.
- Cloudflare R2: stores attached photos, recordings and files (documents). A file you attach is stored with your note, like a photo or a recording, and is only ever downloaded from our storage, never opened there.
- Resend: delivers the email carrying your sign-in code, when you sign in by email. It receives your address and the code, nothing else.
- Apple and Google: only if you use Sign in with Apple or Google sign-in, and under their own policies.
- Expo: delivers the app’s notifications, and only if you allow them. It receives the device’s push token and the notification text (who shared what with you), never a coordinate.
The map in the app is the platform’s own (Apple Maps on iOS, Google Maps on Android), and what you look at on it is handled by them under their policies. The web portal draws its map from OpenStreetMap tiles.
How long
Deleted notes become tombstones, which is what carries the deletion to your other devices, and those are swept after 90 days.
Deleting your account deletes your rows and your files, and announces the revoke of every grant you had made, so shared content leaves other people’s devices too. You do this yourself, in Settings, without asking anybody.
You can export everything at any time, as GeoJSON and Markdown. Leaving with your content is a feature, not a favour.
Children
Asterisco is not directed at children under 13 and does not knowingly collect data from them.
Changes and contact
If this policy changes in any way that matters, the date at the top changes with it and the app says so. Questions, access requests or deletion requests: contato@asterisco.app.