01 / IDENTITY
Who operates Astro Arena
Astro Arena is a non-commercial astronomy learning project operated by Andraž Čadež. For a request you cannot complete in account settings, contact the author through the channel where you received access to the site.
02 / DATA
Data we use
- Account and session: display name, one-way password hash for a local account, account identifier and time-limited sign-in sessions. When you choose ChatGPT, Google, Apple, Microsoft, GitHub or Discord sign-in, the site receives the provider identifier and profile data needed to recognise you. A account uses the verified identifier for the same account across andraz.org projects; accounts are not automatically linked merely because their email addresses match.
- Profile: chosen image, short bio, profile creation date and display name.
- Learning: answers, attempts, timings, assistance used, points, streaks and data used for review recommendations.
- Social features: friendships, direct and group messages, improvement suggestions, group membership, invitations and competition results. Suggestions are visible only to the site operator.
- Security: time-limited hashed network and account identifiers, failed-attempt counts and security event types. Passwords are never written to logs.
- Device: language and selected game settings may be stored only in your browser.
For Google sign-in, we store the Google user identifier and display name for the shared A account. The display name is used in your profile and conversations with other users. We do not request or store your Google email address and do not access Gmail or Drive content. Google access tokens are not retained.
03 / PURPOSE
Why we need the data
The data enables sign-in, durable learning progress, scoring, leaderboards, recommended practice, profiles, conversations, improvement suggestions and competitions. Security data prevents automated registrations, password guessing and abuse. Scores do not produce decisions with legal or similarly significant effects.
04 / SERVICES
Services that help deliver the site
Hosting, database, content delivery, connection security and Turnstile verification when enabled.
Optional sign-in with ChatGPT. It is used only when you choose this sign-in method.
Optional sign-in for the shared A account. The selected provider verifies your identity; the site uses the verified identifier and display name and, depending on the provider, receives an email address. It requests only sign-in data. These methods become available when the operator connects them. Access tokens are discarded after identity verification.
Aladin Lite, astronomical HiPS imagery, Sesame and SIMBAD. Your browser communicates directly with these services when you open the atlas.
Your browser may connect to Google servers when loading typography.
05 / RETENTION
Retention and security
Account data, including submitted suggestions, remains in the active database while the account exists. Sign-in sessions last no longer than 30 days. Expired sign-in records and security challenges are cleaned up during use of the service, together with security events older than 90 days. Data travels over an encrypted connection. Messages and suggestions are not end-to-end encrypted, so do not include sensitive personal information.
06 / CONTROL
How you control your data
You can correct your display name, image and bio in your profile. Account settings let you change a local password and download shared A account data and Astro Arena data as JSON. Deletion removes the shared A account, its connected sign-ins and Astro Arena data from the active database. Data in separate other projects is managed in those projects. The European Commission explains rights of access, correction, erasure and, where applicable, portability in more detail.