Privacy

Short answer: Aster has no server of its own to leak.

The Android app

• Aster has no accounts, no analytics, no ads and no tracking. It never phones home.
• Your chats, settings and API keys are stored only on your device, in the app's private storage.
• Messages you send go directly from your device to the AI provider you configured — Aster is not a middleman and cannot read them.
• Backups you create are encrypted with a password only you know (PBKDF2-HMAC-SHA256, AES-CBC with encrypt-then-MAC) before they are written to the folder you pick.
• The optional "publish crash details" flow is entirely user-initiated; nothing is collected automatically.

The web app (aster pages on Cloudflare)

• Connections, chats and Judge sessions live in your browser's local storage (localStorage + IndexedDB). Clearing your browser data clears them; there is no server-side copy.
• API requests go directly from your browser to your provider whenever that provider allows it (CORS).
• If a provider blocks direct browser calls, the request is retried through a tiny Cloudflare Pages Function that forwards it to the URL you configured and streams the reply back. That relay accepts only `/chat/completions` and `/models` paths on public hosts, does not log request bodies or keys, and stores nothing.
• Markdown rendering uses well-known open-source libraries (marked, DOMPurify, highlight.js) loaded from the jsDelivr CDN; the GitHub releases numbers on the home page are fetched from api.github.com. These are the only third-party requests the site makes.

Your choices

Because everything is local, deletion is trivial: Settings ▸ Delete all conversations, or remove the site's data in your browser. On Android, uninstalling the app removes everything.

Questions? Open an issue on GitHub.