Privacy

Short answer: Aster has no server of its own to leak.

The Android app

• Aster has no accounts, no analytics, no ads and no tracking. It never phones home.
• Your chats, settings and API keys are stored only on your device, in the app's private storage.
• Messages you send go directly from your device to the AI provider you configured — Aster is not a middleman and cannot read them.
• Backups you create are encrypted with a password only you know (PBKDF2-HMAC-SHA256, AES-CBC with encrypt-then-MAC) before they are written to the folder you pick.
• The optional "publish crash details" flow is entirely user-initiated; nothing is collected automatically.

The web app (hosted on Cloudflare Pages)

• Access: the web app is password-gated for two users (U1 and U2). The passwords live only as Cloudflare secrets on this project — there are no accounts, no emails, no password hashes in any database. A sign-in issues a signed session cookie valid 30 days.
• Model lists: when you fetch the models of a connection, the plain model-name list is cached in Cloudflare D1 against your user (U1/U2) so pickers load instantly on other devices.
• Sync: your connections (including API keys), custom instructions and conversations are synced to D1 against your user, so signing in on another device restores everything. This data is visible only to your signed-in users (the two site passwords) and is never logged elsewhere by Aster; Cloudflare stores it at rest encrypted. Clearing a chat deletes it from the sync store too.
• API requests go directly from your browser to your provider whenever that provider allows it (CORS).
• If a provider blocks direct browser calls, the request is retried through a tiny Cloudflare Pages Function that forwards it to the URL you configured and streams the reply back. That relay accepts only `/chat/completions` and `/models` paths on public hosts, does not log request bodies or keys, and stores nothing.
• Markdown rendering uses well-known open-source libraries (marked, DOMPurify, highlight.js) loaded from the jsDelivr CDN; the GitHub releases numbers on the home page are fetched from api.github.com. These are the only third-party requests the site makes.

Your choices

Because chats are local, deletion is trivial: Settings ▸ Delete all conversations, or remove the site's data in your browser. Signing out clears the session cookie; the only server-side data is your per-user model list cache, which Settings ▸ Delete all conversations and a fresh fetch overwrites. On Android, uninstalling the app removes everything.

Questions? Open an issue on GitHub.