Privacy Policy

last updated · August 30, 2026

Astarii is an AI agent that operates a browser for you — in the cloud, in your own Chrome via the extension, on your desktop, or watched from your phone. This policy explains what data moves where when it works, what we store, and what we never do.

How a run works, and where data goes

• The model runs on our side. During a run, the text of the page the agent is working on (and screenshots of it) is sent to Astarii's servers, which call an AI model provider with Astarii's own keys to decide the next step. You never supply or manage a model API key.
• Only pages a run touches. This happens solely for pages a task you started or scheduled is working on. Astarii does not watch, log or transmit your ordinary browsing, and collects no browsing history.
• Transcripts belong to you. The steps, page-derived text and summaries of each run are stored as that run's transcript in your account, visible only to you, and deleted when you delete the run.

What we store when you create an account

Accounts and data live in Google Firebase (project region: US). Stored under your user ID, readable only by your authenticated account:

• Account: your email address and authentication credentials (managed by Firebase Authentication; we never see your password).
• Scheduled tasks: the prompt, cadence, timezone, and run times you configure.
• Run history: transcripts of runs — the steps taken, page-derived text the agent worked with, and its summaries.
• Dedup memory: identifiers (such as URLs) of items the agent has already surfaced, so scheduled runs don't repeat themselves.

The browser extension

The extension needs a small number of Chrome permissions. Each one is listed here with what it is actually used for, because "browser automation" on its own does not tell you anything.

• Access to websites you are on (<all_urls>) — an Astari has to be able to read and act on whichever page its task is about, and that page could be any site. It reads a page only while a run you started is working on it. It does not watch, log or transmit your ordinary browsing.
• Tabs and scripting — to open, switch and act on the tab a run is using.
• Cookies — used in one direction only. When a scheduled run is handed to your browser, that Astari's own saved cookies are placed into a separate private window so it is signed in as itself. They are never mixed into your normal browsing session, and the window and its cookies are destroyed when the run ends. The only time the extension reads a site’s cookies from your own session is when you use “Share this site’s login” in Settings — an explicit click that hands that one site’s session to one of your own Identities so runs can start signed in. Nothing is read without that action.
• Storage and alarms — your settings, and the timer that makes scheduled runs fire.

Astarii's extension does not request Chrome's debugger permission, and does not execute any code downloaded at runtime. Everything it runs ships inside the extension package.

CAPTCHAs

When a task runs into a token-style challenge (reCAPTCHA, hCaptcha, Turnstile), Astarii may solve it through a third-party solving service (CapSolver) called from our own servers — the solving key never ships in any app. What is sent is the challenge's public site key and page address, never anything about you. Full-page challenges that bind to your browser (such as Cloudflare's interstitial) are not bypassed: the run stops and asks you to finish that step yourself.

What data leaves your browser

• What the agent is doing — the step list, and a screenshot of the page it is working on, so you can watch the run from the dashboard or your phone. These are tied to your account and are deleted with the run.
• Sign-in details you save deliberately — stored encrypted, decrypted only on our server at the moment of signing in to the site they belong to, and never sent to the extension, the desktop app or the phone.

Billing

Payments are processed by Stripe. Card details go directly to Stripe and never touch Astarii's servers; we store only your Stripe customer reference and subscription status.

What we don't do

• No selling or sharing of your data. Ever.
• No advertising, no third-party analytics or tracking pixels on the extension.
• No reading your data for any purpose other than operating the service.

Deleting your data

Deleting tasks and runs from the dashboard deletes them permanently. To delete your entire account and all stored data, email hello@astarii.ai from your account address and we'll remove it.

Changes

If this policy changes materially, we'll note it here with a new date. Questions: hello@astarii.ai.