Privacy Policy

Revision: 2.2
Published: 13 October 2026
Effective from: 24 October 2026; section 11 from 10 October 2026, sections 2.13 and 4.6 from 11 October 2026, and the voice-download routing revision 2.2 added (in 2.8, 4.4, 5 and 6) from 13 October 2026 — see section 10
Permanent address: /privacy
Archive of previous revisions: /legal/archive

0. Who is responsible for your data

Mykhailo Samiliak, a sole proprietor registered in the State of Washington, United States of America, trading as Minice. In data-protection language: the controller.

Write to contact@minice.ai for anything in this document, including every request under section

1. That address is monitored by a person and it is the only channel — there is no form to fill in and nobody to telephone.

1. The short version

• We collect what we need to sell you the product, let you sign in, keep your account safe, and count what you use.
• We run our own sign-in system. It holds your email address and a one-way hash of your password — never the password itself.
• We run no analytics and no third-party trackers on this website.
• We never see your card details. They are entered on our payment provider's own pages.
• We do not sell your data, and we do not use what you type to train anyone's models.
• Your requests are sent to three third parties — one for text, one for the voice, one for web search — because routing them there is the cloud service. Section 4 names all three and says exactly what each one receives.
• You can see every device signed in to your account and sign any of them out yourself.
• You can have your data deleted. Section 7 says how, and says honestly what is a button and what is a person doing it by hand.

2. What we collect

2.1 Your account. Your email address and whether you have confirmed it; a name, if you give one; the language for our emails; and a permanent account identifier that contains neither your name nor your email.

• Your password is stored only as an argon2id hash. Accounts moved from our previous sign-in system arrive with a bcrypt hash, which is replaced by an argon2id hash the first time you sign in.
• Two-factor authentication, if you turn it on: the secret behind your one-time codes, stored encrypted, and your recovery codes, stored as hashes.
• Google, if you sign in with it: your Google account identifier, the email address Google tells us it has verified (an unverified one is not kept), and your name.

2.2 Your sessions and devices. Each sign-in on a browser or a device is a session. For each one we keep its identifier, the IP address and the browser or app description (User-Agent) it signed in from, how you signed in, when, when it was last used, and when and why it ended.

For the Astra app there is one more thing. Astra creates a key on your computer once; the private half stays in your operating system's protected storage and is never sent anywhere. Astra uses it to sign its licence requests, and we record the key's fingerprint, the session it belongs to, and when that installation first and last asked. That is what lets a licence work on the installation it was issued to — copying Astra's folder to another computer does not copy the licence — and what lets you see and sign out your devices (section 7).

2.3 Sign-in protection. When a password or a code is entered wrong, we count it, with the time, against your account (or against a hash of the address that was typed, if no account has it) and the IP address it came from. Enough wrong tries pause sign-in for a while. A pause is never permanent: it ends by itself, and we can lift it if you write to us. When sign-in to your account is paused we may email you to say so.

2.4 Codes we email you. For registration, signing in by code and password reset: your address, the IP address that asked, the time, and the code itself only as a hash. These records are deleted once the code expires.

2.5 What happens to your account. A log of changes: a sign-in method linked or unlinked (with the identifier at that provider), a session ended, the account turned off or on, a sign-in pause lifted — and who did it.

2.6 What you bought. Which product, when, how much, the transaction identifier from the payment provider, and the state of your licence or subscription. Not your card number, not its expiry, not the security code — those are entered on the provider's pages and never reach us.

2.7 What you used. Counts: tokens of text in and out, characters of speech synthesised, and when. This is how the monthly credit allowance is measured, and it is the figure we quote back to you if you ask for a refund under the [Refund Policy](/refund).

2.8 Technical data. Your IP address and the time of a request, for rate limiting and for detecting abuse. Server logs.

Where the voice download comes from. When the Astra app downloads its offline voice (one file of about 400 MB), our server looks up the country of the IP address the request comes from — the country and nothing finer — in a copy of a geolocation database kept on that server; nothing is sent to anyone to do it. **IP geolocation by [DB-IP](https://db-ip.com), used under the Creative Commons Attribution 4.0 licence. We use the answer for one thing: when the database places the address in Russia**, the app is sent to download the file from a server in Moscow (dl.knice.tech, section 4.4), because connections from Russia to servers abroad are often cut off partway through a large download. From any other country the file comes from the content delivery network, as before. The country is not stored with anything about you, and an address the database does not place in Russia is never sent to the Moscow server.

2.9 The plugin catalogue. Astra reads the plugin catalogue, the keys that sign it, the list of withdrawn plugin versions and the plugins' install counts from registry.minice.ai, which we operate, served through the gcore content delivery network. While it runs, it asks for the withdrawal list about every 30 minutes (every 2 minutes after an ask that failed, until one succeeds) and for the catalogue about once a day, and again when you browse plugins. These requests carry no account, no sign-in and nothing you have typed — only the address they come from, Astra's version in the User-Agent (astra-daemon/<version>), and the time. The host keeps those as access records, which are never joined to your account. When registry.minice.ai cannot be reached, Astra asks for the same signed withdrawal list and its keys from the copy we publish on GitHub Pages (mihailinl.github.io), carrying the same three things.

2.10 Plugin authors, moderators and operators. The verified email address we send plugin-service notices to, and the delivery log of those notices (section 6).

2.11 Cookies. No more than these:

No advertising cookies. No analytics cookies. No third-party trackers. There is nothing here to consent to, which is why this site does not ask you to dismiss a banner.

2.12 What you type. Your prompts, dictation and the answers you get. They pass through our service to the providers in section 4. We hold them only as long as it takes to answer you, plus what appears in short-lived error logs when something fails.

2.13 Your country, for the withdrawal box at checkout. When you open the payment page, we look up the country of your IP address — the country and nothing finer — in a copy of a geolocation database kept on our own server; nothing is sent to anyone to do it. **IP geolocation by [DB-IP](https://db-ip.com)**, used under the Creative Commons Attribution 4.0 licence. We use the answer for one thing: whether the payment page shows the box described in section 2 of the [Refund Policy](/refund), which it shows only to buyers it locates in the countries listed there. With the purchase, at our payment provider, we record that country and whether the box was shown, and after payment the country that issued your card and the country of your billing address, as the payment provider reports them — so that a later question about your right of withdrawal can be answered from the facts. Using a VPN changes only whether you see the box; it never takes a right away from you.

3. Why we are allowed to hold it, and on what basis

We do not send marketing email. If that ever changes, it will be a separate opt-in and not a re-reading of this table.

4. Who else sees it

4.1 Sign-in. We run the sign-in system ourselves (our own service, built on the open-source Ory Hydra). No outside company holds your password or your account record. If you choose to sign in with Google, you go to their page, they learn that you are signing in to us, and they send us what section 2.1 lists. You can unlink it from your account page, as long as you keep another way in.

4.2 Payment provider. Stripe. They receive what they need to take the payment, including your card details, which they receive and we do not. Their own privacy terms govern that.

4.3 The services your requests are routed to. Routing your requests to third parties is the cloud service. Today there are three, and each one receives a different thing:

Nothing else is sent, and none of them receives your account, your email or your payment data.

This list is the current one and we keep it current in this document. If we add or drop a provider, this section changes in a new revision and the old one stays in the archive — so you can always see who was receiving your requests on a given date, not only who receives them today.

4.4 Infrastructure.

We have not yet confirmed gcore's registered country for this document; we will name it here once we have.

4.5 People on our side. Only staff with the administrator role can open the account panel, where the account data in section 2 is shown; signing in to it needs two-factor authentication, and every change made there needs a fresh sign-in and is written to the account change log. Support staff can look an account up by email address and see the name on it in our service console.

4.6 E-mail. Two services handle the e-mail we exchange with you. Resend sends the letters this site writes to you — sign-in codes and, after a purchase, the confirmation of your purchase and of your withdrawal request — and so receives your e-mail address and the text of that letter. Migadu hosts our own mailbox, contact@minice.ai: it holds what you write to us, and a blind copy of every purchase confirmation we send, which we keep as our record that it was sent.

4.7 Nobody else. We do not sell, rent or trade your data. We do not share it for advertising. If we are ever legally compelled to hand something over, we will tell you unless we are forbidden to.

5. Where it goes

We are established in the United States. Our servers, including the account database, are in Almaty, Kazakhstan. Backups of the databases are kept in the United States. Of the providers named in section 4, Resend and GitHub operate from the United States; gcore's country is not yet confirmed for this document. If you are in the EU or EEA, your data will be transferred to Kazakhstan, to the United States, and to wherever gcore's infrastructure operates.

Russia, for one thing only. When you download the Astra voice from an IP address located in Russia (2.8), that download — and the IP address, User-Agent, time and file address it carries — is handled by the Moscow server of Nikita Alekseevich Gurov, sole proprietor (4.4). Nothing else of yours goes there, and nothing at all from an address located anywhere else.

Where that transfer needs a legal mechanism, we rely on the European Commission's Standard Contractual Clauses with the providers concerned, or on an adequacy decision where one covers them.

6. How long we keep it

7. Your rights, and which of them we can do with a button

If you are in the EU or EEA you have the rights in the GDPR: access, rectification, erasure, restriction, objection, and portability. If you are in California you have the rights in the CCPA, including to know, to delete, and to opt out of sale — and we do not sell, so there is nothing to opt out of.

How to use any of them: write to contact@minice.ai. We answer within one month, which is the period the law gives us, and usually much sooner.

What is a button. On your account page you can see every session and device signed in to your account — when it signed in, when it was last used, its IP address and browser or app — and sign any of them out, or all but the one you are using. A device you sign out has to sign in again. On the same page you can unlink Google (as long as another way in remains), and turn two-factor authentication on or off.

Now the honest part, because a privacy policy that overstates its own machinery is worse than one that admits to doing things by hand:

• Deletion works today, by email. Write to us and say you want your account data deleted. We do it, and we tell you when it is done. There is no self-service button and this document is not going to imply there is one.
• Export — the right to portability — also works by email, and only by email. We have not yet built a self-service export. When you ask, a person assembles your account record, your purchase history and your usage counts and sends them to you in a machine-readable form, within the same one month. That is the right honoured, not waived — the law requires us to provide the data, not to provide a button. We intend to build the button; until it exists, this paragraph is what we do instead of pretending.
• Deletion has one limit and it is not discretionary. We must keep payment and tax records for as long as the law says, so those survive a deletion request. Everything that is not legally pinned goes — except the account change log, which our system gives us no way to edit or delete entries from; we are working on how to honour an erasure request for it.

You may also complain to a supervisory authority in the EU or EEA country where you live.

8. Children

The service is not for people under 16. We do not knowingly collect their data. If you believe a child's data is here, write to contact@minice.ai and we will remove it.

9. Security

Passwords are stored only as argon2id hashes; two-factor secrets are stored encrypted; emailed codes only as hashes. Password and code guessing is slowed by a pause that is never permanent. Every session can be ended on its own, and ending one — or turning an account off — stops that session from getting new access at once. Staff access to account data needs two-factor authentication and is logged. Sessions on this site are sealed. Payment credentials never reach us. Secrets are held outside the application and never in a configuration file a reviewer would read.

We cannot promise that nothing will ever go wrong. If a breach affects your data and the law requires telling you, we will tell you, and we will not wait to be asked.

10. Changes

We publish a revision number and an effective date for every change, and every previous revision stays at /legal/archive.

A change never applies backwards. For a material change we give at least 14 days' notice before the effective date.

Revision 2.2 (13 October 2026) adds where the voice download comes from: the second paragraph of 2.8, the Moscow server and who runs it in 4.4, its paragraph in 5 and its log in 6. They apply from that day, ahead of the rest of this revision, and nothing else changed. Revision 2.1 is in the archive.

Revision 2.1 (11 October 2026) added sections 2.13 and 4.6, which apply from that day, ahead of the rest of this revision: 2.13 says how the country of your IP address, card and billing address is used at a purchase, and 4.6 names Resend and Migadu as the two services that handle the e-mail about your purchases — neither of which revision 1.0 or 2.0 described. Nothing else changed. Revision 2.0 (published 10 October 2026) and revision 1.0 are in the archive. The purchase confirmation it describes is sent only for purchases made from that date; nothing about data already processed changes. Revision 1.0 is in the archive.

11. Plugins

This section is additional to sections 2–7, for the smaller group of people who publish or moderate plugins, and — in 11.7 only — for Astra users who rate a plugin. This section 11 applies from its publication on 10 October 2026 — it describes a new, opt-in service and changes nothing for anyone who does not use it; the rest of this edition takes effect on 24 October 2026. If you only use Astra and never rate a plugin, none of this applies to you.

11.1 Who this covers. Plugin authors and moderators using the plugins panel at
astra.minice.ai/plugins, signed in with your Minice account.

11.2 What we collect.

• Your plugins account id — your Minice account identifier, carried into the panel.
• A notice e-mail address, so we can reach you about your plugins (also listed in 2.10, which

covers how we send it: our own mail server, from no-reply@notices.minice.ai).

• GitHub bindings — the GitHub account and repository links you bind to a listing.
• Submissions — the plugin bundles you submit, their versions, their metadata, and the bot-check

results run against them.

• Moderation records — kept whether or not anything you submitted was ever found to be a

problem: an audit log of moderator actions, the delivery status of notices sent to you, eligibility
readings, sanctions, and appeals together with their outcome.

11.3 Why we are allowed to hold it, and on what basis.

11.4 How long we keep it.

11.5 Public by design. A published plugin listing — its name, the display name you chose as its
author, its versions and its repository link — is public. That is what publishing a listing
means, and section 2.9 says how Astra itself reads the catalogue that carries it.

11.6 Erasure and access requests for plugins data. Write to contact@minice.ai — the same
address section 7 names for everything else in this document. We answer within one month, which
is the period the law gives us, and usually much sooner. There is no self-service erasure inside the plugins panel yet. Until there is, a request made by email is answered by a person, the same
honest way section 7 describes for deletion and export elsewhere in this document.

11.7 Rating a plugin you installed (install facts). When you rate a plugin in the Astra desktop
app, Astra tells us that you installed it:
your account id, the plugin's id, the version you installed and when you installed it.
Only the Astra desktop app sends this, and only when you rate a plugin you installed — nothing is
sent while you simply use plugins. We use it for two things: to check that you may rate that plugin
(only people who installed it can), and to count installs. We keep it
for as long as your account exists and delete it together with your account (section 7).
11.7 applies from its publication, before Astra sends any of it.