Privacy Policy

Revision: 2.4
Published: 16 October 2026
Effective from: 24 October 2026; section 11 from 10 October 2026, sections 2.13 and 4.6 from 11 October 2026, the voice-download routing added in revision 2.2 (in 2.8, 4.4, 5 and 6) from 13 October 2026, the Anthropic provider, the pseudonymous identifier and the policy-signal record added in revision 2.3 (in 3, 4.3, 5 and 6) from 14 October 2026, and the Russian hand-over disclosed in revision 2.4 (in 4.1, 4.8 and 5) from the date section 4.8 states, once set — see section 10
Permanent address: /privacy
Archive of previous revisions: /legal/archive

0. Who is responsible for your data

Mykhailo Samiliak, a sole proprietor registered in the State of Washington, United States of America, trading as Minice. In data-protection language: the controller.

Write to contact@minice.ai for anything in this document, including every request under section

1. That address is monitored by a person and it is the only channel — there is no form to fill in and nobody to telephone.

1. The short version

• We collect what we need to sell you the product, let you sign in, keep your account safe, and count what you use.
• We run our own sign-in system. It holds your email address and a one-way hash of your password — never the password itself.
• We run no analytics and no third-party trackers on this website.
• We never see your card details. They are entered on our payment provider's own pages.
• We do not sell your data, and we do not use what you type to train anyone's models.
• Your requests are sent to three third parties — one for text, one for the voice, one for web search — because routing them there is the cloud service. Section 4 names all three and says exactly what each one receives.
• You can see every device signed in to your account and sign any of them out yourself.
• You can have your data deleted. Section 7 says how, and says honestly what is a button and what is a person doing it by hand.

2. What we collect

2.1 Your account. Your email address and whether you have confirmed it; a name, if you give one; the language for our emails; and a permanent account identifier that contains neither your name nor your email.

• Your password is stored only as an argon2id hash. Accounts moved from our previous sign-in system arrive with a bcrypt hash, which is replaced by an argon2id hash the first time you sign in.
• Two-factor authentication, if you turn it on: the secret behind your one-time codes, stored encrypted, and your recovery codes, stored as hashes.
• Google, if you sign in with it: your Google account identifier, the email address Google tells us it has verified (an unverified one is not kept), and your name.

2.2 Your sessions and devices. Each sign-in on a browser or a device is a session. For each one we keep its identifier, the IP address and the browser or app description (User-Agent) it signed in from, how you signed in, when, when it was last used, and when and why it ended.

For the Astra app there is one more thing. Astra creates a key on your computer once; the private half stays in your operating system's protected storage and is never sent anywhere. Astra uses it to sign its licence requests, and we record the key's fingerprint, the session it belongs to, and when that installation first and last asked. That is what lets a licence work on the installation it was issued to — copying Astra's folder to another computer does not copy the licence — and what lets you see and sign out your devices (section 7).

2.3 Sign-in protection. When a password or a code is entered wrong, we count it, with the time, against your account (or against a hash of the address that was typed, if no account has it) and the IP address it came from. Enough wrong tries pause sign-in for a while. A pause is never permanent: it ends by itself, and we can lift it if you write to us. When sign-in to your account is paused we may email you to say so.

2.4 Codes we email you. For registration, signing in by code and password reset: your address, the IP address that asked, the time, and the code itself only as a hash. These records are deleted once the code expires.

2.5 What happens to your account. A log of changes: a sign-in method linked or unlinked (with the identifier at that provider), a session ended, the account turned off or on, a sign-in pause lifted — and who did it.

2.6 What you bought. Which product, when, how much, the transaction identifier from the payment provider, and the state of your licence or subscription. Not your card number, not its expiry, not the security code — those are entered on the provider's pages and never reach us.

2.7 What you used. Counts: tokens of text in and out, characters of speech synthesised, and when. This is how the monthly credit allowance is measured, and it is the figure we quote back to you if you ask for a refund under the [Refund Policy](/refund).

2.8 Technical data. Your IP address and the time of a request, for rate limiting and for detecting abuse. Server logs.

Where the voice download comes from. When the Astra app downloads its offline voice (one file of about 400 MB), our server looks up the country of the IP address the request comes from — the country and nothing finer — in a copy of a geolocation database kept on that server; nothing is sent to anyone to do it. **IP geolocation by [DB-IP](https://db-ip.com), used under the Creative Commons Attribution 4.0 licence. We use the answer for one thing: when the database places the address in Russia**, the app is sent to download the file from a server in Moscow (dl.knice.tech, section 4.4), because connections from Russia to servers abroad are often cut off partway through a large download. From any other country the file comes from Cloudflare's network (vox.minice.ai, section 4.4), as before. The country is not stored with anything about you, and an address the database does not place in Russia is never sent to the Moscow server.

2.9 The plugin catalogue. Astra reads the plugin catalogue, the keys that sign it, the list of withdrawn plugin versions and the plugins' install counts from registry.minice.ai, which we operate, served through the gcore content delivery network. While it runs, it asks for the withdrawal list about every 30 minutes (every 2 minutes after an ask that failed, until one succeeds) and for the catalogue about once a day, and again when you browse plugins. These requests carry no account, no sign-in and nothing you have typed — only the address they come from, Astra's version in the User-Agent (astra-daemon/<version>), and the time. The host keeps those as access records, which are never joined to your account. When registry.minice.ai cannot be reached, Astra asks for the same signed withdrawal list and its keys from the copy we publish on GitHub Pages (mihailinl.github.io), carrying the same three things.

2.10 Plugin authors, moderators and operators. The verified email address we send plugin-service notices to, and the delivery log of those notices (section 6).

2.11 Cookies. No more than these:

No advertising cookies. No analytics cookies. No third-party trackers. There is nothing here to consent to, which is why this site does not ask you to dismiss a banner.

2.12 What you type. Your prompts, dictation and the answers you get. They pass through our service to the providers in section 4. We hold them only as long as it takes to answer you, plus what appears in short-lived error logs when something fails.

2.13 Your country, for the withdrawal box at checkout. When you open the payment page, we look up the country of your IP address — the country and nothing finer — in a copy of a geolocation database kept on our own server; nothing is sent to anyone to do it. **IP geolocation by [DB-IP](https://db-ip.com)**, used under the Creative Commons Attribution 4.0 licence. We use the answer for one thing: whether the payment page shows the box described in section 2 of the [Refund Policy](/refund), which it shows only to buyers it locates in the countries listed there. With the purchase, at our payment provider, we record that country and whether the box was shown, and after payment the country that issued your card and the country of your billing address, as the payment provider reports them — so that a later question about your right of withdrawal can be answered from the facts. Using a VPN changes only whether you see the box; it never takes a right away from you.

3. Why we are allowed to hold it, and on what basis

We do not send marketing email. If that ever changes, it will be a separate opt-in and not a re-reading of this table.

4. Who else sees it

4.1 Sign-in. We run the sign-in system ourselves (our own service, built on the open-source Ory Hydra). No outside company holds your password or your account record — except, once and if the hand-over described in section 4.8 takes place, the seller of the Russian edition, for the accounts it covers. If you choose to sign in with Google, you go to their page, they learn that you are signing in to us, and they send us what section 2.1 lists. You can unlink it from your account page, as long as you keep another way in.

4.2 Payment provider. Stripe. They receive what they need to take the payment, including your card details, which they receive and we do not. Their own privacy terms govern that.

4.3 The services your requests are routed to. Routing your requests to third parties is the cloud service. Today there are four, and each one receives a different thing:

A pseudonymous identifier goes to the language-model provider with every request. It is a one-way code — an HMAC computed with a key only we hold, over the provider's name and your account — and a different code is computed for every provider we use, so the codes cannot be compared to link one provider's view of you to another's, and the provider cannot turn its code back into your account, your email address or anything else that identifies you. It exists for one reason: so that if one account's requests look like misuse, the provider can act against that one code — slow it down, refuse it — instead of the alternative, which is suspending the language model for everyone, because without it every request looks the same to the provider.

Nothing else is sent, and none of them receives your account, your email or your payment data. The identifier above is not your account: on its own, and to the provider that receives it, it identifies nothing.

This list is the current one and we keep it current in this document. If we add or drop a provider, this section changes in a new revision and the old one stays in the archive — so you can always see who was receiving your requests on a given date, not only who receives them today.

4.4 Infrastructure.

4.5 People on our side. Only staff with the administrator role can open the account panel, where the account data in section 2 is shown; signing in to it needs two-factor authentication, and every change made there needs a fresh sign-in and is written to the account change log. Support staff can look an account up by email address and see the name on it in our service console.

4.6 E-mail. Two services handle the e-mail we exchange with you. Resend sends the letters this site writes to you — sign-in codes and, after a purchase, the confirmation of your purchase and of your withdrawal request — and so receives your e-mail address and the text of that letter. Migadu hosts our own mailbox, contact@minice.ai: it holds what you write to us, and a blind copy of every purchase confirmation we send, which we keep as our record that it was sent.

4.7 Nobody else. We do not sell, rent or trade your data. We do not share it for advertising. If we are ever legally compelled to hand something over, we will tell you unless we are forbidden to.

4.8 Accounts that will be handed over to the Russian edition of Astra, when it gets its own sign-in system. Astra is sold in Russia by a separate seller — Nikita Alekseevich Gurov, sole proprietor (ИП Гуров Н. А., «KNICE TECH») — at knice.tech. Today knice.tech signs its customers in through our sign-in system, the same one this site uses, and nothing described in this section has happened yet. When the Russian edition begins running its own sign-in system, on a date this section will state once it is set, we will hand that seller the accounts of the people who are its customers: everyone who paid for Astra in roubles through YooKassa or bought it in the earlier Russian shop, and everyone who paid nothing and signed in mostly on knice.tech. We will never hand over an account that has ever paid through Stripe, nor a staff or plugin-publisher account. For each account handed over, the seller will receive: the account identifier; the e-mail addresses and whether each was confirmed; the name, language and creation date; the password hash (never the password); the two-step verification key, if you turned it on; and the identifiers of the Google and Telegram accounts linked to it. Recovery codes, sessions and device records will not be sent. The data will travel encrypted, directly between the two sign-in systems, and from the hand-over the seller becomes responsible for that account under its own privacy policy, https://knice.tech/privacy. Fourteen days after the hand-over — until then our support can move it back with nothing lost — we will delete the account from our sign-in system and keep only a one-way code of each of its addresses and linked sign-ins, so that if you try to sign in here afterwards we can tell you where your account went. For fourteen days after the hand-over, when someone creates an account on knice.tech, the seller asks us only whether that address belongs to an active account here that paid through Stripe and stays here — answered "no" for every other address, so that nobody who already holds such an account ends up with a second one on knice.tech by mistake — sending only a one-way code of the address, and nothing is kept. If you think an account should not be handed over when this happens, write to contact@minice.ai with the account's e-mail address.

5. Where it goes

We are established in the United States. Our servers, including the account database, are in Almaty, Kazakhstan. Backups of the databases are kept in the United States. Of the providers named in section 4, Resend, GitHub, OpenAI, Anthropic and Cloudflare operate from the United States, and gcore (G-Core Labs S.A.) is established in Luxembourg, in the EU. If you are in the EU or EEA, your data will be transferred to Kazakhstan, to the United States, and to wherever gcore's infrastructure operates — gcore's own establishment is inside the EU, but a content delivery network's edge locations are not all disclosed to us.

Russia, for one thing only. When you download the Astra voice from an IP address located in Russia (2.8), that download — and the IP address, User-Agent, time and file address it carries — is handled by the Moscow server of Nikita Alekseevich Gurov, sole proprietor (4.4). Nothing else of yours goes there, and nothing at all from an address located anywhere else. If the hand-over described in section 4.8 takes place, the accounts it covers will become a second thing sent there, once, on the date that section will then state; this paragraph will say so from that day.

Where that transfer needs a legal mechanism, we rely on the European Commission's Standard Contractual Clauses with the providers concerned, or on an adequacy decision where one covers them.

6. How long we keep it

7. Your rights, and which of them we can do with a button

If you are in the EU or EEA you have the rights in the GDPR: access, rectification, erasure, restriction, objection, and portability. If you are in California you have the rights in the CCPA, including to know, to delete, and to opt out of sale — and we do not sell, so there is nothing to opt out of.

How to use any of them: write to contact@minice.ai. We answer within one month, which is the period the law gives us, and usually much sooner.

What is a button. On your account page you can see every session and device signed in to your account — when it signed in, when it was last used, its IP address and browser or app — and sign any of them out, or all but the one you are using. A device you sign out has to sign in again. On the same page you can unlink Google (as long as another way in remains), and turn two-factor authentication on or off.

Now the honest part, because a privacy policy that overstates its own machinery is worse than one that admits to doing things by hand:

• Deletion works today, by email. Write to us and say you want your account data deleted. We do it, and we tell you when it is done. There is no self-service button and this document is not going to imply there is one.
• Export — the right to portability — also works by email, and only by email. We have not yet built a self-service export. When you ask, a person assembles your account record, your purchase history and your usage counts and sends them to you in a machine-readable form, within the same one month. That is the right honoured, not waived — the law requires us to provide the data, not to provide a button. We intend to build the button; until it exists, this paragraph is what we do instead of pretending.
• Deletion has one limit and it is not discretionary. We must keep payment and tax records for as long as the law says, so those survive a deletion request. Everything that is not legally pinned goes — except the account change log, which our system gives us no way to edit or delete entries from; we are working on how to honour an erasure request for it.

You may also complain to a supervisory authority in the EU or EEA country where you live.

8. Children

The service is not for people under 16. We do not knowingly collect their data. If you believe a child's data is here, write to contact@minice.ai and we will remove it.

9. Security

Passwords are stored only as argon2id hashes; two-factor secrets are stored encrypted; emailed codes only as hashes. Password and code guessing is slowed by a pause that is never permanent. Every session can be ended on its own, and ending one — or turning an account off — stops that session from getting new access at once. Staff access to account data needs two-factor authentication and is logged. Sessions on this site are sealed. Payment credentials never reach us. Secrets are held outside the application and never in a configuration file a reviewer would read.

We cannot promise that nothing will ever go wrong. If a breach affects your data and the law requires telling you, we will tell you, and we will not wait to be asked.

10. Changes

We publish a revision number and an effective date for every change, and every previous revision stays at /legal/archive.

A change never applies backwards. For a material change we give at least 14 days' notice before the effective date.

Revision 2.4 (16 October 2026) confirms gcore's registered country — G-Core Labs S.A., Luxembourg — in the table and the transfer paragraph of sections 4 and 5; names Cloudflare, Inc. (United States) in section 4 and 5 as the network that delivers Astra's installers and voice models (dl.minice.ai, vox.minice.ai), replacing the unnamed "content delivery network" the text previously said this about, in 2.8 and 4; and adds section 4.8: what will happen to accounts handed over to the seller of the Russian edition when it begins running its own sign-in system, with its clause in 4.1 and its paragraph in 5. None of section 4.8 takes effect yet: it discloses a planned transfer in advance, and takes effect only on the date section 4.8 will state once the hand-over is scheduled. The gcore and Cloudflare confirmations apply from publication, like the rest of this revision. Revision 2.3 is in the archive.

Revision 2.3 (14 October 2026) adds Anthropic beside OpenAI as a language-model provider (the one each request goes to depends on the model in use), and discloses the pseudonymous per-provider identifier sent with a language-model request and the policy-signal record kept when one is refused: the identifier paragraph and the Anthropic row in 4.3, its basis in 3, Anthropic as a United States recipient in 5, and the policy-signal record's 90 days in 6. They apply from that day, ahead of the rest of this revision, and nothing else changed. Revision 2.2 is in the archive.

Revision 2.2 (13 October 2026) adds where the voice download comes from: the second paragraph of 2.8, the Moscow server and who runs it in 4.4, its paragraph in 5 and its log in 6. They apply from that day, ahead of the rest of this revision, and nothing else changed. Revision 2.1 is in the archive.

Revision 2.1 (11 October 2026) added sections 2.13 and 4.6, which apply from that day, ahead of the rest of this revision: 2.13 says how the country of your IP address, card and billing address is used at a purchase, and 4.6 names Resend and Migadu as the two services that handle the e-mail about your purchases — neither of which revision 1.0 or 2.0 described. Nothing else changed. Revision 2.0 (published 10 October 2026) and revision 1.0 are in the archive. The purchase confirmation it describes is sent only for purchases made from that date; nothing about data already processed changes. Revision 1.0 is in the archive.

11. Plugins

This section is additional to sections 2–7, for the smaller group of people who publish or moderate plugins, and — in 11.7 only — for Astra users who rate a plugin. This section 11 applies from its publication on 10 October 2026 — it describes a new, opt-in service and changes nothing for anyone who does not use it; the rest of this edition takes effect on 24 October 2026. If you only use Astra and never rate a plugin, none of this applies to you.

11.1 Who this covers. Plugin authors and moderators using the plugins panel at
astra.minice.ai/plugins, signed in with your Minice account.

11.2 What we collect.

• Your plugins account id — your Minice account identifier, carried into the panel.
• A notice e-mail address, so we can reach you about your plugins (also listed in 2.10, which

covers how we send it: our own mail server, from no-reply@notices.minice.ai).

• GitHub bindings — the GitHub account and repository links you bind to a listing.
• Submissions — the plugin bundles you submit, their versions, their metadata, and the bot-check

results run against them.

• Moderation records — kept whether or not anything you submitted was ever found to be a

problem: an audit log of moderator actions, the delivery status of notices sent to you, eligibility
readings, sanctions, and appeals together with their outcome.

11.3 Why we are allowed to hold it, and on what basis.

11.4 How long we keep it.

11.5 Public by design. A published plugin listing — its name, the display name you chose as its
author, its versions and its repository link — is public. That is what publishing a listing
means, and section 2.9 says how Astra itself reads the catalogue that carries it.

11.6 Erasure and access requests for plugins data. Write to contact@minice.ai — the same
address section 7 names for everything else in this document. We answer within one month, which
is the period the law gives us, and usually much sooner. There is no self-service erasure inside the plugins panel yet. Until there is, a request made by email is answered by a person, the same
honest way section 7 describes for deletion and export elsewhere in this document.

11.7 Rating a plugin you installed (install facts). When you rate a plugin in the Astra desktop
app, Astra tells us that you installed it:
your account id, the plugin's id, the version you installed and when you installed it.
Only the Astra desktop app sends this, and only when you rate a plugin you installed — nothing is
sent while you simply use plugins. We use it for two things: to check that you may rate that plugin
(only people who installed it can), and to count installs. We keep it
for as long as your account exists and delete it together with your account (section 7).
11.7 applies from its publication, before Astra sends any of it.