ASTROGUARD · Owner-authored notice
Privacy Policy & Data Charter
Current data operations are described first. The original submitted charter below is preserved as a legacy draft, not a promise about this application. Reading this page does not create consent or accept terms.
Current ASTROGUARD data operations
Sign-in and sessions: Private PDF uploads use Sign in with Lovable and Lovable Cloud authentication. These services process sign-in and account/session information. The app maintains authentication session state in browser storage. It does not connect accounts to a live spacesuit sensor feed.
Research files: Choosing upload sends the original PDF to Lovable Cloud for storage and server-side text extraction. Stored records include the filename, size, MIME type, SHA-256 checksum, upload time, account association, extraction/review status, extracted page text and candidate claims. The app scopes file access to the signed-in owner. Uploading does not approve scientific claims or verify NASA provenance.
Fictional profile: Weight and height are session-local example inputs used for arithmetic BMI. They are not medical measurements. No source-derived physiological prediction is enabled without verified scientific prerequisites.
File removal: The Delete PDF control requests removal of the stored original and its app record. This is not account deletion, an immediate session purge, or a guarantee about backup retention. There is no account-erasure control in this app. An account-erasure procedure and retention commitments must be supplied by the app owner before they can be promised here.
External resources: The site loads fonts from Google Fonts, which receives the network requests needed to deliver them. Sign-in, file operations and page delivery use network services; this is not a fully offline clinical system. No advertising integration was identified in the app code reviewed for this notice.
Published-site visitor analytics
When this site is published, Lovable visitor analytics records page visits, referrers, country, browser, operating system, device type, time on page, page speed, errors, and clicks on buttons and links. With no consent banner on this site, these are recorded for every visitor. The editor preview is not counted.
Lovable's analytics uses no cookies, stores nothing on the visitor's device, does not keep IP addresses and does not identify visitors. Detailed data is kept for 90 days and daily summaries for a year. This does not mean the app's authentication stores nothing.
Lovable collects this data for us. Lovable's privacy policy explains how it handles it.
LEGACY SUBMITTED POLICY · DRAFT / PROPOSED
Legacy submitted policy text — not verified for the current ASTROGUARD deployment
The original names below are quoted from the owner's draft, not the identity of this app. HMAC/Scrypt algorithms, 10-minute single-use codes and rate limiting, public/crew clearance roles, strict CSP and zero tracking, offline clinical triage, instant erasure, team affiliation and legacy algorithms are not verified for this deployment. They are not current guarantees or NASA endorsement.
DATA PRIVACY & SECURITY CHARTER
PRIVACY POLICY & DATA CHARTER
ASTROVITAL NEXUS Ω · Astro-Club Kuwait · NASA Space Apps Challenge 2026
1. Zero Telemetry Collection on Public Accounts
When you register for a public account, ASTROVITAL collects only the necessary credential identifiers (username, email address, or international phone number) required to authenticate your access. Public accounts are never connected to real-time or simulated spacesuit biometric telemetry sensors.
2. Strict Role Segregation & Confidentiality
All public registrations are strictly isolated to the Ordinary User role. Crew-level telemetry, DTN packet custody streams, and astronaut medical records are restricted to authorized personnel. Telemetry clearance is never granted automatically or upon request through public sign-up forms.
3. Keyed HMAC-SHA256 & Cryptographic Scrypt Hashes
Authentication codes and verification tokens are protected using keyed HMAC-SHA256 secrets. Passwords are never stored in plaintext; they are hashed using Scrypt with cryptographically random per-user salts. Verification codes expire within 10 minutes and enforce single-use redemption with rate limiting.
4. Zero Third-Party Advertising & Tracking
ASTROVITAL operates zero third-party tracking scripts, external advertising cookies, or behavioral monitoring beacons. The application operates in strict compliance with Content Security Policy (CSP) headers that prohibit unauthorized third-party scripts.
5. Sovereign Dual-Mode Operations
In offline mode, all deterministic clinical triage rules and 3D visual computations run entirely on local browser hardware. No telemetry or authentication credentials are transmitted to external servers without an explicit user-initiated command.
6. Right to Erasure (Account Deletion)
Registered users retain the fundamental right to permanently delete their account and associated credentials at any time. When an erasure request is executed, credentials and active sessions are immediately and irreversibly purged from memory and storage.
7. Academic & Educational Purpose
ASTROVITAL is developed for the NASA Space Apps Challenge 2026 under the Kuwait Astro-Club team. All health simulations, Frost's mechanostat algorithms, and DTN relay scenarios are created for scientific and educational demonstration purposes.