Privacy Policy

Version 1.0 · Published 12 October 2026 · Takes effect 12 October 2026

This policy covers the Aster ID services you sign in to: the Personal Data Server (PDS) and the Portal. For the marketing website itself, see the Website Privacy Policy.

Part 1: Introduction

1. Welcome

This Privacy Policy explains how Stichting Modal ("Modal", "we", "us", "our") processes personal data when you use:

the Aster ID Personal Data Server (PDS), our infrastructure for hosting your AT Protocol identity and the data associated with it;
the Aster ID Portal, the front-end at portal.aster.place for managing your Aster account.

Stichting Modal is a non-profit foundation established under the laws of the Netherlands, registered at Kranenburgweg 135 A, 2583 ER The Hague (RSIN 868779465). For the purposes of the EU General Data Protection Regulation (GDPR), Stichting Modal is the data controller for personal data processed in connection with the operation of all three services.

This Privacy Policy is the companion to our Terms of Service, which sit at the same URL family and govern your use of the same two services. The Privacy Policy explains what we do with personal data; the Terms of Service explain what the services are and how you use them.

2. What this Privacy Policy covers, and which Parts apply to you

This Privacy Policy is organized in three Parts, mirroring the structure of our Terms of Service.

Part 1 (this Part) introduces the document.

Part 2 sets the common rules that apply to all processing across our services: who we are, the rights you have, our security and breach posture, our retention principles, our position on selling and profiling, international transfers, and how to contact us.

Part 3 covers personal data processed in connection with the Aster ID PDS and the Aster Portal. It applies to you if you have an Aster ID account.

3. What this Privacy Policy does not cover

This Privacy Policy does not cover:

the Aster ID marketing website, mailing lists, and general communications: a separate Privacy Policy applies at https://aster.place/website-privacy;
the MOVE migration tool (also known as EU-HAUL) which is a separate Modal product with its own Terms of Service and Privacy Policy at https://move.eurosky.tech;
the processing carried out by other atproto applications and PDS providers that you may use through your Aster ID account, which are governed by their own privacy notices.

The Aster ID marketing-site Privacy Policy is kept separate from this document because the marketing site has different data flows (mailing list, newsletter, donor data) and a different lawful-basis profile. We point you to it explicitly so you know where to find it.

Part 2: Common rules

Applies to everyone using any of our services.

4. Who we are and how to reach us

Data controller: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands (RSIN 868779465).

Privacy contact: privacy@aster.place.

Data Protection Officer (DPO): we have designated a Data Protection Officer in line with Article 37 of the GDPR. You can contact our DPO at dpo@aster.place. Correspondence routed to that mailbox reaches the DPO directly.

Postal correspondence: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands.

You also have the right to lodge a complaint with your local supervisory authority. As we are established in the Netherlands, the lead supervisory authority for cross-border processing is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). If you live in another EU or EEA Member State, you can also complain to your own national authority.

5. The categories of personal data we process

Across our services we process the following broad categories of personal data. Part 3 below sets out the specifics for our PDS and Portal services.

Identity and account data: your AT Protocol handle, your account identifier (DID), your profile information, and the email and password you set during sign-up.
Age confirmation: for the Aster IDS PDS and Portal, the record that you self-declared you are 16 or over at sign-up, with the date and source of that confirmation.
Content you create or receive: posts, profile fields, photos, videos, lists, direct messages, and feedback you send us.
Social graph data: your follows, followers, likes, and other relationships expressed through your account.
OAuth grants and app authorizations: the list of third-party applications that you have authorized to act on your behalf via OAuth, the scopes you have granted them, and the timestamps of those grants.
Authentication metadata: sessions, last-login timestamps, login attempts, two-factor authentication setup where applicable, and email verification tokens.
Account recovery information: recovery email if different from sign-up email, recovery keys, and pending recovery actions.
Handle change history: if you change your handle, we keep a record of the previous handle for trust-and-safety, abuse-prevention, and federation reasons.
Service interaction data: the actions you take while using our services, including reports you submit, appeals you file, and interactions with our recommender feeds where applicable.
Account-state acknowledgements: records of your acceptance of these Terms, dismissal of in-product notices and banners, and similar acknowledgements needed to operate the services.
Technical and operational data: IP addresses (and the approximate geographic location they imply), user-agent strings, timestamps, server logs, OAuth flow state, and security and abuse-prevention signals.
Preferences and configuration: your settings within each service, such as language, theme, content filters, and feed selections.
Personal data we receive from third parties on your instruction: for example, when you migrate an account to us using a tool that transfers data on your behalf, or when an age-assurance vendor (where applicable, post-launch) returns a result of your age check.

We do not intentionally process special categories of personal data (Article 9 GDPR). We recognize that content you post may incidentally reveal such information, in which case our processing is limited to what is necessary to host and display the content you have chosen to make public, to apply moderation, and to comply with the law.

6. The lawful bases on which we rely

Under Article 6 of the GDPR, we rely on the following lawful bases. Part 3 below indicates which lawful basis applies to which specific processing.

Performance of a contract (Article 6(1)(b)) to provide the services you have asked us to provide and to take steps at your request before entering into the contract.
Legitimate interests (Article 6(1)(f)) to operate, secure, and improve our services, to detect and prevent abuse, and to inform you of changes that affect you, where those interests are not overridden by your fundamental rights and freedoms.
Legal obligation (Article 6(1)(c)) to comply with EU and Member State law, including the Digital Services Act, the Terrorist Content Online Regulation, tax and accounting law, and lawful orders from competent authorities.
Vital interests (Article 6(1)(d)) in rare cases involving an immediate threat to life or safety.
Consent (Article 6(1)(a)) where the law requires consent for a specific processing activity, for example certain forms of marketing communication. Where we rely on consent, you can withdraw it at any time and we will stop the processing that depended on it.

We do not rely on consent for the core operation of the services, because Article 6(1)(b) and (f) cover those activities. We may rely on consent for specific optional features.

7. What we will never do with your personal data

These are negative commitments that apply across all our services.

We will never sell your personal data. Not your account information, not your content, not your interaction data, not any other personal data we hold.
We will never profile you for advertising purposes. We do not build advertising profiles of you. We do not sell or share data that would let anyone else profile you for advertising.
We will not train general-purpose AI models on your content without your separate, opt-in consent. We may use automated systems (including AI-based systems) to detect spam, abuse, and prohibited content, as described in §23.

8. International transfers

Personal data processed in connection with our services is hosted and processed in the European Union. We are committed to using only hosting providers that are headquartered in the EU and that operate from data centres located in the EU for the primary services (the Aster ID PDS and the Aster ID Portal). The specific providers change from time to time; the current list, by category, is published on the providers page of our Transparency Centre at aster.place/transparency and updated when providers change.

In the course of operating, securing, and supporting our services, we may use ancillary tools and service providers (for example, for email delivery, error tracking, or operational support), some of which may be established outside the European Economic Area. Where personal data is transferred to a country outside the EEA as a result, we ensure that appropriate safeguards are in place in accordance with EU data protection law, including:

Standard Contractual Clauses approved by the European Commission;
adequacy decisions by the European Commission, where one exists for the destination country;
other measures permitted under Articles 46 to 49 of the GDPR.

The primary contents of your Aster ID PDS account are not transferred outside the European Union, except as a result of AT Protocol federation as described in §13.

9. Your rights under the GDPR

You have the following rights in relation to personal data we process about you. You can exercise them by writing to privacy@aster.place or by using the relevant in-product setting where available.

Access (Article 15): ask us for a copy of the personal data we process about you, and information about how we process it.
Rectification (Article 16): ask us to correct inaccurate or incomplete personal data.
Erasure (Article 17): ask us to delete personal data, in the circumstances set out in the GDPR.
Restriction of processing (Article 18): ask us to stop processing personal data for a period while we resolve a dispute about it.
Data portability (Article 20): ask us to provide personal data you have given to us in a structured, commonly used, machine-readable format, and to transmit it to another controller where technically feasible. The AT Protocol is built around portability; our Terms of Service §20 describes the migration mechanics.
Object (Article 21): object to processing carried out on the basis of legitimate interests; we will stop unless we can demonstrate compelling legitimate grounds that override your interests.
Withdraw consent (Article 7(3)) where processing depends on consent.
Not be subject to a solely automated decision (Article 22) that produces legal effects or similarly significantly affects you.

We aim to respond to requests within one month of receiving them. The GDPR allows us to extend this by two further months for complex or numerous requests; if we do, we will tell you why.

If we decline to act on your request, we will tell you why and inform you of your right to complain to your supervisory authority.

We may need to verify your identity before responding, particularly for access, erasure, and portability requests, to make sure we are not disclosing personal data to the wrong person.

10. Children and minors

Our minimum age depends on the service:

Aster ID PDS and Portal: 16 years old.

We do not knowingly process personal data of users below the applicable minimum age for the service they are using.

If we have reasonable grounds to believe a user is below the applicable minimum age, we will suspend access until age is confirmed and, failing confirmation, terminate the account or the relevant access and delete the personal data in accordance with §11.

For users aged 16 or 17 with an Aster ID account, we apply the same data-protection commitments as for adult users, and additionally do not present recommendations based on profiling of any user and do not target advertising of any kind (see §7 and Terms of Service §13).

At launch, age assurance is light-touch and differs by service.

For the Aster ID PDS and Portal, we rely on self-declaration: at sign-up, we ask you to confirm that you are 16 or over, and we record that confirmation.

We do not, at launch, use payment-card checks, government-ID verification, or any third-party age-assurance vendor for either service.

Where local law later requires us to apply specific age-assurance methods, we will introduce them over time, choosing the least intrusive method that meets the requirement. Methods we anticipate adopting may include verified payment-card checks and zero-knowledge proof of age via the EU Digital Identity system. We do not retain biometric data, ID documents, or images supplied to age-assurance vendors. We will not use facial age estimation.

If you are a parent or guardian and believe a person below the applicable minimum age has provided us with personal data, please contact privacy@aster.place and we will take prompt action to delete that data.

11. How long we keep personal data

We retain personal data only as long as necessary for the purposes for which it was collected, taking into account legal obligations, security, and your ability to use the services. The specific retention periods that apply to each service are set out in Part 3 below; the principles in this section apply across them all.

Account data is retained for as long as your account is active.
Technical and operational data, including server logs, IP addresses, and security signals, is retained for 30 days, unless a longer period is required for legal, security, or operational reasons (for example, to investigate a specific incident).
Backups are retained on a rolling basis as described in §12; deletion requests are honoured in the active systems and the data is purged from backups on the next rotation cycle.
Trust-and-safety records, including evidence relating to moderation actions and abuse investigations, are retained for as long as necessary to enforce these decisions, defend appeals, and meet our legal obligations under the DSA and applicable Member State law.
Records required by tax, accounting, and other legal obligations are retained for the periods required by the law that imposes the obligation (typically seven years for Dutch tax records under Article 52 AWR).

When the retention period ends, we delete or irreversibly anonymize the data.

12. Backups

We make regular backups of our infrastructure for resilience and disaster-recovery purposes. Backups are stored on EU infrastructure with the same hosting principles described in §8. Personal data persists in backups until the backup is rotated out; rotation runs on a defined cycle (typically no longer than 35 days). Erasure requests are honoured in the active systems immediately and the backup copies are purged on the next rotation.

13. AT Protocol federation: an important note

Our services run on the AT Protocol, an open, federated standard. This has practical consequences for your personal data that you should understand.

Public content is genuinely public. Posts, profile information, follows, likes, and similar records are designed to be readable by anyone on the network, including atproto operators we do not control.
Other operators may cache or store your content. Relays, AppViews, feed generators, and other atproto services may read, index, cache, and re-display your content. We cannot control them.
Deletion propagates but cannot be guaranteed network-wide. When you delete content from your Aster ID PDS, we publish deletion (tombstone) events on the protocol firehose. We honour the deletion in our systems and notify the network. We cannot force other operators to honour the deletion in theirs.

These are structural consequences of using an open protocol. They are part of the value (your account and content are portable, not locked into our infrastructure) and part of the cost (you cannot un-publish public content with absolute certainty).

14. Security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or destruction. Measures include encryption in transit (HTTPS for all connections), access controls on our internal systems, monitoring for unauthorized activity, and regular review of our infrastructure and procedures.

We do not claim our security is infallible. No service connected to the internet is.

15. Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (the Dutch Autoriteit Persoonsgegevens) without undue delay and, where feasible, no later than 72 hours after we become aware of the breach (Article 33 GDPR).

Where the breach is likely to result in a high risk to the rights and freedoms of affected users, we will also notify those users without undue delay, by the channels described in Terms of Service §16 (Article 34 GDPR).

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, our processing, or applicable law. The most recent version will always be published at this URL, with the date of the latest update at the top. Older versions, and a log of substantive changes, are kept in our Transparency Centre at aster.place/transparency.

Changes that get at least 30 days' advance notice. If we make a material change, we will tell you through the relevant service or by email at least 30 days before the change takes effect, unless the change is required immediately by law. A new version may also take effect for you earlier than its general effective date if you expressly accept it, for example when you first sign in to a new Aster ID Portal application that presents it to you. The following are always material:

processing a new category of personal data, or processing an existing category for a new purpose;
a change of lawful basis for an existing processing activity;
sharing personal data with a new category of recipient;
transfers of personal data to a third country not previously disclosed in this policy;
extending a retention period;
introducing an analytics or measurement tool that uses cookies or persistent identifiers requiring consent (in which case we will also ask for that consent rather than assume it);
any weakening of the commitments in §7. A change to §7 will always be announced prominently in-product, not only in this document.

Changes that take effect on publication. The following are not material, and we make them by publishing the updated text and recording them in the change log:

clarifications and rewording that do not change what we do;
swapping a provider within the same category, under the same safeguards and commitments, reflected on the providers page at aster.place/transparency;
updates to contact details, legal citations, or links;
new features that process only categories of data already described here, for purposes already described here.

Part 3: The Aster ID PDS and Portal

Applies to you if you have an Aster ID account.

17. About the Aster ID PDS and the Portal

The Aster ID Personal Data Server (PDS) provides identity hosting and personal data storage for the AT Protocol. It is infrastructure: it does not provide feeds, rank posts, or curate speech.

The Aster ID Portal is the front-end at portal.aster.place for managing your Aster ID account. It allows you to create or sign in to your account, view your profile information and the data stored under your account, discover compatible third-party AT Protocol applications, and (for selected apps) use sign-in facilitation. The Portal is currently in beta. The Portal is not an online platform: it does not host user content, operate feeds, recommend content, or curate speech.

The Portal's featured-apps directory is a form of editorial curation: we choose which third-party applications appear in the directory and may feature specific apps. We do this to help you find applications that work with your Aster ID account. The applications themselves are operated by independent third parties under their own terms and privacy policies, and we do not control them. Inclusion in the directory is not an endorsement or warranty; it indicates that the application is compatible with the AT Protocol and your Aster ID account.

Modal operates the PDS and the Portal together. Your Aster ID account is a single thing; the PDS is the data layer and the Portal is one of the surfaces you can manage it through.

18. Personal data processed by the Aster ID PDS

Depending on how you use the PDS, we may process the following categories of personal data:

account identifiers including your AT Protocol DID and your handle;
handle change history if you change your handle, kept for trust-and-safety and federation reasons;
profile information you choose to provide (display name, description, avatar, banner, links);
content you post, upload, or store via your PDS, including the post records, media blobs, and metadata associated with them;
social graph data including your follows, blocks, mutes, lists, and similar relationships;
OAuth and authentication state for sessions and access tokens used by applications you have authorized;
email and password you provide when creating an Aster ID account, used for account creation and recovery;
account recovery information, including recovery email if different from sign-up email and any recovery keys;
age confirmation that you self-declared you are 16 or over at PDS sign-up, with the date and the in-product surface where you declared it;
technical and operational data needed to operate the PDS, including IP addresses, timestamps, and server logs;
security and abuse-prevention signals.

We do not intentionally process special category data via the PDS.

Lawful bases. Performance of a contract (Article 6(1)(b)) for the core hosting service; legitimate interests (Article 6(1)(f)) for security, abuse prevention, and operations; legal obligation (Article 6(1)(c)) for compliance with EU and Member State law.

19. Personal data processed by the Aster ID Portal

The Portal is a front-end. Most of the data it shows you is fetched from your PDS on demand. The Portal itself processes:

OAuth flow state during sign-in, including the temporary parameters needed for the OAuth handshake. The Portal does not handle or store your password; passwords are submitted directly to the PDS.
OAuth access tokens that the Portal holds server-side only and uses to retrieve your profile information from your PDS. Tokens are not exposed to your browser or to third-party applications.
Profile data fetched from your PDS for display in your dashboard: handle, display name, avatar, post count, follower count, following count. Depending on how your PDS resolves the request, this fetch may also call an AT Protocol AppView (such as the Bluesky AppView, operated by Bluesky PBC in the United States). Only the minimum public data needed to populate the dashboard is involved; your OAuth token is never shared with an AppView.
Server-side account state for whether you have accepted the Terms of Service, whether you have dismissed the welcome banner, your login-session state, and the OAuth flow state described above.
The handle you share when using sign-in facilitation for selected third-party apps. Only your handle (and, where applicable, a marker identifying Aster ID as the referring service) is shared. The Portal does not share your OAuth access token, your email address, your password, or any other profile or account data with third-party apps through this feature.
Technical and operational data for the Portal's operation, including IP addresses, user-agent strings, timestamps, and server logs.

Cookies and local browser storage. The Portal uses:

a first-party session cookie to maintain your authenticated login session;
a theme key in your browser's local storage to remember whether you have selected light or dark mode;
a language key in your browser's local storage to remember your preferred language.

The Portal sets no third-party cookies, no tracking cookies, no advertising cookies, and no analytics cookies.

Lawful bases. Performance of a contract (Article 6(1)(b)) for the core Portal functionality; legitimate interests (Article 6(1)(f)) for security, abuse prevention, and operations; legal obligation (Article 6(1)(c)) for legal compliance.

20. Hosting, transfers, and retention for the PDS and Portal

Hosting. The PDS and the Portal are both hosted on cloud infrastructure provided by an EU-headquartered hosting provider, in data centres located within the European Union. The current provider is listed on the providers page at aster.place/transparency. We may change provider, but we will use only EU-headquartered providers operating EU data centres.

Transfers. As described in §8, the PDS and Portal do not transfer the primary contents of your account outside the European Union. The exceptions are AT Protocol federation (§13) and the Bluesky AppView call described in §19. Both are necessary consequences of operating on an open protocol.

Retention.

PDS account data (DID, handle, profile, content stored in your repository) is retained for as long as your account is active or deactivated. While an account is deactivated, the data stays in place but is not served on the network. Your handle is held for you for 30 days from the moment of deactivation; after 30 days of continuous deactivation, the handle is released. The account itself remains in its deactivated state until you reactivate, fully delete, or the additional retention period set out for deactivated accounts expires (see §21.3 of the Terms of Service).
Technical and operational data for the PDS and the Portal (server logs, IP addresses, security signals) is retained for 30 days unless a longer period is required for legal, security, or operational purposes.
OAuth tokens and login-session state are retained server-side for the duration of your session, and are deleted or invalidated when your session ends.
Server-side acknowledgements (Terms of Service acceptance, welcome-banner dismissal) are retained for as long as your Aster ID account exists.
Age-confirmation records are retained for as long as your account exists and as required by applicable law (for example, to demonstrate compliance with minimum-age obligations if challenged by a supervisory authority).

If you delete your account or migrate to another provider, we handle your data in accordance with the AT Protocol and applicable law. Certain limited data may be retained where required for legal, security, or operational purposes, as described in §11.

21. PDS-layer moderation and data flows

The Aster ID PDS is infrastructure, not a curation platform. We do not proactively monitor, rank, or curate content. We do not use third-party moderation services at the PDS layer. Moderation at the PDS layer is legal compliance only: we act on lawful notices we receive and where we are legally required to do so.

The notices we act on include:

notices submitted under the EU Digital Services Act (Article 16), including notices from any natural or legal person;
removal orders under Regulation (EU) 2021/784 on terrorist content;
notices submitted by trusted flaggers under Article 22 of the DSA, which we process with priority;
notices from Bluesky Social, PBC about illegal content that Bluesky detects in federated data on the AT Protocol firehose (which Bluesky's infrastructure ingests as a normal part of operating on the network);
court orders and lawful orders from competent EU and Member State authorities;
and other clearly unlawful content where we are legally required to act.

We treat all sources as notices to be assessed against the law. We are the controller of the decision to act or not act on PDS-layer data; the source of the notice does not determine the outcome.

Lawful basis for PDS-layer moderation processing: legal obligation (Article 6(1)(c)) and legitimate interests (Article 6(1)(f)) for protecting users and the integrity of our services.

Contact

For all privacy-related questions: privacy@aster.place.

For Data Protection Officer correspondence: dpo@aster.place.

For data subject access, rectification, erasure, restriction, portability, and objection requests: privacy@aster.place. You can also use the in-product settings for the relevant service where available.

For postal correspondence: Stichting Modal, Kranenburgweg 135 A, 2583 ER The Hague, Netherlands.

To lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. You can also complain to your own national supervisory authority if you live in another EU or EEA Member State.

← Back to Aster ID