Privacy Policy

1. What Information We Collect

We collect only the minimum information required to create and maintain your account:

• Email address — Used for account creation, verification, and account management. Never shared or sold.
• GST-ID — Your unique account identifier, auto-generated. Not tied to your real identity unless you choose to verify. This is an identifier, not an authentication credential.
• Authentication information — Your password and related security data are stored using industry-standard protections. We do not have a way to recover a lost password on your behalf without your registered email access.
• Entitlement and subscription information — Records of your account's introductory or paid access status. When paid subscriptions become available, payment information will be processed by a third-party payment provider, and this policy will be updated to name that provider specifically.
• Device abuse-prevention signal — An opaque, client-generated value used only to flag potential abuse patterns for review. This signal never blocks registration by itself and cannot be used to identify you personally.
• IP address — Used at the time of registration for rate-limiting and abuse-prevention purposes.

2. Communication Content vs. Account Information

We do not require the following for account creation, and do not use it for advertising or profiling:

• Your real name (registration does not require it)
• Your phone number (not required — your GST-ID is separate from any phone number)
• Your contact lists or address book
• Biometric data
• Advertising identifiers or social media connections

3. How We Use Information

The limited information we collect is used exclusively for:

• Sending you your GST-ID upon registration
• Managing your account and entitlement status
• Sending account-related notifications (entitlement status, security alerts)
• Preventing fraud and abuse of the registration and entitlement system
• Responding to support requests you initiate

We do not use your information for advertising, profiling, behavioral analysis, or any purpose beyond operating the service.

4. Does GSTNet Use Servers?

The important distinction is this: using backend infrastructure does not mean Global Space Technology possesses the cryptographic keys required to decrypt protected end-to-end encrypted communication content. Specifically:

• Protected message content is encrypted on your device before it is sent
• Global Space Technology does not hold the keys needed to decrypt that content
• The only data stored on our infrastructure is account information (email, GST-ID, entitlement status) — not the content of your communications

Encryption keys are generated on your device for each session. This supports Perfect Forward Secrecy (PFS): if one session's key were ever compromised, other sessions remain protected.

5. Information Sharing

We do not sell your personal information. We do not share your personal information with advertisers, data brokers, marketing companies, or any third party for commercial purposes.

The only third party who may currently receive limited information is:

• Supabase — Database provider storing account information (email, GST-ID, entitlement status only). Data is stored encrypted at rest.

When paid subscriptions become available, a payment provider will be added here by name, along with what information they receive.

We may disclose information if required by law enforcement under a valid legal order, but only account information (email, GST-ID) — never protected communication content, which we cannot decrypt.

6. Security

We take security seriously:

• Communication content is protected using AES-256-GCM encryption
• Key exchange uses ECDH-P-256
• Perfect Forward Secrecy (PFS) on all sessions
• Account data stored encrypted at rest
• All web connections use HTTPS/TLS 1.3
• Row-Level Security (RLS) on all database tables
• Regular security audits

Despite these measures, no security system is perfect. We encourage users to use strong unique passwords and enable additional verification.

6a. Account Recovery Limitations

Because Global Space Technology does not possess the cryptographic keys required to decrypt protected communication content, we are not able to bypass encryption to help recover lost data. We also will not bypass account security controls solely because a person claims ownership of a GST-ID or account — this protects you from account takeover, but it means you are responsible for maintaining access to your registered email and credentials.

We strongly recommend using a password manager and keeping your registered email account secure and accessible.

7. Data Retention

• Account information — Retained while your account is active. Deleted within 30 days of account deletion request.
• Security and abuse-prevention logs — Retained for the period necessary to serve their security purpose.
• Payment records — Not yet applicable; will be added when paid subscriptions are available.
• Communication content — Not retained. Global Space Technology does not possess the cryptographic keys to access it.

To delete your account, email info@globalspacetechnology.com with subject "Account Deletion Request" and your GST-ID.

8. Your Rights

Regardless of where you live, you have the right to:

• Access — Request a copy of the account data we hold about you
• Correction — Request correction of inaccurate data
• Deletion — Request deletion of your account and all associated data
• Portability — Receive your data in a portable format
• Objection — Object to any processing of your data

EU/EEA users have additional rights under GDPR. California users have rights under CCPA. To exercise any right, contact info@globalspacetechnology.com.

9. Children's Privacy

GSTNet is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us immediately and we will delete it.

10. Contact Us

For all privacy-related questions, requests, or concerns:

This privacy policy was last updated September 7, 2026. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.