Choose what you share
Astor’s collection methods serve different purposes. Review the material and consent choices for the tool you use; a permission for one tool does not enable another.
| Method | What is captured | Important limit |
|---|---|---|
| Written or visual feedback | Your description, selected location and reviewed capture | Mask or remove private content before confirming |
| Voice feedback | Spoken feedback, prepared observations and optional masked stills | Optional tab video stays local and is not uploaded automatically |
| Mission steps | Declared paths and generic actions, with the tester’s reported result | No entered field values; it is not visual video |
| Recorded Mission | Consented screen/audio and optional webcam media | Raw screen video is not automatically redacted |
| Live browser collection | Declared page/action timelines and reported outcomes | No DOM, visual video, page text or entered values |
| Server Live | Declared outcomes or normalized traffic aggregates | No personal IDs, arbitrary logs or request bodies |
Astor’s own website
Astor’s public website does not automatically start Live browser collection. You can still open feedback when you want to share it. Browser collection paused describes this separate website policy; retained activity remains available under its existing retention. Customer installations keep their own reviewed collection and permission settings.
Protect captures
Screenshots mask form fields and configured private elements before loading image resources for the capture. Recognizable identifiers in button labels are masked too; ordinary labels stay readable. A page marked entirely private cannot be captured, and a failed capture still lets you save written feedback. Always inspect the final image: custom page content can contain sensitive information. Remove captures that are not needed to explain the problem.
Automatically attached element text excludes private descendants and form fields, including when a larger surrounding element is selected. Recognizable email addresses, phone numbers, long hexadecimal identifiers and bearer tokens are masked in this text and in screenshots. Captured links omit credentials, query parameters and fragments. These checks are not a general detector for every name or secret: mark private areas and review the capture. Your own written feedback remains your original wording.
Avoid testing passwords, personal records or confidential messages in a recording. Browser device permission and the tester’s informed consent remain explicit steps.
Raw Mission playback uses an authenticated Astor request, with current access and recording state checked again during the private read. It exposes no storage link, starts only when requested and stops loading when its section closes. Successful analysis, discard or expiry removes playback availability; this does not recall a copy already received by an authorized person.
Private Mission uploads recheck current access and the recording state before accepting a delayed reply. A rejected segment enters cleanup; previously issued short-lived upload permissions and physical storage deletion have their own expiry/retry lifecycle. Rejecting a reply is not proof that an earlier upload permission was revoked at the storage provider.
Retention depends on the source
Private Voice sessions expire after seven days. Their private speech, captures and older retry copies are removed by scheduled cleanup, or immediately when discarded. Confirmed feedback retains relevant source speech and the chosen capture separately; minimal retry references contain no speech or capture. Unprocessed Mission recordings expire after 24 hours: their speech and screen samples become unavailable even before cleanup finishes. Pending analysis does not extend the deadline or revive expired material. Raw media enters cleanup after completed analysis; storage deletion can require retries. Mission steps and written results remain.
Live has configurable retention, defaulting to seven days. Retained material follows its expiry when collection is paused. Backups and hosting-provider logs have separate lifecycles.
Archive project performs recoverable archiving: saved feedback remains available for an authorized restoration. Archiving and stopping collection do not prove permanent erasure. Account data shared with another company, payment records and provider backups need separate handling. See project access and archiving.
Saved retry replies are retained data too. Archiving does not erase these copies.
Review collection for your website
Temporary identifiers and cookie-free collection are not guarantees of anonymity or a consent exemption. Decide your activation policy using your website’s requirements. This product guide does not establish legal compliance for every website.
For permission-based Live, connect the website permission callback to your consent manager's current choice. Refusal or withdrawal stops new browser collection and clears pending steps and temporary context. Server revocation prevents further accepted batches for that session once delivered. Previously accepted data follows retention and the applicable deletion process; withdrawal is not a promise that retained data or provider backups have already been erased.
Capacity admission does not grant permission: a blocked new journey starts no event upload or temporary session, while an acknowledged journey still requires website permission. Withdrawal clears its pending material and sends revocation even if new collection is limited.
Project and source access stay separate. Testers do not receive access to the project’s Live journeys, billing or administrative tools.
Security metadata
New app security counters use protected references. These references remain potentially personal data. Older counters and hosting logs can still contain identifying data.