celestual. sign in

Privacy

last updated 27 september 2026

celestual is built to hold as little as possible about who you are interested in, and to show it to nobody. A private note is matched on a salted one way hash of the handle it is to, it is shown to nobody but you unless it turns out to be mutual, and a note that is not mutual is deleted a week after its reveal.

This page is Celestual LLC's privacy policy, and it covers celestual.us, the wall on it, and paying for pings. It is the whole of what we hold.

01 What we hold

your handle
In plain text, once you have proved it with the code you send our Instagram account. Private notes, the reveal, and removing letters about you all run on it.
who you sent a note to
Twice. As a salted one way hash, which is what matching, the opt out list and the rate limits run on, and as the handle itself, kept beside the hash so that your own notes come back to you on another device. No screen, ours included, shows that handle to anybody but you, and it is deleted with the note.
your note
The words you send with a private note, up to 280 characters. They are sealed unless the note turns out to be mutual, and if it lapses they are deleted with it a week later.
an email address
If you leave one with a note, or confirm one for alerts, so we can tell you it is mutual, that a note is coming up on its reveal, or, if you turn it on, that somebody wrote you a letter. It is optional.
a sign in address
The address you sign in with by a mailed link, and when you first confirmed it.
a Google account
If you sign in with Google, the email address Google gives us, an identifier for that account, and when you first used it.
a school address
A school address you confirmed, the school it opens, and when. It lets you reply under letters and, at Berkeley, post as a student. Nobody reading the wall ever sees it. The people who run the desk can, when they review something you wrote.
what you wrote
A letter, the handle or name it is written to, its greeting and its look, the record of the screening it passed, and who wrote it: the account or the device it came from. Who wrote it is never shown to anybody reading, including the person it is to.
a reply
A reply, the letter it is under, whether it came from the person the letter is to, the record of its screening, and who wrote it, which is never shown to anybody reading. Readers see a small creature and a one word name made from a salted hash of the letter and the writer, so it is different under every letter. We also keep that you accepted the terms for replying, and when.
a heart, and a like
One record for each person who hearted a letter or liked a reply, so nobody counts twice. Every read answers with the count, and nothing anywhere returns who.
alerts
Which alerts you have on, and a record of each alert mail queued or sent. The links in a mail are stored only as hashes.
a mailed link
A hash of the link and a hash of the browser that asked for it. A school link also holds the letter waiting on it, or which letter a reply is waiting under, until the link is used or runs out.
a stop
An email address that pressed stop on a kind of mail, so that nothing of that kind is sent to it again until its owner turns it back on.
a session
Only the hash of a token your browser makes. The token stays on your device and travels with each request, so reading that table does not let anybody sign in as you. A device that hearts, likes or writes without signing in is given one too, with nothing else attached.
pings
How many bought pings you hold. For each note, which reveal its ping was spent in and whether it was the free one or a bought one, kept against the same salted hash the note is matched on, never a name.
a purchase
One record each time you buy pings: its own id, how many pings, the amount and the currency, whether it is waiting, paid, refunded or void, when it was made, paid and refunded, Stripe's ids for the checkout, the payment and, where Stripe makes one, the customer, and the handle the pings were bought for. Never a card number. Stripe takes the card on its own page, and it never reaches us.
operational records
Timestamps, rate limit counters, the IP address a request came from, the record of a screening, a report or a takedown, and the id of each notice Stripe sends us about a payment.
a bar
If a handle is taken off, the salted hash of it, so the refusal holds. It contains nothing else.

02 What nobody is shown

Some of this is how the service is built, and some of it is a promise. How it is built comes first.

And the promises:

03 How long it lasts

a private note
Until its reveal: Saturday at 9pm California time, the first one at least a day after it was sent. If it is not mutual it lapses that night, stays listed to you for seven more days so that you can send it again, and then it is deleted outright, words, handle and all. You can keep one for the following week, one week ahead at a time. Letting one go deletes it the same day.
a mutual
A pair is sealed from the moment the second note is sent until the next reveal, and both people are told that night. From then, while both people hold it. It goes when either of them takes their handle off.
bought pings
They never lapse. They stay until you spend them, until a refund or a chargeback takes them back, or until the handle they were bought for is taken off.
a purchase
As long as tax and accounting law require us to keep a record of a payment. When a handle is taken off, the handle is removed from its purchases and the rest of each record stays.
a letter
Thirty days on the wall, and sooner if it is reported, if the person it is to removes it, or if they take their handle off. A letter that came down, or ran its thirty days, is held out of sight rather than shown, so that a decision can be looked at again. It is deleted when its writer's account is.
a reply
As long as the letter it is under is kept. A reply that was refused or taken down is held out of sight, for the desk. It is deleted with the letter, or when its writer's account is.
a mailed link
Thirty minutes, and it works once. A letter waiting on a school link is let go when the link is used or runs out. The code you send our Instagram account lasts until you send it or it lapses, and all it does is tie one message to one browser.
alert mail
The record of a mail that was sent, or failed, is kept sixty days. The link in it that removes a letter lasts thirty days, and the link that stops a kind of mail lasts a year.
a session
A year, and the year starts again each time it is used. Signing out drops the token from your device. Its hash stays until the year runs out, and is then deleted.
rate limit records
About two hours for sending notes, and two days for looking handles up, which is the window each exists to enforce.
a bar
Kept, as a hash. A permanent refusal we forget is not permanent.
backups
Deleted rows can sit in an encrypted backup for a short period before it is overwritten. Nothing is restored from one except to recover the service.

04 Why we hold it

Each of the things in section 1 is there for one of five reasons: to run the service you asked for, to keep it from being turned against somebody, to keep it secure and working, because you handed it to us and can take it back, or because the law makes us keep it. If you are in the United Kingdom or the European Union, those are contract, legitimate interests, legitimate interests, consent, and legal obligation, in that order. Consent is withdrawn by taking the address off or by writing to us. The record of a purchase is the last of these: tax and accounting law is why it outlives the handle that made it.

05 Looking a handle up

When you type a handle we look up that account's public profile so you can check you have the right person: the display name, the badge, and the picture. The lookup runs through Apify, a third party service, and it happens whether or not that account has ever touched celestual.

We keep the name, the badge and a copy of the picture on our own storage, so a screen keeps working and the same account is not looked up twice. The wall shows them beside a name that carries letters, and a letter to a handle can open with the first name on its profile. It is public profile information and nothing else. Looking a handle up proves nothing about who is holding a browser and it never signs anybody in.

When a lookup reaches Apify we also note which handle it was and the account, device or address it came from, and keep that for two days, because it is what the limits on looking handles up count. Write to us if you want a cached profile dropped.

06 Who else handles it

Each of these handles data to do a job for us, under a contract that says so. Stripe and Google also hold what you give them directly under their own privacy policies.

We do not sell personal information, and we do not share it for cross context behavioural advertising, in the sense California gives those words. We have not done either in the past twelve months, and we do not plan to. There is no advertising on celestual and no third party analytics anywhere on it.

07 What we send you

Every alert mail carries a link that stops that kind of mail. There is no newsletter and no marketing mail. Every message above is about something you did or asked for.

08 Cookies, and your device

One cookie, and it is not a tracker: a random identifier the server sets so that a handle lookup can be rate limited without an account. It carries nothing about you.

Your browser also keeps some things itself: the handles you sent notes to, a letter you have not put up yet, which letters you have opened, and the token that keeps you signed in. Which letters you opened stays on your device, and so does the draft, unless a school link carries it to the browser that opens the link. The token travels with each request, and we store only its hash. Clearing your browser storage clears all of it from your device. There is no analytics cookie, no advertising cookie, and no third party tag on this site.

Stripe's payment page is on Stripe's own site, not ours, and Stripe sets its own cookies there under its own policy.

09 Your controls

the way out

Take a handle off permanently, whether or not it has ever been used here. One direct message from the account proves it is yours, and there is no account to make.

take a handle off celestual.us/optout

That is the deletion path as well, and it is one act across the whole product: it bars the handle, erases everything that referenced it, and takes every letter about it off the wall. The deletion page says exactly what goes and what does not, including what happens to pings you bought.

You can also write to contact@celestual.app and ask what we hold about you, under a handle or an email address, ask us to correct it, ask for a copy in a portable file, or ask us to delete it. We answer within thirty days, and asking costs you nothing and changes nothing about how the service treats you. If we say no, you can appeal by replying to that answer. We check that a request comes from the person it is about the way the product does: with one direct message from the account for a handle, and with a reply from the address for an email address.

Bought pings you have not used can be refunded if you ask within fourteen days of buying them. The terms say how.

Depending on where you live, those rights may come from California, Colorado, Connecticut, Virginia or Utah law, or from the United Kingdom and European Union rules, and you may complain to your own regulator. Since celestual does not sell personal information and carries no advertising, there is no sale or targeted advertising for a browser signal such as Global Privacy Control to switch off.

10 How it is kept

The browser cannot read any table in the database. Every path into the data is a small server function that hands back only what that caller may see: the letters on the wall without their writers, your own notes, and somebody else's note only once it is mutual with yours. Matching runs on salted hashes, links and codes are stored only as hashes, sessions are stored only as hashes, a card number never reaches us, and traffic is encrypted in transit. Production access belongs to the people who run the company and to nobody else. No system is perfect and we will not pretend this one is.

11 When the law asks

A valid legal demand can require us to hand over what we hold, and section 1 is that list. We will tell you when it happens unless we are forbidden to. What we cannot hand over is what is no longer here, and we keep little on purpose: a note that is not mutual is deleted a week after its reveal, a note you let go is deleted the same day, and a card number never reaches us at all.

12 Where it is

celestual runs on servers in the United States. If you use it from somewhere else, what you send comes here and is handled under United States law, which may protect it differently from your own.

13 For adults

celestual is for people 18 and older. We do not knowingly collect anything from anybody under 18, and we delete it if we learn that we have. If you believe a child's information is here, write to us and we will act on it.

14 Changes, and contact

The date at the top moves when this page does, and that date is what it is for. Where a change is material we will say so on the site before it takes effect.

Celestual LLC, 8 The Green, Dover, Delaware 19901. contact@celestual.app.