Privacy policy.

The data controller for this site is Gaby Oron, publishing as Astra Echoes. That means we decide what personal data this site collects and why. You can reach us any time at hello@astraechoes.co.uk.

What you give us. When you sign up for the newsletter or a free chapter, we collect the email address you enter, and — for the free-chapter form — your first name (and last name, if you choose to add it). We also record which book you told us you'd read, so we send the right chapter. We don't ask readers to create accounts, and we don't collect payment details on this site — purchases happen on the retailers' and shop's own platforms under their policies.

What your browser sends. Like any website, ours receives your IP addressand basic request details (browser type, the page you asked for, the time). We use the IP address to rate-limit the signup forms so they can't be abused to spam people; it is held in memory for a few minutes and never stored against your name or email. Our host records it in ordinary server logs.

What analytics collects — only if you accept.If you press Accept on the cookie bar, Google Analytics records which pages you visit, roughly where in the world you are, and what kind of device you're on. If you don't accept, none of this happens.

We use your details only to:

• → send the free chapter you requested;
• → send occasional updates — new releases, chapter drops, and cover reveals;
• → keep the signup forms from being abused;
• → understand, in aggregate, which stories readers find — if you've accepted analytics.

We label subscribers in our mailing list with simple tags — which free chapter you asked for, and which book you told us you'd read — so we can avoid spoiling you and avoid sending you something twice. That's the extent of it. We don't sell your data, we don't use it for advertising, and we don't build behavioural profiles or make automated decisions about you. Every email includes an unsubscribe link, and you can opt out at any time.

Under UK GDPR we rely on:

• →Consent — for the mailing list and the free chapter (the box you tick when you sign up), and for analytics cookies (the Accept button). You can withdraw consent whenever you like by unsubscribing, emailing us, or clearing this site's data; withdrawing it doesn't affect anything we sent or measured before you did.
• →Legitimate interests — for keeping the site up and secure: server logs and the IP-based rate limiting that stops the signup forms being used to spam people. We've weighed this against your privacy and kept it to the minimum that works.

We use a small number of providers to run the site and its mailing list. They act as our processors:

• →Mailchimp (Intuit) — stores the mailing list and manages subscriptions.
• →Resend — delivers the free-chapter email.
• →Railway — hosts the site and holds the ordinary server logs described above.
• →Google — provides the analytics described above, and only receives anything if you accept analytics cookies.
• →Behold — supplies the public Instagram feed shown on the author page, and serves those images to your browser.

Some of these may store data on servers outside the UK/EEA (typically the United States) under the safeguards their own privacy terms describe. We share only what's needed for each of them to do its job.

The site uses as few cookies as possible, and none for advertising or cross-site tracking:

• →Reading progress — a small cookie remembers how far into the saga you've told us you've read, so the site can hide spoilers. It holds no personal data.
• →Your cookie choice — whether you accepted or declined analytics is remembered in your browser's local storage, so we don't ask on every page.
• →Sign-in — a session cookie used only for the private author tools. It isn't set for ordinary readers.
• →Analytics — only if you accept them. We use Google Analytics to see which stories readers find and how they move through the site. These cookies are not set unless you press Accept on the cookie bar, and declining sets none at all. Google processes this data on our behalf and may store it outside the UK/EEA under the safeguards its privacy policy describes. To change your mind later, clear this site's data in your browser and the choice will be asked again.

The author page shows a feed of public Instagram posts, supplied by Behold. No third-party script runs on the page, but your browser does load those images from Behold's servers, which means they receive your IP address in the ordinary course of serving them. Links to Instagram, retailers, the shop, and social profiles lead to sites with their own policies.

This site's owner uses a self-hosted scheduling tool that connects, via the Meta Graph API, to the Astra Echoes Facebook Page and Instagram account (@astraechoes) only. It is used solely by the site owner to publish and manage posts on those two accounts — it does not collect, store, or process data belonging to any other Facebook or Instagram user.

To revoke this integration's access at any time, go to Facebook → Settings → Business Integrations (or Instagram → Settings → Apps and Websites) and remove the connected app. To request deletion of any data associated with this integration, contact hello@astraechoes.co.uk.

Some of our links to Amazon are affiliate links. They carry a tracking tag, so if you buy through one we may earn a small commission — at no extra cost to you. The price you pay is exactly the same either way, and we only ever link to our own books.

In privacy terms, this means following one of those links tells Amazon the visit came from this site. From that point Amazon is handling your data as its own controller — it may set cookies and record the visit under its privacy notice, not this one. We never learn who you are from this: we only ever see anonymous, aggregate sales reporting, never the names, addresses, or order details of individual buyers.

As an Amazon Associate we earn from qualifying purchases.

• →Mailing list — until you unsubscribe or ask us to remove you. Once you unsubscribe, your address is suppressed or deleted in the normal course of list maintenance.
• →Server logs — kept only as long as our host retains them, typically no more than 30 days.
• →Rate-limiting records — held in memory for minutes, then discarded.
• →Analytics — retained by Google for up to 14 months, if you accepted analytics cookies.

This site is written for adult readers and isn't directed at children. We don't knowingly collect data from anyone under 13. If you believe a child has signed up, email us and we'll delete the record.

Under UK GDPR you can ask us to:

• → see the data we hold about you;
• → correct it if it's wrong;
• → delete it, or withdraw your consent;
• → receive a copy of it in a portable form, or object to our legitimate-interests processing.

Email us at hello@astraechoes.co.uk and we'll sort it out — normally within a month. If you're in the UK and unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office (ICO).

If we change how we handle your data, we'll update this page and the date at the top. Material changes will be flagged to subscribers.

Questions about your data or this policy? Email hello@astraechoes.co.uk.