Privacy Policy
Effective Date: September 7, 2026
1. Who We Are
Human Spaceflight Analog Connect is operated by Fort Hill Group LLC, doing business as Interstellar Performance Labs, which is the data controller for the personal data described here. References to "we", "us", or "our" in this policy mean Fort Hill Group LLC, doing business as Interstellar Performance Labs.
Human Spaceflight Analog Connect is a private mission log for analog astronauts. In plain terms: what you record is visible to you and to our small administrator team, and to nobody else unless you explicitly choose to be listed on the public Analog Astronauts roster (section 5).
Postal address: 470 L'Enfant Plaza SW, Washington, DC 20024, United States.
For data protection enquiries, contact us at: astro@forthillgroup.com.
2. What Data We Collect
We collect personal data in the following categories:
Account & Identity Data
- First and last name, email address, and password (stored only as a hash by Firebase Authentication)
- Country of residence
- Profile photo (uploaded by you, or the photo attached to your Google account if you sign in with Google)
- Your mailing list preference (off by default)
- The date and version of the Terms and this policy you accepted
- Whether our team has reviewed your log, and which entries we have verified
Mission Log Data
- Personal statement, education history, work experience
- Past analog missions, certifications
- Uploaded documents (CVs, certificates, etc.)
- Qualifications and aspirations
- Two optional consents: whether we may contact you about missions, and whether you want to be listed on the public Analog Astronauts roster
Technical Data
- Standard server logs kept by our hosting provider (Google Firebase App Hosting): IP address, browser user agent, requested page, and timestamp. We use these only for security and troubleshooting.
- Authentication session data managed by Firebase Authentication
We do not run analytics, advertising, or tracking software, and we do not build usage profiles.
Communications Data
- Any messages you send us directly
3. How We Use Your Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Create and manage your account | Contract performance |
| Authenticate your identity and secure your account | Contract performance / Legitimate interest |
| Allow our administrators to review your mission log when crewing analog missions | Legitimate interest |
| Contact you about mission opportunities if you have opted in | Consent |
| Show you on the public Analog Astronauts roster if you have opted in | Consent |
| Produce an AI-generated summary of a log for our team when crewing a mission | Legitimate interest |
| Send service-related emails (password reset, account updates) | Contract performance |
| Send marketing emails if you subscribed to our mailing list | Consent |
| Improve and secure the platform | Legitimate interest |
| Comply with legal obligations | Legal obligation |
4. What Other People Can See
- Other members: nothing. There is no member directory, no profile pages, and no messaging.
- Our administrators: your whole mission log, so they can review entries, verify them, and crew missions.
- The public: only what appears on the Analog Astronauts roster, and only if you opted in (section 5). Habitat pages and the Missions board contain no member data.
5. Public Analog Astronauts Roster
The roster is an opt-in public page. If you tick "list me on the public Analog Astronauts roster" in your profile and our team validates your missions, we may publish a roster entry containing your name, photo, country, a short bio and headline, and your validated mission history (mission name, habitat, role, year). Documents, contact details, education, and employment history are never published.
You can withdraw at any time by unticking the box in your profile. Your entry is removed from the roster immediately, and it is also removed if you delete your account.
6. Data Sharing & Disclosure
We do not sell your personal data. We share your data only in the following circumstances:
Service Providers (Processors)
- Google Firebase and Google Cloud (Google LLC) — authentication, database, file storage, and hosting. Data may be processed in the United States. Google is certified under the EU-US Data Privacy Framework.
- Google Gemini API — when an administrator asks for an AI summary of a log, the text of that log and the mission criteria are sent to Google's Gemini API and a summary is returned. Only administrators can trigger this, and only for the log they are reviewing. We use the paid tier of the API, under which Google does not use submitted content to train its models. See Google's Privacy Policy.
Fonts and images are served from our own servers. No other third party receives your data when you use the site.
Legal Requirements
We may disclose your data if required by law, court order, or to protect the rights, safety, and property of our users or the public.
7. International Transfers
Our services are hosted on Google Cloud infrastructure, which may process data in the United States and other countries. When we transfer data from the European Economic Area (EEA) or the UK, we rely on:
- Google LLC's participation in the EU-US Data Privacy Framework
- Standard Contractual Clauses (SCCs) where applicable
Canadian users' data is handled in accordance with PIPEDA and applicable provincial privacy legislation.
8. Your Rights
Depending on your jurisdiction, you may have the following rights:
| Right | Who It Applies To |
|---|---|
| Access — request a copy of your personal data | EEA, UK, Canada, California (CCPA) |
| Correction — request we correct inaccurate data | EEA, UK, Canada, California |
| Deletion / Right to be Forgotten | EEA, UK, California (CCPA) |
| Restrict or object to processing | EEA, UK |
| Data portability — receive your data in a structured format | EEA, UK |
| Withdraw consent at any time (without affecting prior processing) | All users |
| Opt out of sale of personal information | California (CCPA) — note: we do not sell data |
| Lodge a complaint with a supervisory authority | EEA, UK, Canada |
You can do most of this yourself. In Account & data inside the app you can download a copy of everything we hold about you (as JSON) and permanently delete your account and all of its data. You can correct anything in your log at any time from your profile, and withdraw either consent by unticking it.
For anything else, email astro@forthillgroup.com. We will respond within 30 days (or sooner as required by applicable law).
9. Data Retention
- Your account, mission log, uploaded files, verifications, and any roster entry are kept while your account is active and deleted when you delete your account (or ask us to). Copies may persist in provider backups for up to 30 days.
- Server logs are retained by our hosting provider for up to 12 months.
- We may keep a minimal record (for example, that a request was fulfilled) where the law requires it.
10. Security
We use industry-standard security measures including encrypted data transmission (TLS), Firebase security rules to enforce access controls, and hashed passwords. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security.
11. Children's Privacy
Human Spaceflight Analog Connect is not directed to children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe a minor has submitted data to us, contact us at astro@forthillgroup.com and we will delete it promptly.
12. Cookies
We use essential cookies and browser storage to keep you logged in and remember your session. See our Cookie Policy for full details.
13. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the Effective Date at the top and, for material changes, notify you by email or a prominent notice in the app. Continued use of the platform after changes constitutes acceptance of the updated policy.
14. Contact Us
Fort Hill Group LLC, doing business as Interstellar Performance Labs
470 L'Enfant Plaza SW, Washington, DC 20024, United States
Email: astro@forthillgroup.com
If you are in the EEA and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Ireland, this is the Data Protection Commission. In the UK, the Information Commissioner's Office (ICO).