Ad Astra Computing, Inc. is a technology lab building software products, including Dispatch (AI coding agent orchestration), tulpa (an agentic network for professional relationships), INK (an open protocol for inter-agent messaging), Vega (a verified Nix binary cache), Receipts of Thought (an open format and browser verifier for evidence of how a piece of writing was made), Vulnpatch CVE (agent-first vulnerability data with an auditable trail from CVE to evidence), AER (the flight recorder for AI agents) and AHD (a guardrail and evaluation layer for AI-generated design). Selectively, we take on consulting engagements in fintech, healthcare, information security and education.
This corporate website does not use cookies, tracking pixels, advertising or behavioral tracking. We do not collect personal data from normal page views.
We do load Cloudflare Web Analytics on this site. It is a cookie-free, fingerprint-free, sampling-based analytics service operated by Cloudflare and run from static.cloudflareinsights.com. As implemented, it does not use cookies, does not store end-user IP addresses, and does not build cross-site user profiles. We use it only to count aggregate page views and basic load performance so we know whether the site is working; we do not see individual visitor identities through it. Compliance with any specific regulation (GDPR, CCPA, etc.) is determined by Cloudflare's terms with us and their published behavior, both of which can change; we link Cloudflare's policy from /subprocessors.
If you contact us by email or through our agent endpoints (see below), we use the information you provide solely to respond to your inquiry. We do not sell or share it with third parties for marketing.
We operate a public Model Context Protocol (MCP) server at mcp.adastracomputing.com so that AI agents acting on behalf of a person can submit a structured contact intent: a demo request, consulting inquiry, partnership inquiry, press inquiry or research collaboration request. The agent supplies the submitter's name, email, message, optionally a company, and an explicit contactConsent flag asserting that the submitter authorized the message.
For each accepted submission we:
The endpoint is rate-limited per (hashed) IP. Rejected submissions are not stored.
We also operate a public INK endpoint at the same host. INK is an open inter-agent messaging protocol; through it another party's AI agent can send us a verified first-contact message, such as a connection, introduction or question request. The sending agent is identified by a cryptographic decentralized identifier (DID) and signs the message, so its origin is verifiable. Any human contact details carried in the message, such as a name, headline or email, are asserted by the sender and are not verified by us. For each verified message we forward its content and those asserted details to an Ad Astra mailbox so a person can follow up, and we record the sender's DID, the message intent and the outcome, together with a one-way hash of the source IP. We do not store the raw IP. The endpoint is rate-limited per source IP and per sender DID, and rejected messages are not stored. It accepts both cleartext and encrypted envelopes. For encrypted submissions, we publish an X25519 encryption key in the Agent Card and use it together with AES-256-GCM to decrypt before verifying the signature; the cleartext is then handled identically to a cleartext submission. The forwarded mailbox notification is sent via our transactional email provider in plaintext.
If an AI agent submits a contact intent on your behalf, the agent must set the contactConsent flag to true, which is the agent's assertion that you authorized the message. We rely on that assertion. If an agent submitted without your authorization, email [email protected] with the receipt your agent surfaced to you and we will delete the inbox copy and ignore the submission.
We use a small number of third-party providers to deliver this site and the agent endpoints: a content-delivery and edge-compute platform, a transactional email service, a hosted inbox, and the cookie-free Cloudflare Web Analytics service described under "What We Collect". The current vendor list, with names and regions, is published at /subprocessors and revised when the set changes.
We do not use advertising or behavioral-tracking services on this site.
The Ad Astra products that operate their own hosted services publish separate privacy policies that take precedence over this general policy for product-specific data handling. Where no separate policy is linked, this policy applies.
The Receipts of Thought verifier at receiptsofthought.com is a static page with no accounts and no server side. A receipt you check is read in your browser and never uploaded, and while it verifies, the page is forbidden from making any network request by its own content security policy, so there is nothing for us to collect and no policy of ours you have to take on trust. INK is distributed under the Apache 2.0 license. AHD is distributed under the Functional Source License v1.1 (FSL-1.1-Apache-2.0), which converts to Apache 2.0 two years after each release. Neither project collects data of its own; use is governed by the respective license under which you obtain it.
Page-view analytics: aggregate counts only, handled by Cloudflare Web Analytics. We do not receive individual visitor identities and do not store page-view records ourselves.
Email correspondence and the contents of agent intent submissions: retained in our inbox only as long as necessary to address the inquiry and any reasonable follow-up. Archived correspondence is deleted on request.
Audit records from the agent endpoints: retained while the endpoints are in operation. They hold hashed IP addresses and, for INK messages, the sender's agent DID with the message intent and outcome. Where a human replies to an agent, we also keep our own outbound reply text, drafted and final, to tune future drafts.
We describe these as pseudonymous rather than anonymous, which is the accurate word. The IP hashes are SHA-256 with a fixed prefix and no secret key, so anyone holding the table could confirm a guess at a specific address by hashing it, even though they could not read an address out of it. A did:web identifier names a domain, and a domain can belong to one person. Our own reply text can quote something a person told us. So although the table holds no names, no addresses and no message bodies from inbound senders, treat it as capable of being linked to a person rather than as data about nobody. If that concerns you, write to us and we will remove your records.
If you have previously contacted us (by email or via an agent endpoint) and wish to have your inbox correspondence deleted, email [email protected] and we will process your request within 30 days. If you submitted via the agent endpoint, including the signed receipt your agent issued makes verification immediate.
We may update this policy from time to time. Changes will be posted on this page with an updated date.
Questions about this policy: [email protected]