What Hera knows about you

Who is responsible

Somebody has to be answerable for how your information is used here. That is who you write to if you want a copy of it, or want it gone.

The European Space Agency — ESA — is responsible for your information here. Inside ESA, the department this service comes from is called RES-I.

ESA has a data protection officer, and looking after all of this is their job. You can write to them at DPO@esa.int: for a copy of what is kept about you, to have something put right, or to have it deleted.

ESA has its own written rules about looking after people's information, and everything on this page is done under them. You can read them here: ESA's rules on personal data

What is kept about you

• Your sign-in details: your email address, your name, and when you last signed in.
• Each crew profile you make: its name, its badge photograph, the language it uses — and, only if you chose to say, an age, a country, and how much you already know about space.
• Anything a profile writes about itself, and how it asks Hera to talk to it.
• Every conversation: what you typed, and the written-down version of anything you said out loud.
• Not the pictures you send her. Hera sees a picture while you are talking about it; the picture itself stays on the device you sent it from, and we keep no copy.
• Roughly which large city is nearest to you, worked out from your internet connection. Never your address.

Hera is a computer program

Hera is not a person. She is a computer program, and the voice you hear is made by a computer as well — nobody is sitting at the other end listening. To answer you, she sends what you write or say to computers run by Microsoft, which work out a reply and send it back.

Before you say anything, Hera is told a few things about the profile you are using: its name, what it wrote about itself and how it asked to be talked to, and — only if you said one — which country it is from. She is told what day it is, too, and how long it has been since this profile last talked to her. That is so she knows who she is talking to, and it goes to those same computers along with your message.

Hera also keeps a short note about each profile — what you like being called, what you are interested in, how you like to be spoken to. She writes that note herself, from your conversations, so that she remembers you next time. You can read it: it is in the copy you can download from Settings. Deleting the profile deletes the note with it.

One thing ESA asks: don't type other people's private details into the chat — names, addresses, phone numbers. Hera does not need them, and everything you type is sent on to those computers.

The microphone, the camera, and where you are

Hera uses these only when you let her. Your browser asks you first, every time, and saying no is a perfectly good answer — she carries on without it.

• When you talk to Hera out loud, the sound goes to the computers that understand speech. The words are written down and kept with the conversation. The sound itself is not kept.
• If you ask Hera to take your picture, the photograph is shown to her so she can talk about what is in it. The photograph itself is not kept: it stays on the device you took it on, so on another device the conversation says only that a picture was sent. A badge photograph is different — that one is kept with its profile until you change it or delete the profile.
• If Hera asks where you are, your browser asks you first. The answer is rounded off so that it says only roughly which part of the world you are in, and it is not saved anywhere.

Why we are allowed to keep it

• Most of it is because telling the public about its missions is part of ESA's job, and Hera is one of the ways it does that. You also cannot have a conversation Hera remembers unless the conversation is written down somewhere.
• A little of it — counting messages, so that one visitor cannot use up everybody's turn — is to keep the service working and safe.
• The microphone, the camera and your location are used only when you say yes, and you can stop saying yes at any time.

Who else sees it

ESA, the people who run this service for ESA, and Microsoft, whose computers store the information and run Hera. ESA's own bodies can see it where their job requires it. Nobody buys it and nobody is sold it. There is no advertising here, and nothing follows you to other websites.

The information is stored on computers in Sweden. When Hera works out an answer, though, that work may happen on Microsoft computers in other countries, including outside Europe. Microsoft is under a contract that requires it to protect the information wherever that happens.

How long it is kept

A profile, its conversations and its badge photograph are kept for as long as the profile exists. Delete the profile and all of it goes — the conversations and Hera's note as well, not just the name. Delete the account and everything on it goes.

There is also a technical record of the website working: which page was asked for, how long it took, and whether something went wrong. It has no name, no message and no address in it — not even the number your internet connection uses. It is kept for 30 days and then it goes on its own. Deleting your profile does not remove it, because there is nothing in it that says it was you.

ESA's notice says the note Hera builds up about a profile is deleted when the account is closed, or after the account has been left alone for a long time. Closing the account does delete it today. The part about being left alone is not switched on yet — so if you want it gone, delete it yourself rather than waiting.

What you can ask for

These are things you are entitled to, not favours.

• A copy of everything kept about you. There is a button for it in Settings.
• Anything wrong about you put right.
• All of it deleted. There is a button for that in Settings too, and deleting one crew profile deletes that profile's share of it.
• That we stop using it, or that you object to our using it.
• A copy in a form you can take somewhere else. The file the button gives you is that form.
• If you think any of this is being done badly, you can complain about it. Complaints go to ESA's data protection supervisory authority, which is independent of the people who run this service. Write to DPO@esa.int and say that is what you want to do.

Write to DPO@esa.int and say what you want. You may be asked to show who you are first, so that nobody else can ask for your information.

If you are visiting without an account

A guest visit makes no account. The conversation is never listed and you cannot come back to it — not from another computer, and not from the same one.

A copy of it does stay on our side. Because a guest visit has no account attached, there is nothing to find it by, which means we cannot show it to you or delete it if you ask. That is the trade for talking to Hera without signing up. If you want a conversation you can keep, read and delete, make an account.

For grown-ups

Hera is made for children as well as adults, and crew profiles are usually children's. Only an adult can create an account.

When you add a crew profile for a child, you are the one agreeing to their information being used here, and you are the one who can read it or delete it — from the crew panel, or by deleting the whole account in Settings.

A guest visit needs no account and asks no age, so a child can reach Hera that way without an adult. If that matters to you, ask them to use a profile on your account instead.

What is stored in your browser

A few small things, and every one of them is either needed to make the site work or is something you chose: that you are signed in, which profile is in use, which language you picked, how big you like the text.

There is no advertising, no analytics, and nothing at all from any other company. That is why this site never asks you to accept cookies — there is nothing here to accept.