Privacy Policy

1. What We Collect

Account data: your email address (stored encrypted), a password hash (never the password itself), your interface language, and the 18+ confirmation and Terms acceptance recorded at sign-up.

Birth profile: date, time, time zone, latitude, longitude, city, and country. This is stored encrypted with AES-256-GCM.

Usage data: which readings you requested, the category and personality layer, generation status and timing, and your subscription and payment status. We never store full card numbers.

2. Why We Use It

To calculate your chart and generate your reading; to enforce free-preview and usage limits; to bill and manage subscriptions; to send transactional email such as verification and reading-ready notices; to run safety review of flagged content; and to comply with legal obligations.

We do not use your birth data or reading content for advertising, and we do not build advertising profiles about you.

3. How We Protect It

Your email address and birth profile are encrypted at rest with AES-256-GCM using a key held in the application environment. Passwords are hashed with bcrypt. Session cookies are httpOnly and not readable by JavaScript.

No system is perfectly secure. We cannot guarantee absolute security, but we limit access to production data to those who need it to operate the Service.

4. When We Share It

Model provider: to generate your reading, the birth details you supplied and your question are included in the prompt sent to our large-language-model provider. Your email address is not included.

Payment processor: to charge you, manage subscriptions, and process refunds.

Email provider: to deliver transactional email such as verification links and reading-ready notices.

Authorities: where we are legally required to disclose, or where disclosure is necessary to protect someone's safety.

5. What We Do Not Do

We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.

6. Your Rights

You may request access to, correction of, export of, or deletion of your personal data. Account deletion is available in your account settings and removes your birth profile and readings.

Requests sent to the contact address below are handled within 30 days. If you are in California (CCPA/CPRA) or the EEA/UK (GDPR) you may have additional rights, including the right not to be discriminated against for exercising them.

7. Retention

Account data and readings are retained while your account is open. After deletion, personal data is removed promptly. Limited records, such as payment records required for tax or accounting, may be retained where the law requires it.

8. Cookies and Local Storage

We use an essential httpOnly session cookie to keep you signed in, a cookie that remembers your language preference, and browser local storage for in-progress form drafts. We do not use advertising or cross-site tracking cookies.

9. Children

The Service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

10. International Transfers

We and our processors may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards for such transfers.

11. Changes

We may update this policy. When we do, we increase the version number shown on this page. Material changes are presented to you for acceptance where the law requires it.

12. Contact

Questions about this policy: support@yourdomain.com