Privacy Policy

1. Who We Are

Astrevia is operated by Sérgio Miguel Martins Peixoto, an individual operator based in Portugal ("Astrevia," "I," "me," or "my"). You can contact me at:

Email: support@astrevia.app
Country: Portugal

2. What Data We Collect

We collect only what is necessary to provide and improve our service.

2.1 Account Information

• Email address — used for account authentication, billing communications, and optional daily reminders
• Name (optional) — used to personalise your experience. If you sign in with Google or Apple, we receive the name and email address on that account.

2.2 Birth Data

• Date of birth — required for natal chart calculations and personalised horoscopes
• Birth city / location — required for accurate house calculations
• Birth time (optional) — used to determine your Rising sign and Moon sign precisely

Your birth data is used exclusively to calculate your natal chart and personalise your readings. It is stored encrypted at rest. We do not sell it or use it for any other purpose, and your birth date, birth time and birth place are never shown to other members (see 2.8).

2.2a Optional Personal Details

• Full birth name (optional) — used only for your numerology numbers
• Relationship status and work situation (optional) — used to tailor your tarot readings
• Health focus (optional) — a broad area such as fitness or wellbeing, used only to tailor the health side of your tarot readings. Because this relates to health, we only store it when you choose one, which is your explicit consent (GDPR Art. 9(2)(a)). Tap it again on your Profile to remove it at any time.

2.3 Usage Data

Pages visited, features used, reading history, tarot draws, and your answers to optional questions about your readings (such as whether a reading felt like it was about you) — used to personalise your experience and improve the product. We use Vercel Analytics, a privacy-friendly, cookieless analytics service, to understand aggregate usage patterns. No cookies are set for analytics purposes and no personally identifiable information is shared with Vercel for analytics.

We advertise on Pinterest. With your permission (see Section 7), the Pinterest tag tells Pinterest when someone who saw or clicked one of our ads visits a page or creates an account, so we can see which ads work. It sends Pinterest the page address, your IP address, browser details and a Pinterest cookie identifier. We do not send your name, email, birth data or readings.

With the same permission, Microsoft Clarity records how visitors use our main entry pages (the home page, the free calculators and the sign-up page): scrolling, taps and how far people get, so we can fix where they get stuck. It does not record member pages. Clarity hides what you type, numbers and email addresses before anything leaves your browser, and uses cookies (its own and Microsoft's) with a pseudonymous ID to link the pages of a visit and recognise a returning browser. We tell Clarity not to use this data for advertising. Microsoft keeps recordings for 30 days, and a small random sample for up to 9 months.

2.4 Journal Entries

• Text you enter into your private journal
• Stored encrypted. Accessible only to you. Not used to train AI models or shared with third parties.

2.5 Payment Information

Subscription payments are processed by Stripe. We never receive or store your credit card numbers. We retain your Stripe customer ID and subscription status to manage your account. See Stripe's privacy policy. Premium bought in our Android or iPhone app is paid through Google Play or the App Store and managed by RevenueCat, which receives your account ID and purchase status; see RevenueCat's privacy policy.

2.6 Technical Data

• IP address — collected automatically by our servers and infrastructure for security and debugging
• Browser type and operating system — collected for compatibility and debugging
• Session cookies — used for authentication (see Section 7)
• Push notification token — only if you allow notifications in our phone app: a code for your phone, used to tell you about friend requests, friends who join or compare with you, and big days in your sky (such as a Full Moon in your sign or your streak about to end). Expo and Google (Firebase Cloud Messaging) deliver these messages. It is removed when you log out, turn "Sky days and friends" off in Settings, or delete your account

2.7 Referral Data

If you sign up via a referral link, we record the referral relationship (the referral code and the identity of the referring user) to operate our referral programme. This data is retained while your account is active and deleted when you delete your account.

2.8 What Other People Can See

Astrevia has optional friend features. Only you decide to use them, and they show as little as possible:

• Your compare link and friend code — anyone you give them to sees your first name, your Sun sign and your Life Path number.
• Friends you connect with — also see your Moon and Rising signs and the badges you have earned.

No one else ever sees your birth date, birth time, birth place, full name, email address, readings or journal. When someone compares with your link without an account, we keep only the first name and Sun sign they typed, never their birth date. You can remove a friend at any time, and deleting your account removes you from your friends' lists.

2.9 What We Send to OpenAI

Written readings are generated with OpenAI's API. For each reading we send your chart placements (signs, degrees and houses), your first name, and anything you type into the reading, such as a tarot question or the optional details in 2.2a. We never send your email address, full name, birth date or birth place. Under OpenAI's API terms this data is not used to train their models and is kept by OpenAI for at most 30 days for abuse monitoring.

3. Legal Basis for Processing (GDPR Article 6)

4. How Long We Keep Your Data

When you request account deletion, we will delete all personal data listed above within 30 days, except payment transaction records which are retained for the legally required period. See how to delete your account. Payment records retained for legal compliance do not include birth data, journal entries, or any content beyond what is required for accounting (name, email, payment amounts, dates).

5. Your Rights Under GDPR

As a resident of the EU (or any data subject whose data we process), you have the following rights under the General Data Protection Regulation:

How to exercise your rights: Email support@astrevia.app from your account email address. We will respond within 30 days (extendable to 3 months for complex requests, with notice). We will not charge a fee for reasonable requests.

Right to lodge a complaint: If you believe we are processing your data unlawfully, you have the right to lodge a complaint with Portugal's data protection authority:

6. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights regarding your personal information.

Categories of personal information we collect: Identifiers (name, email address), date of birth and birth location, internet or network activity (usage data, pages visited, reading history), and payment-related identifiers (Stripe customer ID). See Section 2 for full details.

We do not sell your personal information. Through the Pinterest tag (Section 2.3) we may share internet activity on our site (pages visited, sign-up) and device identifiers with Pinterest to measure our ads, which the CPRA may treat as sharing for cross-context behavioral advertising. You can opt out at any time with "Cookie choices" in the footer, and we treat a Global Privacy Control signal from your browser as an opt-out.

Your California Privacy Rights

• Right to know — Request the categories and specific pieces of personal information we have collected about you
• Right to delete — Request deletion of your personal information (subject to legal exceptions such as accounting record retention)
• Right to correct — Request correction of inaccurate personal information
• Right to opt-out of sale/sharing — We do not sell your data. To opt out of sharing with Pinterest, use "Cookie choices" in the footer or turn on Global Privacy Control in your browser
• Right to non-discrimination — We will not discriminate against you for exercising any of these rights

How to exercise your California rights: Email support@astrevia.app from your account email address. We will verify your identity and respond within 45 days (extendable to 90 days with notice). You may also exercise your right to delete by using the account deletion feature in your Profile.

You may designate an authorized agent to make a request on your behalf. The agent must provide written proof of authorization.

7. Cookies

Astrevia uses essential cookies necessary for the service to function:

• Session cookies — used to keep you logged in during your session. Deleted when you close your browser or your session expires.
• Authentication cookies — used to recognise your account after login.

We use Vercel Analytics for aggregate usage statistics, which operates entirely without cookies.

Two kinds of non-essential cookie are used, under one choice. The first is set by the Pinterest tag (Section 2.3), an advertising cookie that measures which of our Pinterest ads bring visitors and sign-ups. If you are in the EU, EEA, UK or Switzerland, we ask before it loads and it stays off unless you choose "Accept". Elsewhere it is on unless you opt out or your browser sends Global Privacy Control. With the same choice, we also keep the tag on the ad link you arrived from (for example which pin) in your browser for up to 30 days, so our own analytics can count sign-ups per ad; it is not sent to Pinterest. The second is set by Microsoft Clarity (Section 2.3), which uses a pseudonymous ID to link the pages of a visit to our entry pages so we can see where people get stuck. You can change your choice at any time with "Cookie choices" in the footer; your choice is stored in your browser.

8. Third-Party Processors

We share data only with the following service providers, under data processing agreements (DPAs), and only to the extent necessary to provide the service:

All processors are contractually required to process data only on our instructions and maintain appropriate security standards.

9. International Data Transfers

Our infrastructure providers may transfer and process your data in countries outside the European Economic Area (EEA), including the United States. We ensure such transfers comply with GDPR Chapter V through:

• Adequacy decisions where the destination country has been recognised by the European Commission as providing adequate protection
• Standard Contractual Clauses (SCCs) as approved by the European Commission, where adequacy decisions do not apply

You may request a copy of the applicable safeguards by emailing support@astrevia.app.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (TLS 1.2+)
• Encryption of sensitive data at rest (including birth data and journal entries)
• Access controls limiting who can access personal data
• Regular review of our security practices

No method of transmission or storage is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the CNPD within 72 hours of becoming aware of the breach (GDPR Article 33), and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights (GDPR Article 34).

11. Children's Privacy

Astrevia is not directed at children under 16. Under Portuguese law and GDPR Article 8, the digital age of consent in Portugal is 16 years. We do not knowingly collect personal data from anyone under 16. If you believe a person under 16 has created an account, contact us at support@astrevia.app and we will delete the account immediately.

12. Records of Processing Activities

As required by GDPR Article 30, we maintain internal records of our processing activities. These are available to the CNPD upon request.

13. Changes to This Policy

We will notify you of material changes to this policy by email (to the address on your account) at least 14 days before the changes take effect. For non-material changes (e.g. correcting typos or updating processor addresses), we will update the "Last updated" date.

Your continued use of Astrevia after the effective date of a material change constitutes acceptance of the updated policy.

14. Contact

For all privacy-related questions, requests, or concerns:

Email: support@astrevia.app
Data controller: the operator named in Section 1, Portugal

We aim to respond to all privacy enquiries within 2 business days.