Privacy Policy

1. In short

The account is created without registration, under a pseudonymous identifier — we don't ask for your name, email or phone number. The data you enter (name if you wish, date/time/place of birth, questions, dreams) is stored on your device and in your private cloud copy in the EU that only you can see. We don't sell data and there are no ads in the app. Measuring the performance of our own ads (Meta) works only if you turn it on yourself — see “Ad measurement”.

2. Data controller

The data controller is 365 LAB DOO, Belgrade, Serbia; the contact address is shown in your Profile and at the end of this text. The processing of data of persons in the European Union is governed by the General Data Protection Regulation (GDPR), and of persons in Serbia by the Serbian Personal Data Protection Act. We do not have a representative in the European Union — all data-related requests are handled directly by the controller at the contact address. You can lodge a complaint with the supervisory authority of your country or with the Commissioner for Personal Data Protection in Serbia.

3. What we process

Data you enter yourself: your name or nickname (it can even be made up), date of birth, optionally time and place of birth, gender, questions and dream descriptions. Data of the people close to you that you add yourself under “My loved ones”: name, date, optionally time and place of birth, and optionally that person's gender and their relationship to you (partner, crush, friend or family) — only you add them, and you confirm that you have that person's consent (for a child, as a parent or guardian). Gender and relationship type are optional and exist only so that the interpretation doesn't have to guess: without them, the text assumes neither that person's gender nor that you are in a romantic relationship. We do not share them with any third party and they are not used for ad measurement. All of this data is used only for your comparative readings, is stored with your profile, and is deleted when you remove it (except in readings and conversations you have saved — there they stay until you delete those readings and conversations) or delete your account. Data the app creates: saved readings, the “Your file” section (the themes of your questions — fully visible in the app, and it can be turned off and deleted), a pseudonymous account identifier, daily usage counters to prevent abuse, a technical error log (screen, app version and a technical description of the error, without content), a push notification token if you allow notifications (for messages the app sends you and for Telepathy), and — if you buy a subscription or credits — purchase status and a record of the consent you give at purchase (time, product, language and text version), linked to the pseudonymous identifier. To prevent abuse of gift credits (reinstalling to get new credits), the app sends the server a device identifier that we keep in a one-way encrypted form for at most 12 months. We do NOT collect: phone number, location or contacts, and email only if you enter it yourself when withdrawing from a contract (see “Withdrawal from a contract”). The device advertising identifier is used only if you enable ad measurement (see “Ad measurement”). We do not store the photo of your cup — it is processed immediately, for that one reading only, and is never saved anywhere (see “AI processing”). When you install the app through a link in one of our ads, Google Play tells us the campaign tag (the ad's source, campaign and theme, without any advertising ID); we keep it with your account only to measure which ads work, we share it with no one, and it is deleted with your account — it is a separate piece of data and does not change your choice about ad measurement (Meta).

4. Why and on what legal basis

For running the app (profile, readings, credits, Telepathy, notifications you turn on yourself): performance of the contract with you. For the error log, protection against abuse and usage counting: our legitimate interest in keeping the app working and free from abuse — you can object to this processing. For ad measurement (Meta): your consent, which you can withdraw at any time. The “Your file” section is the personalisation of readings based on your themes and questions; it makes no decisions with legal effects on you, and you can turn it off on the “What she knows about you” screen. For the tag of the campaign the app was installed from: our legitimate interest in knowing which ads work — you can object to this processing too.

5. Where it's stored and transfers outside the EU

On your device (primarily) and in a private cloud copy (Google Firebase, EU region — europe-west1); security rules guarantee that only your account can read and write your data. The texts are generated by the AI of Anthropic, PBC (USA), acting as our processor, on the basis of the European Union's standard contractual clauses. The status of purchased credits and of subscriptions bought earlier is managed for us by RevenueCat, Inc. (USA) — it receives only your pseudonymous account identifier and purchase data; payment is processed by Google Play (Google Ireland Limited in the European Economic Area). Neither we nor RevenueCat can see your card details. Ad measurement, if you turn it on, is processed by Meta Platforms Ireland Limited as an independent controller.

6. AI processing

For written readings the app sends to our server (EU) the astrological facts calculated from your birth date, your question or dream and, if enabled, a summary of your file. For a coffee cup reading, a photo of the cup that you choose yourself is also sent — without location data; it is used solely for that one reading and is not stored by us; only the text of the reading remains in your history. The server forwards everything to Anthropic (Claude API), which writes the text. Anthropic doesn't use your data to train models; it may retain inputs and outputs for at most 30 days for safety checks and then deletes them — this also applies to the photo of the cup. Before answering text you write yourself (a question, dream, wish or chat message), the server briefly checks it with the same processor for signs of crisis, violence or a health question — so that a helpline number is shown instead of a card; this check is free and is not stored anywhere on our side.

7. Telepathy

If you start Telepathy, the other person who enters your code can see your name (as you entered it), your date of birth and the daily states you enter, and you see theirs. That data is stored in our database in the EU for as long as the pair lasts, and is deleted when either of you leaves the pair, deletes their account, or after 180 days without activity. Give your pair code only to the person you want to connect with. For the “you're connected” notification your phone gives us a push notification token, which we delete together with your account.

8. Ad measurement

Measuring the performance of our ads works only with your consent — a switch in the intro or in your Profile, off by default. When you turn it on, the app sends Meta Platforms Ireland signals: the event name (for example tarot opened or offer shown), the device's advertising identifier and the purchase amount. Neither your name, nor your date of birth, nor the content of your questions and dreams is sent. Meta processes that data as an independent controller under its own privacy policy. You withdraw consent with the same switch; from that moment nothing more is sent, and the app works exactly the same.

9. Deletion, retention periods and your rights

You can see and change all of it in the app. The “Delete all my data” button (Profile) immediately deletes your profile, readings, “My loved ones”, your file, your Telepathy pair, notification token, counters and your account — from the device and from the cloud. Without any personal content we keep only: purchase records that Google Play and RevenueCat retain under tax and accounting regulations; the device fingerprint, unlinked from any account, for up to 12 months so that deletion can't be used to claim gift credits again; a purchase record, unlinked from any account (Google Play order number, product, number of credits and time), for up to 12 months so that the same purchase can't be credited twice; the technical error log without account identifiers for up to 90 days; reports of disputed AI content without account identifiers. Telepathy pairs without activity are deleted after 180 days, and push tokens that haven't been refreshed after 90 days. You have the right of access, rectification, erasure, restriction of processing, portability of the data you entered and objection to processing based on legitimate interest; we respond within 30 days. Send your request to the contact address in your Profile; you also have the right to lodge a complaint with a supervisory authority.

10. Children and the nature of the content

The app is intended for adult users (18+) and is not intended for children; age is checked from the date of birth at first entry. All interpretations are for entertainment and self-reflection — they are not facts, event predictions, or a substitute for medical, legal, or financial advice. Don't rely on them when making important life, health, legal or financial decisions.

11. Reading memory on the server

So the AI astrologer knows what it has already told you and doesn't repeat itself, our server writes a short trace into our database after every AI reading (Google Firebase, EU region — europe-west1), under your pseudonymous identifier: the type of reading, the date, the language, the key piece of advice we gave and our closing question, the cards drawn, the symbols from the cup, the transit of the day or the dream motifs from our symbol database — never the full text of the reading and never the text of the dream. With tarot, the cup and conversation, the topic of your question is also written, shortened to 120 characters; the AI sees it for at most 7 days, and if the question contains words about health, pregnancy, death, sexual life, faith or politics, it isn't written at all. The whole trace is deleted after 90 days. Before every new reading, a summary of the trace goes to the AI that writes the text (Anthropic) together with the other facts, in the same way and on the same basis as the dossier — as part of the personalised reading service. The “Personalisation” switch on the “What she knows about you” screen turns off both the dossier on your device and this trace: from that moment nothing new is written or read, and existing traces expire or are deleted immediately along with the account. The trace isn't displayed in the app; you receive it on request, at the contact address from your Profile, within 30 days. Whatever you yourself tell the astrologer about your life in conversation (who is who to you, the situation, a deadline) is kept as short facts for 90 days, or 7 days if you choose that on the “What she knows about you” screen; there, too, nothing is written about health, pregnancy, death, sexual life, faith or politics.

12. Another person's data

When you add someone to “My loved ones” or mention them in a conversation, we process the data of a person who may not use the app themselves: name or nickname, date of birth, optionally time and place of birth, gender and the kind of relationship. We use it only to write a comparative reading for you (for example “The two of you today” or an answer in the conversation about the two of you) — we do not build a profile of that person, we do not contact them, and we do not use this data for anything else, including ads. The legal basis is our legitimate interest in providing the service you asked for, together with your confirmation that you have that person's consent; since we do not have their contact details, we cannot notify them ourselves, so we ask you to tell them that you added them and point them to this section. The data is stored on your device and in your private cloud copy in the EU, linked to your account; for each comparative reading, our server and the text writer (Anthropic) receive the name, the gender and kind of relationship if entered, and astrological facts calculated from the birth data, and short notes about that person may remain in the conversation trace and among the facts the astrologer remembers, with the time limits from the section “Reading memory on the server”. When you remove the person from “My loved ones”, their data is deleted from the device and from the cloud copy; you delete a conversation with the “Delete conversation” button, and everything at once with the “Delete all my data” button in your Profile, while the text in readings you have saved remains until you delete those readings. If you are that other person and want to find out whether any data about you exists or ask for it to be deleted, write to the contact address at the end of this text and send the name and date of birth by which we can recognise you — because accounts are kept under a pseudonym, we will search for this data and reply within one month. If you write about that person in a conversation, everything you write about them, for example their date of birth, goes to our server and to the text writer (Anthropic) as part of your message, like the rest of the conversation. If the person entered their data themselves, through a link you sent them, the legal basis for processing that data is their consent given on that page: they can withdraw it and ask for deletion at the contact address at the end of this text, without giving reasons.

13. Soulmate sketch

When you request a soulmate sketch, our server sends Google (Gemini API) only an image description put together from your chart: the sign of your Venus and the sign of your descendant, plus what you choose yourself — the gender and age range of the person in the sketch. Google does not receive your name, date, time or place of birth, your questions, or any other data about you or other people. The short description accompanying the sketch is written by Anthropic from the astrological facts of your chart (Venus, descendant, Moon and periods derived from planetary movements), just like the other AI readings. The image is stored only on your device; our server keeps a copy of it for 30 minutes so that a repeated request is not charged twice, and keeps a short record of the sketch (the signs, your choices, your rating and the date) under your pseudonymous identifier until you delete your account. The legal basis for processing is performance of the contract — the sketch is a service you request yourself; Google processes this data on our behalf, under its own data processing terms for the paid Gemini API. The sketch is an illustration created by artificial intelligence, not a photograph or a depiction of a real person, and it is labelled as such on the image.

14. Withdrawal from a contract

If you withdraw from a purchase using the “Withdraw from contract here” button, we process what you enter or choose in the statement: your name, the purchase you are withdrawing from (product, date and Google Play order number) and the email address to which we send the acknowledgement of receipt. The legal basis is our legal obligation under consumer protection law: to acknowledge receipt of the statement on a durable medium and to make the refund. We keep the statement in our database in the EU (Google Firebase, EU region — europe-west1), with your pseudonymous identifier, for no longer than 3 years from receipt, as proof of the withdrawal and refund; that is why the “Delete all my data” button does not delete it either. We use the email address only for the acknowledgement and correspondence about that withdrawal, never for advertising, and the acknowledgement is sent from our contact address through an email service provider that processes it on our behalf.

Contact

365 LAB DOO · Stevana Filipovića 100G, Beograd (Čukarica), Serbia · Registration no. 20854766 · Tax ID 107699456 · kontakt@astro365.app · Delete account