1. What we collect

We only collect what you type directly into the birth chart and numerology forms:

• · Birth date and birth time — entered on the birth chart form.
• · Birth city — the text you type is sent to a city-search lookup (see Third parties) to resolve it to coordinates and a timezone.
• · Full birth name — only if you use the numerology calculator, to compute your Expression, Soul Urge, and Personality numbers.

For the birth chart and numerology tools, we don't ask for an account, an email address, a payment method, or anything beyond the birth details above — there's no login and no way for us to identify you across visits.

If you create a Journal account, we additionally collect:

• · Your email address — used only to log you in and, if you request it, to send a password reset link.
• · Journal entry text — the free-text you write about signs and synchronicities you noticed.
• · Confirmed symbol tags — the symbols (and their element/planet) you confirm or add against an entry, after our automatic keyword scan suggests matches.
• · Mood — an optional short text field you can attach to an entry.

2. Why we collect it

Birth chart and numerology data: solely to calculate and display your natal chart or numerology profile back to you, in your browser, in the same request.

Journal data: solely so you can keep a private record of what you notice, get suggested symbol matches for what you write, and see a weekly tally of which elements keep showing up. Your email is used only for authentication. Nothing you enter — in either case — is used for any other purpose: no marketing, no profiling, no resale, no sharing with third parties.

3. Where it's stored

For the birth chart and numerology tools, there is no server-side database.Your birth data is processed in memory for the duration of a single request to generate your chart or profile, and the result is sent back to your browser — nothing is written to a database, and we have no way to look up “your” data after the fact, because we never kept it.

Our server does log limited technical debug output while it talks to NASA JPL Horizons (see below) to look up the Nemesis asteroid position — which asteroid, and whether the lookup succeeded or failed — but not your birth date, time, name, city, or coordinates.

What is stored, and where: once your chart is generated, it's saved to your own browser's localStorage (not a cookie, not sent to us) under the key astroshadow:lastChart, so pages like Body Map can reference your most recent chart without asking again. This never leaves your device. Numerology results aren't stored anywhere at all, not even locally — they exist only in the page while it's open and disappear the moment you refresh or navigate away.

The Journal is the one exception.Your account email, journal entries, confirmed symbol tags, and mood are stored server-side in a Postgres database hosted by Supabase, in the EU region. Every one of those tables has Row Level Security enabled, and the database itself — not just our application code — enforces that your account can only ever read, write, or delete your own rows. No user, including us through the ordinary app, can query another user's journal entries.

Our server logs never include your journal entry text or mood. When something goes wrong saving, loading, or exporting an entry, we log a generic outcome (e.g. “failed to save journal entry”) and the database's own error message — never the content you wrote.

4. Third parties

We rely on five external services:

• · OpenStreetMap Nominatim— resolves the birth city you type into coordinates. It receives the search text you enter, nothing else about you. The request is proxied through our server, so Nominatim sees our server's IP address, never yours.
• · NASA JPL Horizons— looks up the Nemesis asteroid's position for your chart. It receives only the UTC-converted birth date and time (to the minute); it never receives your latitude/longitude, name, or city. Also proxied through our server, so JPL never sees your IP.
• · Vercel Web Analytics & Speed Insights— our hosting provider's own privacy-focused analytics, added July 26, 2026. See Section 5 for what it collects.
• · Google Analytics (GA4)— Google's analytics platform, used to see anonymised page-view and session data. Unlike Vercel Analytics above, it sets a cookie on your device, but only once you accept the cookie banner, and the data it collects is processed by Google. See Section 5 for what it collects and how to withdraw consent.
• · Microsoft Clarity— Microsoft's session-recording and heatmap tool, used to see anonymised playback of how visitors move through and interact with the site. Same cookie banner as Google Analytics above gates it, and the data it collects is processed by Microsoft. See Section 5 for what it collects and how to withdraw consent.

We don't use any other third-party service. No advertising networks, no data brokers.

5. Cookies & tracking

AstroShadow does not use advertising cookies, and does not sell or share data with ad networks.Journal accounts use one essential, strictly-necessary sign-in cookie to keep you logged in — this does not require consent under GDPR's ePrivacy exemption for functional cookies. The browser localStorage described above is separate from this and isn't used to track you either — it only stores your own most recent chart, on your own device, for your own convenience, and nothing is transmitted from it to us.

As of July 26, 2026, we use Vercel Web Analytics and Speed Insightsto see aggregate page-view counts and page-load performance, and to track four specific product events: a chart being generated, a Destiny Statement being revealed, a Journal signup, and a Journal entry being saved. Each of those four events sends only its bare event name — no birth data, no journal content, no email address, and no other identifying details are attached. We checked the library's own source directly: it sets no cookies and no persistent identifier on your device, and its script and data both travel through our own domain rather than a third-party one.

As of July 29, 2026, we also use Google Analytics (GA4) to collect anonymised page-view and session data — which pages are visited, in what order, and aggregate visit counts. Unlike Vercel Analytics above, Google Analytics uses cookies— but only after you click “Accept” on the cookie banner shown on your first visit. Until then, Google Analytics runs in Google's own Consent Mode, defaulted to denied: no cookie is set on your device, and no ID that could identify you or link separate visits together is used. A small number of cookie-less pings may still reach Google even while denied — this is Consent Mode's own documented behaviour, used only to model aggregate traffic statistically, not to track anyone individually. We don't configure Google Analytics to collect your name, email, birth details, or journal content in any case — only the pages you visit plus the standard technical signals (browser, rough device/location) Google's script attaches automatically. That data is processed by Google under Google's own privacy policy, not ours.

As of July 29, 2026, we also use Microsoft Clarity for session recording and heatmaps — an anonymised playback of mouse movement, scrolling, and clicks, so we can see where people get stuck or lose interest on a page. Clarity is gated more strictly than Google Analytics: its script isn't requested from Microsoft at all — not even in a cookie-less or denied state — until you click “Accept” on the same cookie banner, one decision covering both tools. We haven't configured Clarity to collect your name, email, birth details, or journal content, and by default it masks text and input content in its recordings rather than capturing it verbatim; for the full detail of what Microsoft itself does with that data, see Microsoft's own privacy statement.

Your choice is remembered in your browser's localStorage (not itself a cookie) under the key astroshadow:cookieConsent, so the banner only asks once, for both tools together. To withdraw consent after accepting, clear your browser's cookies and site data for AstroShadow (or use private/incognito browsing) — this removes the Google Analytics and Clarity cookies along with your stored choice, so both go back to denied and the banner reappears the next time you visit. If you click “Decline,” the same denied state is stored immediately for both and the banner won't ask again either.

6. Legal basis (GDPR)

For users in the EU/EEA/UK, our legal basis for processing the birth data you submit is your consent — given by voluntarily entering your details into the form and choosing to generate a chart or profile. You may withdraw consent at any time simply by not using the tool, or by clearing your browser storage as described below.

The same applies to the Journal: creating an account and writing entries is voluntary, consent-based processing. You can withdraw consent at any time by deleting your account (see below), which removes your email and every journal entry permanently.

For Vercel Web Analytics and Speed Insights, our legal basis is legitimate interest— understanding which pages and features are actually used. This doesn't require consent because no cookie or other on-device storage is involved. That script does not currently honor browser “Do Not Track” signals, so if you want to opt out of it specifically, use a browser extension or setting that blocks first-party requests to /_vercel/insights and /_vercel/speed-insights.

For Google Analytics and Microsoft Clarity, both of which use a cookie, our basis is your consent— the cookie banner asks before anything is set, and both stay denied (Google in its own Consent Mode, Clarity not recording at all) until you click “Accept.” You can withdraw this consent at any time exactly as described in Section 5: clearing your browser's cookies and site data for AstroShadow removes both cookies and your stored choice.

7. Your rights

Under GDPR and similar laws, you have rights over your data. Here's how each applies, concretely — birth chart/numerology data first, then the Journal.

• · Access— since we retain nothing server-side for the chart and numerology tools, there's nothing for us to send you beyond what's already in your own browser. Your chart data is visible in your browser's developer tools under localStorage.
• · Deletion— clear your browser's site data/localStorage for this site (or use private/incognito browsing) to remove all stored chart data instantly. No request to us is needed, because we hold nothing to delete on our end.
• · Portability— export your data yourself at any time: it's stored as plain JSON in localStorage under the key astroshadow:lastChart, copyable via your browser's developer tools.
• · Rectification / objection — also self-serve: re-enter different details and generate a new chart, or simply stop using the tool.

For the Journal, both of these are self-serve, built into the product, and available from the bottom of your Journal page:

• · Access & portability— the “Export my entries” button downloads every entry you've written, with its confirmed symbols and mood, as a JSON file.
• · Deletion— the “Delete my account” button permanently removes your account and every journal entry tied to it. This is immediate and irreversible; we don't hold a backup copy to restore from.

8. Wellbeing disclaimer

AstroShadow's content — archetypes, shadow work, numerology, body-map correspondences — is offered for entertainment, self-reflection, and personal growth. It is notmedical, psychological, or professional advice of any kind, and it is not a substitute for therapy, counseling, or professional mental health care. If you're struggling or in crisis, please reach out to a licensed professional or a crisis line in your region.

9. Changes to this policy

We may update this policy as the product changes. If we add cookies, analytics, or any tracking technology, we'll update this page and add a consent mechanism before doing so, not after.

10. Contact

Questions about this policy or your data can be sent to [email protected].