Privacy Policy · Astraloom

Who we are

Astraloom (the Astraloom apps for Android and iOS, and the server they talk to) is run by freshcodes technology, which is the controller of the personal data described here. Questions, requests and complaints go to freshcodes.technology@gmail.com.

The short version

You can use Astraloom without an account. Charts are calculated on your device, and your birth details are not sent to us unless you sync a chart or open a shared chart link in a browser.
Charts and journal entries stay on your device unless you have Astraloom Plus and sign in, in which case a synced copy is kept on your account.
The free version shows ads from Google. Google’s software collects data for this, including an advertising ID, as described in Advertising. Your birth details, charts, journal and messages are not given to advertisers. Astraloom Plus shows no ads.
We do not sell your personal data for money, and we add no analytics of our own.
You can delete your account at any time in the app (Settings → Account) or on the web, and ask us for a copy of your data.

Using Astraloom without an account

Charts are calculated in the app, on your device: birth dates, times and places are not sent to us to cast a chart, and place search uses a gazetteer built into the app. Your Aura-Soma bottle, where that reference is available, is also picked on your device; the app asks our server only for the list, in your language.

Charts you save, your journal and your settings are kept in the app’s storage on your device, along with counters that decide when an ad may appear and whether you have unlocked a feature for the day. Your charts and journal do not leave the device unless you sync or share them, and uninstalling the app removes them.

Some parts of the app, such as Help, the store and the esoteric reference, are fetched from our server. Like any online service, our server sees your IP address with each request. We use it to rate-limit requests, to stop abuse such as password guessing, and our web server records it in access logs with the page or address requested, the time and the device or browser type. We use those logs to keep the service secure and working. See how long we keep things.

Your account

When you create an account we store:

your email address and the display name you choose;
your password as a salted scrypt hash — never the password itself;
your language, role and account status, and when the account was created;
for each signed-in device, a session record: a hash of the session token, when it expires, and a shortened copy of the app’s user-agent string (so you can recognise your sessions);
whether your email address has been confirmed, and one-time tokens for confirming it or resetting your password. Tokens are stored only as hashes and expire (reset links after an hour, confirmation links after seven days).

We use this to run your account, keep it secure, and email you about it — confirming your address and password resets. We do not send marketing email.

Synced charts and journal (Astraloom Plus)

With Astraloom Plus, signing in keeps a copy of your saved charts and journal on your account so they follow you between devices. A saved chart includes its name, birth date and time, birthplace name and coordinates, time zone and any note; a journal entry includes its title, text, tags and any cards or Moon details attached. We also keep the identifiers of items you delete, so the deletion reaches your other devices. Tarot readings you save to your account (question, cards and note) are stored the same way.

A chart may describe someone other than you. Only save other people’s birth details if you have good reason to believe they would not mind.

If you use friends and messages, we store who you are connected with or have blocked, which charts you have shared and with whom, and the messages you send and receive (their text, any chart attached, and when they were read). Messages are visible to the people in the conversation and, if one is reported, to our moderators. When you delete a message it is hidden from everyone, but its text remains in our database until the conversation itself is removed — which happens when either participant deletes their account.

If you report a message or a person, we store your report and its reason so a moderator can act on it. Moderator and admin actions are recorded in an internal audit log.

Astraloom only shares when you ask it to. A share card is an image you send through your phone’s own share sheet. A chart link or QR code holds that chart’s name and birth details inside the address itself, so anyone you give it to can read them.

When such a link is opened in a browser, our server receives the address, and therefore those birth details, and they appear in our web server’s access logs until those are deleted. We do not otherwise store them, the page is not indexed by search engines, and it sends no referrer. When the Astraloom app opens the link directly, nothing is sent to us. Only share a link for someone else’s chart if you have good reason to believe they would not mind.

Advertising

The free version of Astraloom is paid for by ads, served through Google AdMob using the Google Mobile Ads software built into the app. You may see banner, native (in-page), app-open, full-screen and optional rewarded video ads. Rewarded videos are your choice: watching one can unlock a tarot reading, or the full Year ahead and Tarot for the day. Astraloom Plus shows no ads, and the app does not request them while your subscription is active.

To show and measure ads, Google’s software may collect:

your device’s advertising ID and app-set identifier;
your IP address, from which an approximate location can be worked out;
device and app details, such as model, operating system, language and app version;
which ads were shown, tapped or watched;
diagnostics such as crash and performance data from that software.

Google uses this to deliver and measure ads, limit how often you see them, prevent fraud and, where you have agreed or your law allows it, personalise ads. Google handles this data under its own Privacy Policy; see also how Google uses data from apps that use its services.

We do not pass your birth details, charts, journal, readings or messages to Google’s ad software, and our ad requests carry no information about your chart or what you are reading.

Your choices. If you are in the European Economic Area, the UK, Switzerland or a US state with a privacy law that applies, Astraloom asks for your choice through Google’s consent message before personalised ads are used. You can change it later in Settings → Ads → Ad privacy choices, which appears where this applies to you. Your phone’s own settings also let you reset or delete its advertising ID. If you choose not to allow personalised ads you will still see ads, based on less data.

Under some US state laws, personalised advertising can count as “selling” or “sharing” personal data even though no money changes hands for the data itself. The same Ad privacy choices setting lets you opt out.

What the app asks your phone for

Notifications: if you turn on daily insights, sky alerts or messages. These are off until you allow them.
Camera: only when you choose to scan a chart’s QR code. Nothing it sees is saved or sent.
Starting after a restart: so scheduled reminders survive your phone being switched off.
Advertising ID, billing and internet access: for the ads, purchases and online features described here.

Astraloom does not ask for your phone’s location, contacts, microphone or files.

Payments and purchases

Astraloom Plus and any single items in the app’s store are paid for through Google Play or the App Store. Card and bank details go directly to those stores; we never see or store them.

We store what we need to know what you are entitled to: your plan and its status, the store, the store’s reference for the subscription or transaction, the renewal date, and a record of each item you have bought. To confirm a purchase we send its transaction reference to Google or Apple. We keep the payment notifications the stores send us, for accounting and to resolve disputes.

Push notifications (apps)

Daily insights and sky alerts are worked out and scheduled on your device, so we are not told about them. For messages and friend requests, if you allow notifications in the app, we store the device’s push token, its platform, language, time zone, app version and which kinds of notification you want. Those notifications are delivered through Google Firebase Cloud Messaging, which receives the token and the notification’s title and text (for a message, the sender’s name and the start of the message). Signing out of the app removes its token.

Email

Account emails (address confirmation and password reset) are sent through an email delivery provider — Resend or Postmark, depending on how this installation is set up — which receives your email address and the message.

Affiliate links

When you arrive through a partner’s referral link, we record the click to credit the partner if you go on to install the app or subscribe. The record holds a salted, one-way hash of your IP address and device (which we cannot reverse), the user-agent string, the referring page, and — if you then sign up — your account id. No cookie is set for this.

Device storage and cookies

The apps keep your session token in the device’s secure storage (the iOS Keychain or Android Keystore) and your charts, journal, settings, ad counters and sync bookkeeping in the app’s own storage on the device. Google’s ad software keeps its own data on the device for the purposes in Advertising.
The web pages on our server, including this policy and the terms, set no cookies unless you sign in. They carry no ads or tracking scripts.
Signing in from a web browser, which staff do in the admin panel and you do if you delete your account on the web, sets one cookie, astraloom_session, which keeps you signed in: HTTP-only, 30 days, renewed while you use it, and removed when you sign out.

Who else processes your data

These providers handle data for the purposes above:

Google and Apple — in-app purchases and their verification.
Google AdMob — ads in the free version, as described in Advertising. For some of this Google decides how the data is used, as a separate controller.
Google Firebase — push notifications.
Resend or Postmark — account emails.
Our hosting provider, which runs the server and its database.

Some of these are based in the United States, so your data may be processed outside your country. Where the law requires it, those transfers rely on the provider’s standard contractual clauses or an equivalent safeguard.

Why we are allowed to

To provide the service you asked for (performing our contract with you): your account, sync, friends and messages, purchases, notifications you turned on, account emails.
Legitimate interests: security and rate limiting, moderation, affiliate attribution, server logs and non-personalised ads, which keep the free version free — each kept to the minimum described above.
Legal obligation: payment and tax records.
Consent: notifications and, where the law requires it, personalised ads and the ad identifiers and storage they use. You can withdraw consent at any time in Settings → Ads → Ad privacy choices or in your phone’s settings.

How long we keep things

Account data, synced charts and journal, friends and messages — until you delete them or delete your account.
Sessions — 30 days after last renewal, or until you sign out.
Password-reset and confirmation tokens — one hour and seven days respectively; single use.
Rate-limit records (which can contain your IP address) — only for the short window they count, typically minutes to an hour, after which they are deleted.
Web server access logs (IP address, address requested, device type) — up to about 15 days, then deleted.
Ad data held by Google — under Google’s own retention rules; see its privacy policy.
Push tokens — until you sign out on that device, delete your account, or the token stops working.
Payment records and provider notifications — as long as needed for accounting, tax and disputes, which can outlast the account.
Affiliate click records — currently kept without a fixed limit; they do not identify you, and on account deletion the link to your account is removed.

Your choices and rights

Get a copy — email freshcodes.technology@gmail.com from the address on your account and we will send you your account details, saved charts, journal and subscription as a file, and anything else we hold (such as messages).
Ads — review or change your choices in Settings → Ads → Ad privacy choices, where they apply to you, or remove ads with Astraloom Plus.
Correct — change your name in the app (Settings → Account); email us to change your address.
Delete — “Delete this account” in the app (Settings → Account), or the delete your account page on the web, deletes the account and, immediately, your charts, journal, saved readings, friendships, conversations (including the messages in them), reports you filed, devices and subscription record. A subscription bought through Apple or Google must be cancelled in that store. Payment records we must keep, and records that do not identify you, are kept as described above.
Depending on where you live you may also have the right to object to or restrict processing, to data portability, to withdraw consent, and to complain to your data-protection authority (in the UK, the ICO). Email freshcodes.technology@gmail.com and we will answer within a month.

Children

Astraloom is not intended for children. Accounts are for people aged 16 or over; if you believe a child has given us personal data, email freshcodes.technology@gmail.com and we will delete it.

Security

Passwords are hashed with scrypt; session tokens and email tokens are stored only as hashes; connections are encrypted in transit; and login, reset and other sensitive requests are rate-limited. No system is perfectly secure — if something goes wrong that affects you, we will tell you.

Changes

When this policy changes, the date at the top changes with it. If a change is significant, we will say so in the app or by email before it takes effect. See also our Terms of Service.