Data Protection Notice

Controller

Under Article 13 of the EU General Data Protection Regulation ("GDPR") and of the UK GDPR, the controller for the Astrolith app is Emre Omer Yildiz. You can reach the controller at hello@astrolithapp.com.

This notice describes which data the app actually processes, where it is stored and for what purpose. It is not a generic template; every sentence below is written to match the app's code.

The same facts apply wherever you live. The section "US state privacy laws" adds what those laws ask for.

Categories of personal data

Birth details: the name, birth date, birth time and birthplace you enter when you create a profile. When you add a person, the same details for that person and the relationship label you choose (partner, crush, friend, family, colleague). A person can also be added from the match code they send you themselves; the code carries the same birth details, but not the name.

Relationship status (optional): if you choose to give it, your answer of "in a relationship", "single" or "it’s complicated". It is used only to leave out lines in the daily reading that do not fit you. It is stored on your device and never enters usage measurement. You can change or clear it in the You tab.

Journal entries: the free text you write and the mood you choose. Because you control this field, it may contain special categories of personal data (GDPR Article 9), depending on what you write. Examples are health, religious beliefs or sexual orientation. The app does not read, classify or analyze this content; it is stored on your device as written.

Day log: a snapshot of the reading shown on screen that day (headline, day label, Moon sign and phase, cards). If you gave one, it also holds your answer to "Did it ring true?".

Resonance and learning data: counters of the transit families you answered "It did" or "Not really" for. These counters affect the order of what is shown next.

Settings: house system, notification time and which profiles get notifications, display level (Simple, Detailed or Expert) and onboarding status.

Purchase status: the subscription status read from the store (App Store or Google Play). Payment details such as your card number or billing address never reach the app or us; only Apple or Google processes them.

Operating records: weekly counts of how often each part of the app was used, recent error logs without personal information, and when the store rating request was shown. The full list of counts is in the app under "What this device counts". These records contain no name, birth details or free text, and they are kept on your device. While usage data sharing is on, what is counted is also sent as events, with a random number, to an analytics service (see below).

Trial record (Android only): a one-way code made on your phone from the Android ID, and the date the free trial first started on that device. It is not linked to your name, an account, your birth details or any other data, and it is deleted after 400 days.

Account data, only if you create the optional account: your email address and when the account was created and last signed in. It includes your end-to-end encrypted records, with their number, size and update times. It also covers your friend code and public key, your friend links, the encrypted cards sent to your friends and the purchase record linked to your account. We cannot see the content of the encrypted records or the cards.

No other data is collected. The app never requests location, camera, microphone or external storage permissions. No advertising ID is created. The only identifier for analytics is the random number created on the phone while usage data sharing is on (see below). If you turn sharing off, that number is deleted too.

Purposes and legal bases

Birth details and settings are processed to provide the service you choose (birth chart, daily reading, calendar). The legal basis is the performance of a contract with you (GDPR and UK GDPR Article 6(1)(b)). Without this data the app cannot perform its basic function.

Journal, day log and resonance data are processed to personalize the service, on the basis of our legitimate interest (Article 6(1)(f)). Because journal text may contain special category data, a condition of Article 9, such as explicit consent, may also apply to it. The final form of this distinction is subject to approval by legal counsel. Without an account, this content stays only on your device. With an account, it goes to the cloud only end-to-end encrypted, in a form we cannot read.

Purchase verification is done through Apple's or Google's own systems to confirm that your subscription is valid. The legal basis is the performance of a contract (Article 6(1)(b)). If you are signed in, the purchase is also verified on our server and linked to your account, on the same basis, to carry your access across your devices.

The trial record is processed so that the free trial can be used once per device, that is, to prevent misuse, under our legitimate interest (KVKK article 5/2-f). It is used for nothing else.

Account data (email address, encrypted records, friend links and cards) is processed to provide the encrypted backup, sync and friends features of the optional account. The legal basis is the performance of a contract (Article 6(1)(b)). Your email address is used only to send sign-in codes and to identify the account, never for marketing.

Usage data is shared on the basis of our legitimate interest in improving the app (GDPR and UK GDPR Article 6(1)(f)); we do not ask for separate consent. You can object and stop the sharing at any time by unchecking the "Share usage data" box. The events are used only for aggregate analysis to improve the app, and they are kept only as long as that analysis needs them. They are not used for advertising or marketing, are not sold and are not matched with any other record.

The service is not directed at anyone under 18; the app is designed for users aged 18 and over. You are asked to confirm this on first launch.

Where data is stored, and transfers

If you do not create an account, the personal data listed above is kept only in your device's local storage and is not sent anywhere. The exceptions are the usage data sharing described below, which you can turn off at any time, and the trial record on Android. In this version, the app also connects to our server at launch to read a few app settings, for example whether a newer version is recommended. This request carries none of the data you enter.

The trial record on Android (the one-way code and the date the trial first started) is stored on our server even if you do not create an account. The server is located outside Turkey, so this record is also transferred abroad under KVKK article 9.

If you want, you can create an optional account with your email address. The account is for moving your data to a new phone, syncing it across several devices and adding friends. There is no password: to sign in, we email you a 6-digit code.

If you create one, your data (profiles and birth details, people, journal, day logs, tarot spreads, learning data and settings) is encrypted on your phone. The key can be opened only with your backup password or your recovery code. The data goes to our cloud server (Supabase, Frankfurt (Germany)) only in encrypted form (end-to-end encryption). The key stays in your phone's secure storage, and no one, including us, can read this content. Your trial start date and the usage counts on your device are not part of this encrypted backup.

The server cannot see the content. To run the service, it keeps the following in readable form: your email address and when the account was created and last signed in. It also sees how many encrypted records you have, their size and when each one changed. Your friend code, your public key, who you are friends with and any purchase record linked to your account are also stored. When the app connects, the server also receives your device's IP address. We do not store it in our tables, but it may stay in the cloud provider's technical logs for a limited time.

You can delete your account at any time in the app, under "Account and cloud". Deleting it permanently removes your email address, all your encrypted data in the cloud, your keys, your friendships, friend cards and your purchase record. The data on your phone stays where it is. Deleted data may remain for a short time in the cloud provider's routine backups until those backups roll over. If you sign out, the data on your phone also stays; syncing stops and the key is deleted from this phone.

Friends: you give your friend code only to the people you choose. When you add someone's code or accept their request, you agree to send them your card. The card holds your name and the birth date, time, place and time zone of your first profile. It is encrypted on your phone with your friend's public key, so only their phone can open it; there it is added to People as a person. When you add a code, your card goes with the request, so the other person sees your request with your name. If your profile changes, the card is updated. The server cannot see what the card contains; it only knows who sent a card to whom and when it changed. When you end a friendship or delete that person, the cards in both directions are deleted from the server. The person then disappears from both phones at the next sync.

Sharing usage data: this is on from the moment you give the first-launch confirmation, and the app does not ask a separate question for it. The "Share usage data" box is under You > Settings > Privacy and your data > "What this device counts". You can turn it off there at any time and turn it on again; turning it off does not change how the app works. No account is needed. While sharing is on, everything counted in the closed list shown there is also sent, as individual events, to an analytics service called Mixpanel. The events go to its server in the European Union. An event holds the event name and its values from that list, the moment it happened (the exact time) and a random number created on the phone. It also holds the app version, the platform (iOS or Android), the app language and "TR/other", based on the phone's time zone. The service needs two technical fields as well: our project token, and a random number for that one event so it is not counted twice. An event holds nothing else. A small profile record is also kept under the same random number. It holds the app version, the platform, the app language, "TR/other", your plan (free, trial or Astrolith+), the day sharing was turned on and when the record was last updated. It is refreshed when it changes, at most once a day. Your name, email address, birth details, chart, journal text, the people you add, your location, an advertising ID and the phone's own identifiers are never sent. The random number is not linked to your account or your email address. It only links events from the same phone to each other. Nothing counted before the first-launch confirmation is sent. The request reaches the service with your device's IP address. We send it with the setting that tells the service not to derive a location from the IP address and not to write the address on the event. No third-party software development kit (SDK) was added for this; the app's own code sends the events.

Turning it off and deletion: when you uncheck the box, sending stops. The random number and any events still waiting to be sent are deleted from your phone. A request to delete your profile record at the service is sent at that moment; if the phone is offline then, the request is not sent. If you check the box again, a new number is created. To have events that were already sent deleted, send us the random number shown in that section before you turn sharing off. Write to hello@astrolithapp.com. Once the number is gone from your phone, we cannot match events to you.

If you turn on the personal reading, the sign, house and relationship-status information above is transferred to our server and to the servers of Google LLC. Both are outside Turkey. The transfer rests on your explicit consent, serves only to write the text, and stops when you turn the feature off.

The cloud server is located outside Turkey. So if you create an account, your email address, your encrypted data and the account data listed above are transferred abroad. The analytics server is in the European Union, and the provider, Mixpanel, Inc., is a US company that acts as our processor.

Unless you create an account, we do not transfer the personal data you enter abroad. Data that arises directly between you and Apple or Google during a purchase (payment, billing and account details) is not data we transfer. It is subject to Apple's or Google's own privacy policies and may be processed on their infrastructure in different parts of the world.

Sending your match code is a share you make with a messaging tool of your choice. The app does not send the code to a server or anywhere else.

If you have not created an account, this data does not move automatically when you change devices or remove and reinstall the app. You can import the file from "Export my data" on the new device, or create an account and use the encrypted backup.

Your rights

Under the GDPR and the UK GDPR, you have the right to access your personal data and to receive information about its processing (Article 15). You can have it corrected (Article 16) or erased (Article 17), restrict its processing (Article 18) and receive it in a portable format (Article 20).

You can object to processing based on legitimate interest (Article 21). You have the right not to be subject to a decision based solely on automated processing that significantly affects you (Article 22). Where processing is based on consent, you can withdraw it at any time.

You can lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. In the UK, this is the Information Commissioner's Office (ICO).

Your data is kept on your device, and its cloud copy is encrypted so that only you can open it. So you can use most of these rights directly in the app, right away. You can view and edit your profile and people on screen, and delete journal entries one by one. You can see and reset the usage counts in "What this device counts". "Reset all data" deletes all profiles, the journal, day logs and learning data at once. "Export my data" gives you a complete copy of your data as a file. If you have an account, you can delete it and all your cloud data under "Account and cloud". You can also turn usage data sharing off in "What this device counts". To have events already sent deleted, give us the random number shown there.

For a request you cannot complete in the app (for example, a written request for information about the purposes of processing), you can contact the controller at hello@astrolithapp.com. Requests are answered within the period the applicable law sets.

US state privacy laws

This section is for residents of US states with consumer privacy laws, such as California (CCPA, as amended by the CPRA), Virginia, Colorado and Connecticut.

Categories and sources: the personal information the app processes is listed under "Categories of personal data" above, and it comes from you. Journal text may include sensitive personal information, depending on what you write. The purposes are the ones under "Purposes and legal bases".

The app processes this information on your device. It reaches us only in the cases this notice describes.

We do not sell or share personal information, including for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. The app has no ads, no cross-app tracking and no profiling.

Retention: data on your device stays there until you delete it in the app, reset all data or remove the app. The privacy policy explains the two small records a reset keeps on purpose. If you create an account, the encrypted cloud copy and the purchase record linked to the account stay until you delete your account. Usage events are kept only as long as the aggregate analysis needs them.

Depending on your state, you have the right to know about and access your personal information, to correct it, to delete it and to get a copy. You also have the right to opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of.

You can use most of these rights directly in the app, as described under "Your rights". For anything else, write to hello@astrolithapp.com. We will not treat you differently for using your rights. If we decline a request, you can appeal by replying to our answer. If the appeal is denied, you can contact your state attorney general.

Changes

This notice is effective as of 15 October 2026. If the way the app processes data changes, this notice is updated and shown in the app with the new version date.