Where your data lives
Every service that touches your data, what it gets, and what our privacy policy does not yet cover.
This article describes something in the app that is missing, partly built, or advertised elsewhere and not actually available. It says what happens today and how to get the outcome by hand. Everything of this kind is listed on known gaps.
On this page
Your birth data is unusually specific — an exact time and place — so it is worth being concrete about where it goes.
The services involved
Supabase hosts the database. Your account, your charts, your birth data, client records and share links live here. This is the only place your birth data is stored.
Cloudflare serves the application. Requests pass through it; it does not store your charts.
Stripe handles payments. It holds your card details, billing address and invoices. We never see your card number. Stripe does not receive your birth data or your charts.
Stripe has two roles at once, and it is worth being exact: for taking the payment it acts on our instructions, and for its own fraud prevention and legally required regulatory checks it is an independent controller. That second part is its responsibility rather than ours, which is why some payment questions have to go to Stripe directly.
Resend sends transactional email — confirmations, password resets. It receives your email address and the content of those messages. It does not receive your birth data.
GeoNames provides the birth-place search. This one is worth stating precisely: only the text you type into the place field is sent, through our own server. Your birth date, your birth time, your name and your account are not included. GeoNames sees "vienna" and returns a list of places. It has no way to associate that with a person or a birth moment.
What is not happening
Your birth data is not sold, not shared with advertisers, and not used to train anything. There is no analytics tag that receives it.
What our privacy policy does not yet cover
Our published privacy policy was written for the marketing website. It does not currently mention app accounts, birth data, charts, or Stripe's role in payments. That is a real omission and we are not going to pretend the policy covers ground it does not.
Until it is rewritten properly — which needs a lawyer rather than an afternoon — this article is the operative description of what the app does with your data. It is on our known gaps list.
The controller, and the address for any formal data protection request, is in the imprint and at the top of the privacy policy. Those parts are accurate.
Your rights
Access, portability, correction, erasure and objection all apply:
- Erasure works in the app: Account → Privacy and data → Delete account. Immediate and complete — see deleting your account.
- Correction: edit your birth data yourself in Account → Birth data, or ask us.
- Access and portability: exporting your data — still by email while the automated export is built.