Privacy Policy

Astrowl ("we," "us," or "our") operates the website astrowl.ai (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices regarding that information.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please discontinue use of the Service.

Account Information

When you create an account, we collect your email address and a password (stored only as a one-way cryptographic hash — we never store or have access to your plaintext password).

Profile & Birth Data

To provide personalized astrology services, we collect the information you voluntarily enter when creating a profile:

• Profile name (a label you choose)
• Date and time of birth
• Birth location (city/region), and the corresponding geographic coordinates and timezone
• Gender (optional — "male," "female," or "unspecified")
• Residence location (optional)
• House system preference (Placidus or Whole Sign)

This data is used exclusively to generate astrological charts and reports. We do not use birth data for marketing, profiling, or any purpose other than delivering the Service.

Contact Information

If you contact us through the contact form, we collect your name, email address, phone number (optional), and message content. This information is used solely to respond to your inquiry.

Payment Information

If you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not collect, store, or have access to your full credit card number or payment method details. Stripe receives your email address, subscription plan, and payment details. Please refer to Stripe's Privacy Policy for details on how they handle your payment data.

Automatically Collected Information

When you visit the Service, our server may automatically record:

• Pages visited (URL path) and HTTP method
• IP address
• Approximate geographic location (derived from IP)
• Browser type and operating system (User-Agent)
• Referring URL
• Date and time of access

This data is collected for the purpose of maintaining service security, diagnosing issues, and understanding aggregate usage patterns. We do not use third-party analytics or tracking services.

We use the information we collect to:

• Provide, operate, and maintain the Service
• Generate personalized astrology charts, reports, and forecasts
• Process your subscription and payments (via Stripe)
• Send transactional emails (account verification, password resets)
• Respond to your inquiries and support requests
• Detect and prevent fraud, abuse, and security threats
• Improve the Service based on aggregate usage data

We do not use your personal information for behavioral advertising, sell it to third parties, or use it for purposes unrelated to the Service.

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances:

• Stripe — to process payments and manage subscriptions.
• Geocoding services — when you enter a birth or residence location, we send the city/region name (not your personal identity) to third-party geocoding providers (OpenStreetMap Nominatim, Open-Meteo) to obtain geographic coordinates. These providers do not receive your account or identity information.
• Email delivery — transactional emails (verification codes, password resets) are sent through our configured email provider.
• Legal requirements — we may disclose information if required by law, regulation, legal process, or governmental request.

Your data is stored in encrypted databases. Passwords are hashed using industry-standard one-way cryptographic algorithms. Session tokens are stored as hashes.

We use the following security measures:

• HTTPS encryption for all data in transit
• HTTP-only, Secure, SameSite session cookies
• CSRF protection for state-changing requests
• Content Security Policy (CSP) headers
• Rate limiting on authentication and sensitive endpoints
• No third-party tracking scripts

While we take reasonable measures to protect your information, no method of transmission or storage is completely secure. We cannot guarantee absolute security.

We retain your account data for as long as your account is active. Specifically:

• Account data — retained until you delete your account.
• Session tokens — automatically expire after 14 days or upon logout.
• Email verification codes — expire after 15 minutes.
• Server logs — retained for security and operational purposes.

You may request deletion of your account and associated data at any time by contacting us at [email protected].

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — update or correct inaccurate personal data.
• Deletion — request deletion of your personal data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to certain processing of your data.

To exercise any of these rights, please contact us at [email protected]. We will respond within a reasonable timeframe.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• The right to know what personal information we collect and how it is used.
• The right to request deletion of your personal information.
• The right to opt out of the sale or sharing of your personal information.
• The right to non-discrimination for exercising your privacy rights.

We do not sell or share your personal information as defined under the CCPA/CPRA. For more information, see our "Do Not Sell or Share My Personal Information" page.

To submit a request, email [email protected] with the subject line "California Privacy Request."

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will promptly delete it.

The Service is operated from servers that may be located in various jurisdictions. If you access the Service from outside the jurisdiction where our servers are located, your information may be transferred to, stored, and processed in a different country. By using the Service, you consent to such transfer.

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or your personal data, please contact us:

Email: [email protected]