Privacy policy

• We keep what the app needs to work for you: your account, your birth details, your settings, the readings written for you and your Ask the Sky conversations.
• Your birth details stay with us. The AI that writes readings receives the positions of your birth chart and today’s sky, computed from your birth details — not the details themselves (exactly what it receives).
• No advertising, no analytics trackers, and we never sell your data.
• You can download everything we hold about you, and delete your account and all of it, at any time in Settings.

What’s My Sky? presents astrology as an interpretive tradition alongside measured astronomy. Nothing in it is medical, psychological, financial or legal advice.

What’s My Sky? (the website and the iOS and Android apps) is run by [owner name or company], [postal address], the controller of your personal data under the EU and UK General Data Protection Regulation (GDPR). Write to us at [owner contact email].

Everything below is tied to your account unless it says otherwise, and is deleted with your account.

If you turn on the morning note, your personal readings for the day are prepared in advance each morning, so they are ready when the note arrives.

Readings and Ask the Sky answers are written by Claude Haiku 4.5, a language model made by Anthropic, from facts our own astronomy engine computes. The model computes nothing itself, and it never sees your account.

For your personal readings the model receives the positions of your birth chart and today’s sky, computed from your birth details — not the details themselves:

• your natal chart as measured positions: the Sun, the Moon and the planets in both zodiacs, and your rising sign, angles and houses only when your birth time allows them; the aspects between them; today’s sky measured against them; and how far precession has shifted the zodiac since your birth, as an angle (for example “0.57°”);
• for today’s readings, when the Sun, the Moon and the planets rise and set where you are, in local times, and any eclipse seen from there;
• the frames used: tropical or sidereal, the ayanamsa and the house system;
• whether your birth time is exact, approximate or unknown;
• your hemisphere — northern or southern — but not your latitude;
• for today’s readings only: your local date, and the abbreviation of your time zone that its times are shown in (such as “AEST”).

Never sent, for any reading or answer: your name, email address, account or reading identifiers, IP address, birth date, birth year, birth time or age; the names or coordinates of your birthplace or current place; or your time zone’s name (names such as “Australia/Hobart” name a city).

Ask the Sky sends a short note about you — your local date with its weekday and the part of the day, your zodiac frame, whether a birth profile and a location are on file, and how accurate your birth time is — then your question and the conversation’s earlier questions and answers exactly as typed, and the facts its tools compute to answer, in the same form as above. Anything you type yourself, such as a date or a place, is sent as you typed it. A question that suggests distress or thoughts of self-harm is not sent to the model: you get a reply with places to find help.

What the positions imply. A chart’s positions are derived from birth details, so they are not anonymous: someone with an ephemeris could, in principle, work back from them to a birth date — and, with the rising sign and houses, to an approximate time and latitude. Our prompts never state those details, and the model is instructed not to state or estimate them.

Public readings (the day’s sky, regions and signs) contain no personal data. Under Anthropic’s commercial terms for its API, what we send is not used to train its models and is kept only for a limited period for safety monitoring [owner: confirm against Anthropic’s current commercial terms and data processing addendum].

These providers process data on our behalf, only to run What’s My Sky?:

If you choose “Continue with Google” or “Continue with Apple” on the website, that company tells us who you are, under its own privacy policy. The App Store and Google Play distribute the apps under theirs.

We use no advertising or analytics cookies. Each item below exists only for a feature you use. The names starting with __Secure- are sent only over HTTPS, which the site always uses; a copy of the app running on a computer for development, over plain HTTP, uses the same names without that prefix.

The orrery’s “use my location” asks your browser or phone for your position only when you use it, and the position stays on your device. The link from onboarding to the orrery’s “your birth sky” carries your birth moment and your birthplace, rounded to about a kilometre, in the page address, so your browser’s history keeps them.

• Sell or rent your personal data, or share it for advertising.
• Show ads, or use analytics or tracking tools that follow you across sites.
• Send marketing email, or track whether you open our emails or follow their links.
• Write your birth details, reading text or questions to our logs.
• Make decisions about you with legal or similarly significant effects: readings are written automatically, and that is all they are.

Under the GDPR we rely on:

• Our contract with you — to run your account, compute your chart and readings, keep your settings and conversations, and export or delete your data.
• Your consent — for notifications and for “use my location”. Withdraw it at any time by switching the notification off in Settings, or in your browser or phone settings.
• Our legitimate interests — protecting the service against abuse (the hashed rate-limit counters), keeping it working (error logs) and controlling the cost of AI generation. You can object; write to us.
• Legal obligations — when the law requires us to keep or disclose data.

• Access and portability: Settings → Your data → Download my data gives you a JSON file with your account, sign-in methods, sessions, birth details, settings, readings and Ask the Sky conversations (passwords and tokens are never included).
• Correction: change your birth details and settings in Settings; for anything else, write to us.
• Deletion: Settings → Account → Delete account deletes your account and everything linked to it at once. Copies in our database provider’s backups expire within [backup retention, days].
• Objection, restriction and consent: write to us, or turn the notification off.
• Complaints: you can complain to your data protection authority; we would welcome the chance to help first.

We answer requests within one month. California residents: we do not sell or share personal information.

• Everything travels over HTTPS; passwords are stored only as scrypt hashes; Google and Apple sign-in tokens are encrypted at rest.
• The session cookie is HttpOnly, Secure and SameSite=Lax, and every change you make must come from our own site.
• Sign-in attempts and costly features are rate-limited. Wrong passwords slow down attempts from the network they come from, and never lock you out of a browser you have signed in with. Resetting your password signs out every device.
• Pages load scripts, styles and data only from our own site (a Content Security Policy); the AI service’s key never leaves our servers.
• Only the app’s servers hold the database credentials; secrets live in encrypted storage.

Our hosting runs in the United States (AWS, us-east-1) and the content delivery network serves you from its nearest location. Anthropic processes AI requests in the United States. The database is hosted in [database region]. Transfers from the EU and UK rely on [the EU–US Data Privacy Framework or Standard Contractual Clauses, per provider].

What’s My Sky? is not directed at children. You must be at least 16 years old to create an account. We do not knowingly collect data from anyone younger; if you believe a child has created an account, write to us and we will delete it.

When this policy changes we will update it here with a new date and, for significant changes, tell you in the app before they take effect.

[owner contact email] · [owner name or company] · [postal address]. If the law requires one, our representative in the EU or UK is [representative, if required].