Privacy Policy

1Who processes your data

The AstroPulse app (com.everoncraft.astropulse) is published by EveronCraft, the data controller under the GDPR. Full publisher details are in the legal notice. For any question about your data: contact@everoncraft.com.

2What stays on your phone

By default, everything is local. The following is stored in the app's private storage and nowhere else:

• your first name, your birth date, time and place, your sign;
• your circle (the first names and birth details you enter);
• your history of viewed days and the birth chart you see;
• your settings: language, notification time, cached subscription status.

All of it disappears when you uninstall the app. From Profile → "Switch account" you can wipe it at any time and start over.

3Account and sync

• Anonymous account. On first launch, the app opens an anonymous session with our server: a random technical identifier with no email and no name, used only to attach your profile if it is synced.
• Email account (optional). To carry your profile to another device, you link an email address and a password. The password is never stored: the server only keeps a cryptographic hash of it (bcrypt).
• What is synced: first name, sun sign, language, notification preferences, subscription status, and for each person in your circle their first name and sign.
• What is never sent: your viewing history, your birth chart, your display settings — and your birth details in the clear (see § 4).

4How your birth details are encrypted

Your birth date, time and place are encrypted on your phone before anything is sent, using XChaCha20-Poly1305. The key is derived from your password (PBKDF2-HMAC-SHA256, 150,000 iterations) and never leaves the device: the server only stores a non-secret salt and an encrypted block.

The direct consequence: we cannot read your birth details, even if we wanted to, and a breach of our database would not reveal them.

5How the content is written

Horoscopes are written ahead of time, sign by sign: every night our server prepares the next day's texts for all twelve signs using the Claude model (Anthropic) and stores them in a database. No personal data is sent to the model: it only receives a sign and a date.

When you open the app, it downloads the public text for your sign — like a newspaper page, not a message written about you. Anything derived from your birth details (your sign, your chart) is computed on your phone.

6AstroPulse+ subscription

Subscriptions go through Google Play Billing. Google handles the payment: we never see your payment method. We receive a purchase identifier and the state of your subscription (active, trial, cancelled, refunded), which Google notifies us about so your access stays correct.

You manage and cancel your subscription from Google Play. How Google handles data: policies.google.com/privacy.

7Notifications

Your daily reminder is a notification scheduled locally by the app. We use no push notification service: no device token is created, and nothing goes through our servers to notify you. You pick the time, and you can turn everything off in the app or in your phone's settings.

8Usage statistics and logs

• Usage statistics (ours, no third-party tool): for each view we record the screen type, the sign, the date viewed, the language and the account's technical identifier. No IP address, no first name, no birth date. It tells us which content gets read, nothing more. When an account is deleted these rows are anonymised: the identifier is cleared, the count remains.
• Server logs: each request leaves a technical line (method, path, response code, duration, IP address), needed for security and troubleshooting. Request bodies are never logged — no passwords, no birth details. Retention: 30 days maximum.

Legal basis: our legitimate interest in measuring usage and keeping the service secure (GDPR art. 6(1)(f)).

9What we don't do

• No advertising, no ad network, no advertising identifier.
• No third-party tracking or analytics SDK (no Firebase, no social network, nothing equivalent).
• No selling, renting or trading of personal data.
• No ad profiling and no automated decisions producing legal effects.
• No geolocation: your birth place is typed in, the app never asks for your location.
• No access to your contacts, camera, microphone or photos. Sharing a card renders an image on the device and hands it to your phone's share sheet.

10Hosting and transfers

• OVH — France (European Union): hosting for the website and the API. This is where the account, the profile and the encrypted blocks live.
• Google (Play billing, United States / Ireland): subscription processing, covered by standard contractual clauses.
• Anthropic (content writing, United States): receives no personal data — only a sign and a date.

No identifiable personal data leaves the European Union because of AstroPulse, apart from the billing processing carried out by Google.

11Retention periods

12Deleting your account

Two levels, depending on what you want erased:

• The data on this device: Profile → "Switch account" wipes the local profile and signs you out. Uninstalling the app removes everything else.
• The account and synced data: email us at contact@everoncraft.com from the account's email address, with "account deletion" as the subject. We delete the account, the profile, the circle, the subscription record and the sessions — within 30 days, usually within 72 hours. Usage statistics rows are kept in anonymised form, with no link back to you.

Deletion is permanent: synced data cannot be recovered afterwards.

13Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object to and port your data, and to withdraw your consent at any time.

One address for all of it: contact@everoncraft.com. We reply within one month. If our answer doesn't satisfy you, you can lodge a complaint with the French data protection authority, the CNIL: cnil.fr.

Legal bases: the account, sync and subscription rest on performance of the service you asked for (art. 6(1)(b)); usage statistics and security logs on our legitimate interest (art. 6(1)(f)); notifications on your consent (art. 6(1)(a)), which you can withdraw at any time.

14Security

• All traffic to our servers goes over HTTPS (TLS).
• Your birth details are end-to-end encrypted (§ 4); we don't hold the key.
• Passwords are hashed (bcrypt), never stored in the clear.
• Refresh tokens are stored hashed, with rotation and revocation on sign-out.
• Every request is scoped: the server only returns data attached to the account behind the token presented.

No system is bulletproof — which is why we collect the bare minimum and encrypt what matters most.

15Children

AstroPulse is intended for people aged 13 and over and is not directed at children. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it along with the associated data.

16Changes

This policy may change; the effective date at the top of the page will change with it. Material changes will be announced in the app or on the Google Play listing.

17Contact