Privacy Policy
What we collect, why, who else processes it, how to get it back or delete it.
Updated September 17, 2026
Contents
1. Who is responsible
Septagram LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States, is the controller of the personal data described here.
Privacy questions and data-rights requests: privacy@septagram.app.
2. What we collect
You give us:
| Data | Why |
|---|---|
| Email address, password hash | To create and secure your account |
| Display name, language, gender (optional) | To address you correctly in readings |
| Date of birth; time and place of birth (optional) | To calculate charts — this is the core function of the Service |
| Current location (optional) | For local transits and the lunar calendar |
| Questions you ask, journal entries, saved readings | To deliver and store your readings |
| Payment details | Handled by our payment provider; we receive only status and the last four digits |
We record on our servers when you use the Service:
| Data | Why |
|---|---|
| Pages opened: path, referring website, campaign tags, device type, browser language and time zone, and the country worked out from your IP address | To count visits and see which pages work |
| A daily visitor code derived from your IP address and browser, recomputed every day | To count unique visitors without storing your IP or anything on your device |
| If you have an account: features you use (a reading was drawn, a lesson step completed, a subscription changed) and pages you open | To improve the product and fix what is confusing |
| If you arrived through a partner link: your IP address and browser details (kept 30 days), and the country and network provider worked out from the IP address | To spot fake or automated clicks before partners are paid |
| If you have an account: where you first came from (landing page, referring site, campaign, partner code), saved with your account when you sign up | To know which channels bring people who stay, and to pay partners |
| Days you were active | To run streaks and light points |
| Error logs and security events | To keep the Service working and safe |
We record what you did, not the content: we log that you drew a reading, not your question or the cards' meaning for you; that you wrote a journal entry, not what it says.
We store on your device, depending on your region and your choice, a small number of items described in the Cookie and local storage policy.
Birth data is sensitive in practice even where it is not a special category in law. Providing it is optional. Without it, chart-based modules will not work, but the rest of the Service will.
Place of birth is searched in a list of cities built into the app. The list (about 26,000 cities of 15,000 inhabitants or more) is loaded into your browser and searched there: what you type in the place field is not sent to any outside service. City data: GeoNames (geonames.org), CC BY 4.0.
3. Why we process it, and on what basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the Service you signed up for, including streaks and light points | Performance of a contract |
| Calculating charts from your birth data | Performance of a contract, at your request |
| Taking payment, preventing fraud | Contract; legitimate interests |
| Security, abuse prevention, debugging | Legitimate interests |
| Server-side usage statistics and product analytics (section 2) | Legitimate interests — understanding and improving our own service |
| Crediting partners who referred you | Legitimate interests; contract with the partner |
| Detecting fraudulent partner clicks | Legitimate interests (fraud prevention) |
| Analytics identifiers and attribution stored on your device | Consent where required (EU, EEA, Switzerland, Brazil); otherwise legitimate interests with a right to opt out |
| Marketing email | Consent |
| Meeting legal and tax obligations | Legal obligation |
Our legitimate interest is knowing how our own product is used so we can improve it. We limit it: the data stays in our own database, is never sold or used for advertising, is not combined with data from other websites, and does not include the content of your readings or journal.
You can object at any time. In Settings → Data and privacy, turn off Product analytics on my account; from that moment we stop recording your feature usage. Where we rely on consent, you can withdraw it in the same place. Neither affects processing that already happened.
4. AI processing
Several features use AI: Ask, our AI assistant; dream analysis; the personal daily message; and summaries in charts and compatibility reports. When you use them, the text you enter — your question or your dream and, if you have enabled personal context, a summary of your chart data — is sent to an AI model to generate the response. We send the minimum needed to produce it.
Requests go through the AI gateway operated by Lovable to models from Google (Gemini). We do not permit model providers to use your content to train their models.
Some texts can be read aloud. For that, the text being read — a reading or an affirmation, not your account details — is sent to ElevenLabs to synthesise speech.
If you connect a third-party AI assistant to your Septagram account, that assistant can read your profile, birth data and reading history and add journal entries, within the access you approved. The access lasts until you revoke it in that assistant or ask us to revoke it at privacy@septagram.app.
Processors are listed in section 6, and this policy is updated when they change.
5. What we do not do
- We do not sell or share your personal data for advertising.
- We do not share your readings, journal, or birth data with advertisers.
- We do not build advertising profiles, and we run no advertising or cross-site tracking technology.
- We do not store your IP address for analytics. The daily visitor code cannot be turned back into an IP address and cannot link your visits across days. The only IP addresses we keep are from partner-link clicks, for 30 days, to detect fraud.
- We do not publish your data. There is no public sharing of readings in the Service.
6. Who else processes your data
| Processor | Role | Location |
|---|---|---|
| Supabase | Database, authentication, backend functions, product analytics | EU / US |
| Lovable | Hosting and deployment, AI gateway, sending account emails | EU / US |
| Cloudflare | CDN, DNS, security | Global |
| Google (Gemini) | AI models behind Ask, dream analysis and other AI features | US |
| ElevenLabs | Speech synthesis for texts read aloud | US |
| Browser push services (Google, Apple, Mozilla) | Delivering the push notifications you turned on | Global |
| — to be named before payments launch | Payment processing and invoicing | EU / US |
| IPinfo | Working out country and network provider from an IP address | US |
Processors are bound by data-processing agreements. Push notifications are encrypted end to end, so a push service delivers them without being able to read them. Product analytics runs on our own database — there is no third-party analytics service and no analytics data leaves our infrastructure.
7. International transfers
We are based in the United States and some processors are outside the European Economic Area. Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
8. How long we keep it
- Account data: while your account exists, then deleted within 30 days.
- Questions to the oracle and its answers, dreams, readings and journal entries: while your account exists, or until you delete them. A button in Settings → Data and privacy deletes your history of questions and dreams without deleting the account.
- Inactive accounts: if you do not sign in for 24 months, the account is frozen and we email you. If you still have not signed in 90 days after that, we send a reminder 14 days before deletion and then delete the account and its data. Signing in at any point cancels this.
- Product analytics and first-touch attribution linked to your account: while your account exists; deleted with it.
- Page-view statistics without an account: up to 13 months, then purged.
- Anonymous visit records linked to a device identifier: up to 12 months, then purged.
- Payment and invoice records: as long as tax law requires, typically 7 years. When an account is deleted, they are kept for accounting without your name, email or any link to an account.
- IP addresses and browser details from partner-link clicks: 30 days.
- Server and security logs: up to 90 days.
- Backups: overwritten on a rolling cycle, no longer than 35 days after deletion.
9. Your rights
If you are in the EEA or the UK, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent. Residents of California and several other US states have comparable rights, including the right to opt out; we honour the Global Privacy Control signal.
Several of these are built into the product. In Settings → Data and privacy you can download everything we hold about you, switch analytics storage on this device on or off, object to product analytics on your account, delete your history of questions and dreams, and delete your account. For anything else, write to privacy@septagram.app. We respond within 30 days.
You also have the right to complain to your local data-protection authority.
10. Security
Data is encrypted in transit and at rest. Database access is governed by row-level security, so one account cannot read another's rows. Administrative access is limited and role-based. Payment card details never reach our servers.
No system is perfectly secure. If a breach affects your data and poses a risk to you, we will notify you and the relevant authority as the law requires.
11. Children
The Service is for adults. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, write to privacy@septagram.app and we will delete it.
12. Cookies and local storage
The Service stores a small number of items in your browser, most of them in local storage rather than in cookies. What they are, which ones need your consent and how that depends on your region is set out in the Cookie and local storage policy.
13. Language
This policy is written in English; translations are provided for convenience. If a translated version differs from the English one, the English version governs.
14. Changes
We will post any update here and change the date at the top. For material changes we notify you by email or in the Service before they take effect.
15. Contact
Septagram LLC 30 N Gould St, Ste N, Sheridan, WY 82801, United States privacy@septagram.app