Legal
Privacy Policy
This policy explains what data The Astro Diary collects, why, who processes it on our behalf, and the choices you have. Plain language, no dark patterns.
Last updated 22 September 2026.
Who we are
The Astro Diary (theastrodiary.com) is a personal astrology app built by Tihomir Videnov under IdeasAllDay. For any privacy question, contact us at the address below — we are the data controller for the information described here.
What we collect
Account data includes your email address, profile name, preferences and sign-in records. Sign-in uses an email code. We store the birth date, time and place you provide for charts, and the content you save: journal entries, people, conversations and goals. Usage events are described below. Payment card numbers go directly to Stripe.
How we use it
To compute your astrological charts and readings, to run the features you use (chat, reports, the daily reading, notifications you opt into), to operate billing, and to understand which features are used so we can improve the app. Your birth data and readings are processed to provide the service to you — not for advertising.
Your journal is private
Saved journal entries are encrypted at rest (AES-256-GCM). They are excluded from public chart sharing, groups and synastry. Features you request, such as a journal reflection, can process the relevant entry. Your own account export includes readable journal entries; protect any file you export or share.
Who processes your data
We use a small set of trusted processors, each only for its stated purpose: PostHog (product analytics), Stripe (payment processing), Amazon SES via a self-hosted email service (transactional and daily emails), OpenStreetMap Nominatim (turning a birth city into coordinates), our own ephemeris service (astronomical calculations), and Anthropic and OpenAI via the Vercel AI Gateway (generating written readings). If you explicitly allow ad measurement, Google and Meta also process limited visit and conversion events, and OpenAI processes limited sign-up conversions from its ads. We never sell your data, and birth data, readings, chats, goals, and journal content are never sent to Google, Meta, or OpenAI for ad measurement.
Analytics
We use PostHog to understand which pages are visited and key actions such as sign-up and upgrade. Browser analytics loads only after your consent, uses page-memory-only persistence and respects Do-Not-Track. With measurement consent, a first-party cookie retains campaign labels, a coarse landing route, a referrer hostname and an anonymous browser ID for up to 30 minutes so same-browser sign-in redirects can be linked to the visit. It contains no birth data, email or signed-in account ID. For signed-in users, events are associated with the account so we can measure real product usage; we do not send PostHog data to advertising platforms for targeting.
Cookies
We use a strictly necessary cookie to keep you signed in. Without measurement consent, browser analytics stays off. The optional astro_acquisition_v1 cookie expires after 30 minutes and is removed on sign-out or consent withdrawal. If Google or Meta ad measurement is configured, their tags do not load until you explicitly allow them; after consent they may set first-party measurement cookies. When you arrive from an OpenAI ad, its ad-click reference is stored only after consent in a first-party cookie for up to 30 days and is removed if you deny or withdraw consent. You can withdraw consent at any time from Privacy settings in the footer.
Data retention
We keep your data for as long as your account exists. Deleting your account (Settings → Danger Zone) hard-deletes your charts, chats, profiles, groups, reports, and journal entries.
Your rights
Depending on where you live (including the EU/EEA under GDPR), you have the right to access, correct, export, or delete your data, and to object to certain processing. You can delete everything yourself from Settings, or email us and we will help.
International transfers
Some processors (for example, PostHog and our LLM providers) are based in the United States, so your data may be processed there under standard contractual safeguards.
Changes to this policy
If we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app or by email.
Optional ad measurement
Ad measurement is off by default. If you opt in, Google and Meta may receive the page URL and limited conversion events when you register or reach your first useful reading. If a registration follows an OpenAI ad, OpenAI may receive a sanitized page URL, its ad-click reference, one-way hashes of your email and account ID, and standard request data such as IP address and browser user agent. OpenAI does not receive the raw email or account ID. We use this only to measure campaign results and never send birth data, chart results, readings, chats, goals, or journal content.
ChatGPT and Codex connection
If you choose to connect The Astro Diary to ChatGPT or Codex, OpenAI receives only the tool results needed for the request. Personalized results may include saved profile names or relationship labels and derived chart positions and aspects. We do not send your password, raw birth date or time, coordinates, timezone, journal entries, chats, or goals through this connection. OAuth connection records remain while your account exists; access can be revoked and tokens expire under the service's security settings. OpenAI processes the data it receives under its own privacy policy and terms.
The iOS app and widgets
Unsaved diary drafts are kept in protected, account-separated storage on your device and excluded from backup. Session credentials use the device Keychain. Widgets receive only a dated lunar snapshot, including its time zone and expiry, through storage shared with the app; they receive no credentials, birth coordinates, diary text or generated readings and make no network requests. iOS controls widget refresh timing. The app uses Apple's App Attest service and sends integrity proofs to our server. If you enable push notifications, device registration includes an APNs token and installation identifier; Apple handles notification delivery when configured. Native server requests can produce account-linked service analytics. The native app embeds no advertising SDK or advertising identifier collection. The browser measurement choices below apply when you use the website.
Contact
Questions about your privacy, or a data request? Email us: hello@ideasallday.com