Privacy Policy

1. What we collect

• Account details — your email address, a display name, and either a securely hashed password or, if you use Google sign-in, the basic profile Google shares (name, email, picture). We never see or store your Google password.

• Birth data — date, time and place of birth, and the coordinates and time zone we derive from the place. This is what the chart is calculated from.

• What you tell the app — the symptoms and states you select, your check-ins, intentions and any free-text notes, and your questions to the AI guide. Some of this may be sensitive; share only what you are comfortable sharing.

• Readings and sessions — the calibrations generated for you, the sessions you run, and the before/after ratings you choose to record.

• Practitioner client records — if you are a practitioner, the client names, birth data and session notes you enter. You are responsible for having your clients' permission.

• Membership status — from our store: the email used at checkout, which product and plan was bought, and when access runs to. We do not receive or store your card details.

• Basic technical data — IP address and request logs kept by our hosting provider for security, rate-limiting and troubleshooting, and the record of when you accepted our terms.

The app also keeps some data in your own browser (local storage) so it opens where you left off. Clearing your browser data removes it from that device.

2. How we use it

To calculate your chart and generate your calibration; to save your readings and sessions so you can return to them; to run your membership and trial; to send the account and service emails you would expect (confirmations, password resets, trial and billing notices); to keep the service secure; and to fix and improve it. Where we look at outcomes across members to improve the method, we use them in aggregate, without names.

3. Who helps us process it

We use a small number of service providers, each only for the job described:

• Vercel — hosts the app and keeps request logs.

• Supabase — hosts the database where accounts, readings and sessions are stored.

• Shopify — runs checkout and billing for memberships and products.

• Resend — delivers our emails.

• Google — if you choose Google sign-in.

• AI model providers — when you talk to the AI guide or write a free-text check-in, the text of that message, together with the chart context needed to answer it, is sent to a model provider (currently DeepInfra, Anthropic and OpenAI, the last for the spoken voice) to generate the response. For the AI guide we send a minimal summary of your reading (signs, states and protocol labels) — never your email, account or payment details, and never your full birth time or birthplace.

• OpenStreetMap (Nominatim) — the birthplace text you type is sent to look up its coordinates.

• Cloudflare — serves the app's audio and images.

We may also disclose information if the law requires it, or to protect someone's safety or our rights.

4. How long we keep it

We keep your account, readings and sessions for as long as your account is open. If you ask us to delete your account we remove them within 30 days, except records we must keep for tax, accounting or legal reasons (for example, the fact that an order was placed). One-time links such as password resets expire within hours.

5. Your choices and rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account, by writing to info@sacredtea.net from the email on your account. Depending on where you live (for example the EEA, the UK, or California and other US states) you may have further rights, including to object to or restrict certain processing and to complain to your data-protection authority. We will not treat you differently for using any of them.

You can unsubscribe from non-essential emails with the link in any of them. Account and billing emails are part of the service.

6. Security

Data travels over encrypted connections; passwords and one-time links are stored only as hashes; access to the database is restricted; and paid access is unlocked only for an email address its owner has confirmed. No system is perfectly secure — if we learn of a breach affecting you, we will tell you as the law requires.

7. Children

Astryx is for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, write to us and we will remove it.

8. International use

Astryx is operated from the United States, and the providers above may process data in the United States and other countries. [DRAFT — counsel to confirm transfer mechanism language for EEA/UK members.]

9. Changes and contact

If we change this policy in a way that matters, we will tell you in the app or by email before it takes effect.

Questions or requests: info@sacredtea.net.