Privacy policy

In this policy, “we” means Alexandra Bendicakova, a private individual based in Belgium who trades as Stars Decoded. We decide how your data is used, which makes us its controller under the GDPR.

Stripe takes your payments. It also uses your payment details for its own needs, like stopping fraud.

Write to hello@mystarsdecoded.com with any question about your data.

• The birth details you enter, for yourself or someone else: a name, birth date, time and place, with the place's coordinates and time zone.
• The chart we work out from them, and the reports we write.
• Your account, if you make one: the ID our sign-in provider gives it and your email address.
• When you share a report or give a credit as a gift: the other person's email address, and the name and note you add.
• The credits you buy and use.
• For each payment: what you bought, the price, when you ticked the box at checkout, and Stripe's reference for the payment. We never see your card details.
• If you start Timeline: your plan, and when it renews or ends.
• If you save a free chart to your account: its birth date, time and place.

We don't collect health data, and reports make no health, medical or clinical claims.

We work out your chart on our servers, from your birth details. OpenAI then writes your report's text from that chart.

OpenAI gets the name you gave and the positions we worked out, never your birth date, time or place. For a Compatibility report, it also gets passages from both Personal reports, and for a parent and child, the child's age.

OpenAI keeps what we send it for up to 30 days to check for abuse, then deletes it. Those are its standard terms for businesses that use its API.

OpenAI doesn't use what we send it to train its models.

The free birth chart is worked out in your browser. The birth date and time you type there reach our servers only if you buy from that page. The words you type in the place field always do, so we can find the place and its time zone.

The birth date, time and place also reach our servers if you save the chart to your account.

Before Stars Decoded launches, you can join the waitlist with your email address. We email you a link, and your address goes on the list only when you click it. The link works for seven days. If you don't click it, we delete your address after seven days.

With your address, we keep the date you joined, the form you used and the wording you agreed to. If the link that brought you had campaign tags, we keep those too. We don't keep your IP address.

We use your address for one thing: to email you when Stars Decoded launches. We delete it once that email has gone out, or sooner if you ask. To be taken off the list, write to hello@mystarsdecoded.com.

The form answers the same way for every address, so nobody can use it to find out who's on the list.

Stripe takes the payments on our checkout page. You type your card details into Stripe's own fields, so they go to Stripe and never reach us.

We send Stripe your email address and what you're buying. Stripe tells us whether the payment went through, and emails you its own receipt.

If you start Timeline, Stripe also takes each renewal. Your Account page opens Stripe's own page, where you can change your card or stop Timeline.

Our payments go through Stripe Payments Europe, which is based in Ireland, in the EU. Stripe takes your payment for us. It also uses your payment details for its own needs, like stopping fraud, as Stripe's privacy policy explains.

These companies run parts of Stars Decoded for us.

• Supabase holds our database: birth details and charts, reports, accounts, what you buy, the people you share a report with or give a gift to, and the waitlist. Based in the United States
• Railway runs our servers. Everything you send us, birth details included, passes through them. Stores data in Railway's EU West region
• Vercel serves our web pages and passes your requests on to our servers. Like any web host, it sees your IP address. It also counts visits to each page, without cookies. Based in the United States
• OpenAI writes the text of each report. It gets the name you gave and the positions we worked out, never a birth date, time or place. Based in the United States
• Clerk runs sign-in and holds your account's email address and sign-in details. Based in the United States
• Resend sends our emails, such as the link that confirms your place on the waitlist, a receipt for what you buy, or a report you share or a gift you give someone. It gets the address each email goes to. Stores data in Resend's EU West region, in Ireland
• Nominatim is OpenStreetMap's place search, run by the OpenStreetMap Foundation. It gets the words you type in the place field. Based in the United Kingdom

Data we send to a company in the United States is covered by the EU's standard contractual clauses or the EU-US Data Privacy Framework.

• Charts, reports, payments and your account: to give you what you asked for. The legal basis is our contract with you.
• The waitlist email: to tell you when we launch. The legal basis is your consent, which you can withdraw at any time.
• Logs of requests to our servers: to keep Stars Decoded secure and working. The legal basis is our legitimate interest in running a safe service.

• Your charts and reports stay until you delete them. Deleting a report removes it, and the birth details behind it unless another report uses them.
• Your account stays until you ask us to close it.
• We keep a record of what you buy, for our accounts.
• If you buy from the free birth chart, we keep the birth date, time and place you entered there. We use them only to fill in your form after you pay. Deleting the report you made from them removes them, and so does closing your account.
• A waitlist address you haven't confirmed goes after seven days. A confirmed one goes once we've emailed you that Stars Decoded has launched.
• A free chart you save stays until you delete it or close your account. You can delete it from your dashboard or your Account page.

You can delete any report yourself, from your dashboard.

Write to hello@mystarsdecoded.com to:

• get a copy of your data, which we email you within 30 days
• correct or delete your data
• close your account
• object to how we use your data

We read that inbox every week.

You can also complain to Belgium's data protection authority, or to the one where you live.

If a breach ever exposes your data, we record what happened. We report it to Belgium's data protection authority within 72 hours of finding out.

We don't use advertising or tracking tools, so there's no cookie banner. Vercel, our web host, counts visits to each page without cookies. We also count how many people take each step towards buying, like seeing the prices, signing in and paying, as one number per day. Neither count tells us who you are. The cookies we do use are below.

Our own cookie, sd_session_id, remembers which charts and reports are yours before you sign in. It lasts a year from your last visit. Clerk, our sign-in provider, sets its own cookies to know whether you're signed in.

On our checkout page, Stripe's payment fields set cookies of their own: __stripe_mid for a year and __stripe_sid for 30 minutes. Stripe uses them to spot fraud.

Some pages also keep a small note in your browser's storage, which stays on your device. Notes marked “This tab” go when you close the tab. The rest stay until you clear your browser's data.

• sd.form.draft This tab The birth details you typed, and the name on the birth form, so you don't type them twice after you sign in or pay. They're deleted as soon as the birth form reads them.
• sd.return_to This tab The page to take you to after you sign in. It's deleted as soon as you leave the sign-in pages.
• sd.keep.chart This tab Only when you save a free chart before you sign in: its birth date, time and place, kept in this tab until you're signed in and the chart is saved to your account. Then it's removed. Closing the tab removes it too.
• sd.pair.selection This tab The two reports and the choices you made for a Compatibility report, so they're still there if you leave the page and come back.
• sd.timeline_in This tab That you went in to Timeline while it was still being set up, so this tab opens Timeline, not the setup screen, when you come back.
• sd.campaign This tab Only when a link with an offer brought you: the offer's code, so this tab shows the offer's price, at checkout too.
• sd.prelaunch.preview This tab Only when we test the site: that this tab shows the site as visitors see it before we launch.
• sd.steps.hidden Until cleared Whether you hid Your first steps on your dashboard.
• sd.marks.<report id> Until cleared Whether a report shows what changed after you updated your birth time.
• sd.sunrise.<report id> Until cleared That a report's opening has played once in full on this device, so it plays short the next time.
• sd.timeline.notnow Until cleared The day you chose Not now on your life's big cycles, and whether they have come back. Your dashboard shows them once more, when your next one is under a year away.
• sd.story.seen Until cleared Which of your Timeline stories you have watched on this device, so their rings show as seen. It keeps the last 24.
• sd_lang Until cleared The language you chose for the site, English or French. It's a cookie, so our servers read it too and send you pages in that language. It lasts a year.
• sd.uncounted Until cleared Only on a browser we use to test the site: that its visits are left out of our counts.