Privacy Policy

Dolmastro is operated by an independent developer based in British Columbia, Canada.

1. Data We Collect

When using the Service, we may collect the following types of data:

• Data you provide directly: your name and your date, time, and place of birth (and whether you entered a birth time), which we store on our servers against your account; your sign-in details — your email address and, if you sign up with email, a password (we never see it in readable form; our authentication provider stores it in hashed form); the stocks and markets you choose to follow, the reflections you write in your journal, and any archive requests you submit, which stay in your own browser (see "How your data is actually stored and used" below); and, if you submit a listing-date correction, the ticker, date, and source link you provide. We also store your display name and language setting on our servers. Sign-in with a Passkey is not available yet; if it is added, we will store only the public-key verification data generated by your device.
• Automatically collected technical data: when you access the Service, our hosting provider (Cloudflare) records request logs, including your IP address, browser and device information, and access times, to keep the Service secure and stable. The Service does not currently integrate any third-party analytics tool; if one is adopted in the future, this Policy will be updated to name it here. We use cookies set by our authentication provider only to keep you signed in; we do not use advertising or analytics cookies.
• Third-Party Login: If you sign in using Google, we receive your name, email address, and profile picture from Google. We use this information solely to create and maintain your account. We do not access your Google password or any other Google account data beyond what is listed here.

We do not proactively collect sensitive personal data (such as health or religious information) from you, unless you voluntarily provide it through a channel such as feedback.

How your data is actually stored and used: your birth details are saved on our servers (our database provider is listed in Section 3) and linked to your account, protected by database access rules so that other users cannot read or change them. We access them only to operate the Service or when you ask us to. When you open the Service they are retrieved and your astrological readings are calculated on your device in real time; they are not sent to any third-party AI service. This means: (1) your birth details are available whenever you sign in, including from another device or browser; (2) clearing your browser data does not delete them from our servers — to have them deleted, see Section 4. Separately, some items are kept only in your own browser, on the device you use, under your account's ID, and are not sent to our servers: the stocks and markets you follow, the reflections you write in your journal, your archive requests, your record of accepting the Terms, and your language and display preferences. For these: (3) if you clear your browser data, or switch devices or browsers, they will be lost and we cannot restore them; (4) signing out does not delete them — they stay on that device and reappear when you sign in again — so on a shared device, clear your browser data if you do not want them to remain. (5) Once the Service opens paid features, we plan to introduce server-side AI-generated personalized readings, at which point your birth data would be sent to Anthropic's AI service for processing as described in Section 3 below — we will update this Policy and notify you before that feature actually goes live.

2. How We Use Your Data

• Birth data is currently used to compute astrological calculations on your device in real time (see "How your data is actually stored and used" above); once the paid AI-personalization feature launches, it will additionally be used to generate that content, and this Policy will be updated accordingly at that time.
• We do not sell your personal data to third parties for advertising purposes.

3. Data Storage and Third-Party Services

Some features of the Service rely on third-party service providers to operate, including but not limited to:

• Content-generation service (planned, not yet live): the Service plans to use Anthropic's (Claude) AI technology to process your birth data and watchlist to generate personalized readings, once paid features open. This feature is not live yet; we will update this Policy and notify you within the Service before it goes live.
• Cloud hosting service: Cloudflare, used for the Service's server-side computation and data transmission.
• Database and authentication service: Supabase, which hosts our database (your account, sign-in credentials, and birth details) and handles sign-in. Our database is hosted in Singapore (Supabase region ap-southeast-1).
• Email delivery service: Resend, used to send account-related emails such as the sign-up confirmation email; it receives your email address.
• Listing-date lookup: when you add a stock, we first look up its first public trading date in our own database, which is built from public sources (exchange filings and announcements, and U.S. SEC EDGAR filings). If it is not there and the ticker you enter looks like a U.S. one, that ticker may be sent, through our servers, to U.S. SEC EDGAR to look up its date. What is found is stored in our database as shared reference data and is not linked to your account. The company name you enter is not sent. Your birth details are not sent either.
• Once paid features launch, payments will be processed by Waffo Pancake, which acts as the merchant of record for transactions. Waffo states that it is a PCI DSS service provider and is assessed for compliance every year by an independent Qualified Security Assessor (QSA). We do not receive or store your full card number.

These providers may process some of your data, but only to the extent necessary to provide the services listed above. We only use service providers that have appropriate data-protection measures in place.

4. Data Retention and Deletion

You can delete your account at any time in the app: More → Account → Delete account. This permanently deletes your account, birth details and natal chart from our database. Listing dates you submitted that were approved remain in the public data, no longer linked to you. Usage records are kept for cost and service monitoring, with the link to your account removed. The service providers we use, such as email delivery and web hosting, may keep service records like email delivery logs and access logs for a limited period under their own policies. Deleted data may also remain in system backups for a limited period before being removed automatically. You can also contact dolmastro@gmail.com.

5. Your Rights

The Service's primary target users are in Hong Kong, Taiwan, and Macau, but because it's delivered via the web / app stores, actual users may come from other regions. Accordingly, the rights available to you under your local law may include the following (which apply depending on your actual location — not every item applies to every user):

• Hong Kong users: under the Personal Data (Privacy) Ordinance, you have the right to access and correct your personal data.
• Taiwan users: under the Personal Data Protection Act, you have the right to inquire about, review, copy, supplement, correct, request cessation of collection/processing/use of, or delete your personal data.
• Macau users: under the Personal Data Protection Act, you have similar rights of access and correction.
• EU / European Economic Area users: under the General Data Protection Regulation (GDPR), you may have the right to access, rectify, erase ("right to be forgotten"), port your data, and lodge a complaint with your local data protection authority.
• California, U.S. users: under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), you may have the right to know, delete, and opt out of the sale/sharing of your data (we do not sell personal data).
• Users in other regions: if applicable personal-data-protection law exists where you live, we will handle your request in accordance with that law.

Regardless of where you're located, if you'd like to exercise any of the rights above, please contact us and we'll respond within the timeframe required by applicable law.

Cross-border data processing note: some third-party technical service providers this Service relies on (e.g. the AI service planned for content generation, our database provider in Singapore, our cloud hosting provider) may transmit your data to countries or regions outside your own for processing (including Singapore and the United States). We only use service providers that have appropriate data-protection measures in place.

6. Minors

The Service does not knowingly provide service to, or collect personal data from, anyone under 18. If you become aware that the Service has collected a minor's data, please contact us so it can be deleted.

7. Changes to This Policy

We reserve the right to modify this Privacy Policy at any time. The revised version will be posted within the Service. If there are material changes, we will notify you within the Service.

8. Contact

For privacy questions, or to request access to or correction or deletion of your personal information, contact dolmastro@gmail.com.

See also our Terms of Service.