Celestium: Cosmic Compass — Privacy

Effective 2026-07-16 · Provided by WithJhinna (Texas, USA).

This service turns astrology/divination requests into readings for AI agents and, when you explicitly ask, into a shareable web page. This policy describes exactly what we collect, store, and can or cannot read — matched to how the service actually works.

What we collect — only what you send, only when you ask

• Reading inputs (birth date/time/place, questions): sent per request to compute a reading. Not stored unless you opt into a shareable render.
• Shareable renders: only if you pass render, we store that chart + reading behind an unguessable link.
• Couples invites: if you send an invite to compare charts, we relay only end-to-end-encrypted chart data between the two devices — we cannot read it, the key lives solely in the invite link, and the encrypted blob expires automatically and can be revoked.
• Web accounts: You can create an account on celestium.me, with Sign in with Apple, to use Premium on the web. That account, and what it stores, lives on the website only; the app never signs in. Your email and sign-in provider are handled by our identity provider, Clerk.
• Billing: subscriptions are processed by Stripe; we do not store card data.
• Premium on the web: If you subscribe in the app, you can use Premium on celestium.me too: the app sends proof of your purchase to our server, which gives your browser a key. We keep only a fingerprint of that key, the App Store transaction id and when your subscription ends, not who you are.

The Celestium app

• Accounts: There are no accounts in the Celestium app. Nothing you do in the app is tied to who you are.
• Notifications: If you turn on notifications, the app registers an anonymous push token with our server, along with your time zone and language, so we can send New Moon and Full Moon alerts. It is not tied to you or to your chart. Your personal transit alerts are worked out and scheduled on your phone; your chart never leaves it.
• Paid readings: When you buy a Natal Reading, the app sends that chart's birth data, and the name you want on it, with your purchase receipt to our reading server, which writes your reading. We delete the birth data 7 days after your reading is delivered; the reading itself, which carries your name, is kept so you can open it again.
• Erase: Erase all my data (Settings) erases everything Celestium holds on this device and in your iCloud.

Shareable renders — how they’re protected

• Opt-in only — nothing is stored unless you request a render.
• Unguessable link — a 72-bit id; the page is not indexed by search engines.
• Auto-expiry — every render expires (default 90 days; you may set a shorter time, or make it view-once).
• Revocable — you can delete any or all of your renders at any time.
• Encrypted at rest — the storage volume is encrypted. For an encrypted render, we store only ciphertext and the key lives solely in your link — we do not keep it, so we cannot read that render’s contents. For a standard render, the content is readable by our service in order to display the page. We never sell it, and we do not use it for advertising.

Honest limit: a standard (non-encrypted) render is readable by our service while stored. An encrypted render protects the stored contents from us, a breach, or a legal demand — but the link itself contains the key, so anyone you share the link with can read it.

Third parties

• Clerk — authentication / account identity.
• Stripe — subscription billing.
• Fly.io — hosting.

Retention

Renders auto-expire (default 90 days) and can be revoked sooner. Everything else tied to your account is kept until you delete your account. Deleting it removes your account identity at Clerk and, on our servers, your saved renders, linked App Store / Google Play purchases, API tokens and couples invites (see Delete your account). Push tokens are not tied to an account, so they are not part of it; turning notifications off in the app removes yours.

Premium on the web keys expire with the subscription and are deleted 30 days later. With each key fingerprint we hold only the App Store transaction id, the product and the expiry date; never your name, email, account or device. A key is not tied to an account, so it is not part of account deletion.

One exception: billing records. If you had a web subscription and cancelled it, we keep your Stripe subscription id and a note of which follow-up email we sent you, and when. These stay after you delete your account; email us and we will erase them.

Your rights

• Access / portability — signed in, request GET /my/export for your full render data (or contact us).
• Deletion — revoke a render (DELETE /my/renders/:id), revoke all (DELETE /my/renders), or delete your account (which removes everything listed under Retention, except billing records).
• Erasure requests under GDPR/CCPA and similar laws — contact dearjhinna@icloud.com.

We do not sell personal data and do not use it for advertising.

Contact

WithJhinna — dearjhinna@icloud.com.

Changes to this policy will be posted here with a new effective date.