Privacy Policy for Horoscorpio

Version 1.2 · Effective 22 July 2026

This Policy covers Horoscorpio both as the anonymous, read-only mobile app and as the web application (horoscorpio.com) with member accounts. Part A applies to everyone; Part B discloses the additional information handled once you create an account or use the web / social features.

Terms

• Consumer: users of Horoscorpio who have downloaded the app or use the web application.
• Member: a Consumer who has created an account (web / cloud services).
• Horoscorpio: brand of the application developed by Kudomos (ABN 15 384 058 395).
• We, our, us: the development team of Horoscorpio.

Overview

Horoscorpio ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how Horoscorpio — as a mobile application and a web application with member accounts — collects, uses, and protects information when you use our planetary timing, aspect calculation, and planetology services.

Our guiding principle is unchanged: we collect as little as possible, we do not track you, we do not profile you for advertising, and we never sell your information. The web application adds member accounts, which necessarily involve some personal information (an email, a password, an age signal, and anything you choose to contribute). Everything we hold is disclosed below.

---

PART A — Applies to everyone (mobile and web)

Information Automatically Collected

• Server Communications: When the app requests astronomical data, our cloud server provides public planetary position and aspect data to your device. No tracking or personal-data collection occurs during this process.
• Transient network data: Like any web service, our infrastructure (and our providers) may briefly process your IP address and request timestamps for delivery, security, and abuse-prevention. We do not use this to build a profile of you.

Information NOT Collected

Horoscorpio does not collect: your real name — accounts are pseudonymous, identified only by an auto-generated handle (e.g. cosmicSirius), never your legal name; device hardware details; app-usage analytics or performance metrics; crash/diagnostic data; third-party analytics, advertising IDs, or tracking pixels; location data (unless you voluntarily enter a birth place for a natal feature); browsing history; or access to your photos, contacts, or files.

Data Sharing

Horoscorpio does not sell, trade, or rent your information. Disclosures are limited to the service providers listed in Part C and to legal requirements.

---

PART B — Applies to Members (web accounts & social features)

Creating an account or using the web social layer means we necessarily hold more than the anonymous app does. Specifically:

Information You Provide

• Account data: your email address (for login, verification, password reset, and service notices); a password, stored only as a salted PBKDF2 hash (never in plaintext, never recoverable by us); an auto-generated display handle; and your birth year (used only for age assurance — see "Children and Young People").
• Optional profile: social handles you connect (either self-typed or verified via that platform's official sign-in); a short greeting line; notification preferences.
• Contributed content ("canonisations"): the keyword(s) you lodge against a planet-pair and aspect, the orb at the time, method, and timestamp; journal submissions; and group ratings. These form the shared planetology corpus.
• Social / GEO activity: group participation, consent grants (Address / Challenge / Invite / Submit), blocks, and reports you make.
• Birth date / time / place: collected only if you use natal-chart features (a future addition). This is sensitive information, collected with explicit consent and treated with heightened care.
• Support and correspondence: if you contact a Horoscorpio role address or open an in-product support case, we process the sender and recipient addresses, subject, message, language, mail-authentication and delivery metadata, case history, and any files you choose to provide. Correspondence is free-form and may contain sensitive information, so please do not send passwords, recovery codes, payment-card details, or unnecessary private material.

How We Use Member Information

Solely to: run your account and authenticate you; verify your email and enable password reset; assure age and enforce the minimum age for accounts; build the planetology corpus from your consented contributions; form live groups and operate the GEO consent ladder; deliver notices you've opted into; handle support and rights requests; and maintain security, prevent abuse, and moderate the service. Support correspondence may be processed by deterministic rules and, when enabled, a locally operated language model to suggest a category, summary, translation, or reply draft. Model output is advisory: it does not establish identity or entitlement, send a reply, delete a case, change an account, or make a legal or similarly significant decision. Consequential actions require authorised human review.

The Matrix — proximity resonance and aura sharing

The Matrix is an optional Member feature that renders your quality-aura — a colour spectrum derived from keyword contributions you have already lodged — and, with your consent, composes it alongside the auras of other consenting Members. Its handling of information is as follows:

• Consent is specific, informed, and required. The Matrix does not operate unless you affirmatively consent at a purpose-specific prompt, presented the first time you open the feature, that discloses precisely what is shared. Consent may be withdrawn at any time from your account Settings; withdrawal removes you from the shared pool and ceases sharing, and does not require you to uninstall the application (consistent with GDPR Art. 7(3), which requires withdrawal to be as easy as the giving of consent).
• Only quality-keyword data is shared — never personal information. What another Member may perceive of you through the Matrix is your aura (the derived keyword spectrum), under an auto-generated, non-identifying tag. We do not disclose your name, email address, precise location, or contact details through the Matrix. Your legal identity and any connected social handles remain private unless and until you separately grant them through the GEO consent ladder.
• Proximity features (where and when enabled). Where the Matrix offers proximity discovery, your device may exchange a rotating, anonymised presence token over short-range radio (Bluetooth Low Energy) and/or near-field communication (NFC) in order to detect other consenting Members in your immediate vicinity. These tokens carry no personal information and are designed not to be linkable to you by third parties. You are discoverable only while signed in with the feature enabled, and only as an anonymous tag; you become identifiable to another Member solely through mutual, affirmative consent.
• Location. The core Matrix does not collect or store your location. Any future "ambient" discovery layer will use only coarse, approximate location to indicate general areas of compatible activity — never a precise position, and never a bearing toward an identifiable individual — and will be separately disclosed and consented before any release.
• No covert profiling. The Matrix reflects content you contributed and the live sky; it does not infer, score, or reveal anything about your private conduct.

The Planetology Caveats (specific to this service)

• Your profile is contributed, not surveilled. Planetary positions come from cached Astronomy Engine ephemeris calculations — astronomical geometry, not inferences drawn about your behaviour. Legacy NASA/JPL-derived reservoirs may be used only where expressly labelled for validation or backfill. Your "aura"/keyword profile is content you chose to lodge.
• Group matching is not covert profiling. Matches derive from the live sky plus your consented contributions — never from hidden scoring of your private conduct.
• Birth data is sensitive and is minimised, gated behind your account, encrypted in transit, and never shared for marketing.

Member Data Storage, Residency & Retention

• Residency: account and contribution data are stored in Cloudflare D1, Oceania (OC) region.
• Security: passwords are PBKDF2-hashed; the operator console sits behind Cloudflare Zero Trust Access; application secrets are kept in provider secret stores; and traffic is protected with TLS and HSTS. Payment is processed by Stripe: we never receive or store card numbers, only the subscription and billing records needed to provide and account for the service. Account records are generally pseudonymous, but support messages and optional features can contain identifying or sensitive material. Those records are separated by role and purpose, access-restricted, and excluded from model training.
• Retention: account data is kept while your account is active; contributed canon is retained as part of the cumulative corpus (de-identified from you at the aggregate layer). Support and correspondence records are kept according to documented case-category periods and then deleted or de-identified; quarantine and attachments have shorter, separately controlled periods. Legal, financial, security, and safety records may be retained only for the period reasonably required by law or to establish, exercise, or defend a claim. If we suspend or ban an account, we retain the minimum evidence needed to defend the decision, handle appeals, or meet legal obligations — then delete or de-identify it.
• Deletion (DELETE MY DATA): every member account has a Delete my data control in the profile. Using it permanently removes — in one operation — your account; the account-linked copies and attribution of keyword uploads; journal submissions; ratings; GEO activity; group presence; optional profile fields; subscription record; and your stored payment methods at Stripe. Two narrow categories of account-linked records survive deletion, both time-bounded and access-restricted: (a) financial processing records we must keep under tax and audit law (with no remaining operational account linkage), and (b) safety records — contribution attempts that were flagged or rejected by the safety gates, retained for safety review and, where legally required, disclosure to authorities. Separately, Contributions already irreversibly assimilated into the de-identified aggregate global planetology corpus survive without account attribution under the corpus licence in the Terms. Deletion does not unwind the aggregate weights, ranks, classifications, canonical progressions, or derived wordmaps already produced from them. Those corpus results cannot be used to restore the deleted account or re-identify its former member.

Your Member Rights

You may access, correct, export, or delete your account and associated personal data (GDPR Art. 17 / APP 13), object to or withdraw consent for a processing activity, and complain to the OAIC (Australia) or your EU/UK supervisory authority. Withdrawing consent stops future attribution and removes your linkable records, but does not retroactively remove already-aggregated, no-longer-linkable words from the corpus. Requests: [email protected].

---

PART C — Service Providers (all users)

We do not sell your information. We rely on:

• Stripe — payment processing for the web membership and the mobile app sold directly on horoscorpio.com as a one-time purchase. Stripe collects payment details and billing address directly; we receive subscription or purchase status, billing country (for tax), payment confirmation, and the limited billing records needed to provide and account for the service, but never full card details. Stripe calculates and adds applicable GST/VAT/sales tax at checkout and retains transaction records to meet its own financial-law obligations even after you delete your account with us. Governed by Stripe's own privacy policy.
• Regional pricing and language recommendation: the country of your network connection, as seen at our hosting provider's edge, selects the regional price/currency shown to you and a suggested interface language. This is a property of the connection (never GPS, never a device permission) and is not stored as any location history.
• Astronomy Engine sky cache — open-source astronomical ephemeris calculations generated ahead of time and served from Cloudflare storage. No personal data is sent to Astronomy Engine or NASA for the launch runtime path.
• NASA/JPL-derived legacy reservoirs — used only where expressly labelled for validation or backfill. No personal data is sent to NASA.
• Railway — hosts our legacy cloud server (the mobile beta API). May log standard access data.
• Cloudflare (web) — hosting, Email Routing, member and support data stores, security controls, and Zero Trust operator access. Database placement is configured for the Oceania (OC) region where supported, although Cloudflare may process transient routing and security data through its global network.
• Resend (web) — transactional email (verification, reset, notices). Servers in the United States — a cross-border disclosure under APP 8; verifying your email constitutes consent to this transfer.

When local support-triage assistance is enabled, the model runs on operator-controlled infrastructure without cloud-model processing. It receives only bounded, redacted case text and approved support material, has no email-sending or account-management authority, and its output is not used as a private training corpus.

Legal Requirements

We may disclose information only if required by law or to protect our rights, users' safety, and the integrity of the service.

---

Children and Young People

• Under 16 — accounts are not available, worldwide. Registration is refused at the point of signup, so no account, contribution, GEO or payment record is created. We do not knowingly collect personal information from anyone under 16 (COPPA / UK Age Appropriate Design Code / Australian social-media minimum-age framework).
• 16+ — full features. Age is computed conservatively from your birth year (we assume your birthday has not yet passed in the current year), is recorded once at registration, and cannot be changed afterwards; attempts to change it are logged. Circumventing the age gate breaches our Terms.

Aggregate, De-identified Statistics

We may compile and share de-identified, aggregate statistics about how members use the service — for example, how many members contribute in a given language pool, or move between pools — with research, cultural, and institutional partners. These statistics never identify you and never include your words, email, handle, location, or account; they are released only in groups large enough that no individual can be recognised.

Language pools are not countries. A language pool is a community of members who chose that language — it is not a country, territory, or nationality, and we record no member location, so these statistics cannot be produced by country or territory. A pool's statistics say nothing about any state or its citizens; members of one language community span many jurisdictions and writing systems. Where our paid service is not offered for sale in a market, there is no membership there for any statistic to describe, and no statistic may be represented as describing such a market. We do not permit recipients to use pool statistics as a proxy for nationality, citizenship, residency, or territorial claims — nor for profiling individuals, or for political, law-enforcement, immigration, insurance, employment, or credit purposes. We do not sell your personal information.

Data-Breach Notification

If an eligible data breach occurs, we act under our internal Data Breach Response Plan and comply with the Notifiable Data Breaches scheme (AU Privacy Act) and, where applicable, GDPR Arts. 33–34 — notifying the OAIC / supervisory authority and affected individuals as required.

International Users

By using Horoscorpio, you consent to the processing of data as described under Australian legal frameworks, with the additional EU/UK protections noted where GDPR applies.

Changes to This Policy

We may update this Policy from time to time. Significant changes will be notified through app updates or in-app/website notices, with an updated effective date.

Contact Us

Email: [email protected] — Kudomos (ABN 15 384 058 395), Brisbane, Queensland, Australia.

Compliance

This Privacy Policy is intended to comply with: the Australian Privacy Act 1988 (Australian Privacy Principles) and Australian Consumer Law; GDPR / UK GDPR where applicable; CCPA where applicable; and children's-privacy expectations under COPPA and the UK Age Appropriate Design Code.