Privacy Policy

Last updated: 11 October 2026

Who this covers

This policy covers the AstroPi app for Android and iOS, and astropi.app. Where a sign-in or payment flow genuinely differs between the two platforms, the difference is stated in the relevant place below; everything else applies to both.

The controller responsible for your data is:
Ahmet Eren Tosun (sole proprietorship)
Am Tierpark 25, 10315 Berlin, Germany
VAT ID: DE455588598
Email: info@astropi.app

Full company details are on the Impressum page.

What we collect

• An account identifier. On first launch the app creates an anonymous account. You do not have to register, and we do not ask for your email to use the app.
• Linking an account (optional). You can link your anonymous account to a personal one: Sign in with Apple on iOS, Sign in with Google on Android. We then receive the name and email address that provider returns, and a profile picture address if it publishes one. If you choose Apple’s Hide My Email, we only ever see the relay address.
• Birth details. The name you give a profile, date of birth, time of birth if you know it, and birth place, stored as the city you picked together with its coordinates and time zone. These are the inputs the chart is calculated from.
• People you add. The birth details of anyone you add for a compatibility reading are kept on your device. They reach us only if you ask Pi to interpret that compatibility. See the AI section below. Add another person’s details only where that person has agreed to it.
• Photographs. The coffee cup or palm photos you take with the camera, or choose from your gallery, for a reading.
• Purchases. Which subscription or credit pack you bought, whether it is active, and your star balance. Card numbers never reach us: payment is handled by Apple on iOS and by Google Play on Android.
• Your daily check-in. The energy level and mood you tap in the daily ritual, and your feedback on ritual tasks.
• How you use the app (iOS). On iOS the app records which days you open it, how often, and which of a handful of screens you looked at, one record per day, for the streaks and pattern summaries it shows you.
• Notification tokens. So that a reading can tell you when it is ready, we receive a token for the device that started it: an Apple Live Activity token on iOS, if you have Live Activities switched on, and a Firebase Cloud Messaging registration token on Android. The token is stored on that one reading and deleted with it. This is separate from the app’s own daily reminders, which are scheduled locally on your device and send us nothing.
• Device details. Platform, app version and build number, when you last opened the app, and an install identifier: a random value the app generates and keeps in its own storage on the device. It is not derived from any device signal; it exists so the one-time welcome credits cannot be minted twice.
• Technical and security records. IP address, request time, service endpoint and result, and installation and app-verification identifiers used to operate the service and prevent abuse.
• Crash reports. Firebase Crashlytics collects crashes, unresponsive sessions and recoverable errors, with device and app versions, diagnostic context and your account identifier. Birth details, photographs and reading contents are excluded.

We do not access GPS or device location services. Birth places are entered by you. With usage analytics enabled, Google derives an approximate country, region or city from the connection IP address; Google Analytics does not log or store that IP address.

Usage analytics

Both apps use Google Analytics for Firebase to understand screen visits, feature use, onboarding, paywall views and purchase flows. On Android we also use it to measure advertising performance and conversions. Data includes event names, product identifiers, purchase amounts and currency where available, outcomes, an app-instance identifier, account type and subscription status, device and app information, and approximate location derived from IP. We do not send your Firebase account identifier, name, email, messages, photographs, birth details or reading contents to Analytics.

In the European Economic Area, the United Kingdom and Switzerland, and when the app cannot determine your region, collection stays off until you allow it. In other regions it is enabled by default. You can decline or turn it off at any time under Profile › Usage analytics and continue using the app normally. On Android, the same choice also controls advertising measurement.

When measurement is enabled, the Android integration can collect the Android advertising ID, where available, and process it with usage and purchase events through Google to measure advertising conversions. Advertising personalization and remarketing are disabled. On iOS, advertising measurement and IDFA/IDFV collection are disabled. The current integration does not send app events to Meta.

Google processes this data under the terms applicable to Google Analytics. See Google Privacy Policy.

Readings are produced by AI

Your readings are produced by a large language model, Google Gemini, and not by a person.

For a coffee or palm reading, the photograph itself is sent to Gemini so it can be interpreted. For astrology and tarot, what is sent is text: your birth details and the chart values calculated from them.

The same applies when you ask Pi about a reading. Your question, up to a dozen earlier turns of that conversation, and the relevant chart context are sent to Gemini, and the reply is stored on your account so it can be shown again. If the question is about compatibility, the chart context includes the name and birth details of the person you added.

Because of this: please do not photograph anything you would not want handled by an external AI service, and do not upload photographs of, or add birth details for, other people without their agreement.

What Google does with it. We use Google Cloud Vertex AI under Google Cloud’s enterprise terms, not the free consumer tier of the Gemini API. Under those terms Google does not use the data we transmit (your photographs, your birth details and your questions) to train or improve its models, and does not use it for any purpose of its own. Google processes it only to return the reading, and retains a short-lived copy for abuse monitoring and to meet its own legal obligations, after which it is deleted on Google’s schedule rather than ours. Google’s handling is described in the Google Cloud Service Specific Terms and the Cloud Data Processing Addendum.

What happens to your photographs

A photo is uploaded to our storage under a single-use permission scoped to one reading, sent to Gemini to produce the reading, and then deleted as soon as that reading finishes, whether it succeeded or failed. If a deletion does not go through, a scheduled cleanup job retries it. Photographs are never moved to the archive described below.

The written reading stays in your history until you delete it or close your account. The image does not.

Who else processes your data

• Google Firebase: usage analytics on both platforms according to the choices described above, and advertising conversion measurement on Android; sign-in, database and file storage on both platforms; push notifications for a finished reading on Android; crash reporting on both platforms; remote feature configuration on iOS.
• Google Cloud Vertex AI (Gemini): generates the readings, as described above.
• RevenueCat: manages subscriptions and entitlements on both platforms.
• Apple (iOS): App Store payments, Sign in with Apple, Lock Screen Live Activities, and turning the birth city you type into coordinates through Apple Maps search.
• Google (Android): Google Play payments and Sign in with Google. The birth-place list on Android is built into the app, so no lookup leaves the device.

We do not sell your personal data or share birth details, photographs or readings for marketing. Providers process data for the services listed above; their roles and obligations depend on the service and its applicable terms.

Why we are allowed to process it

These are our legal bases under the GDPR and UK GDPR:

• To perform our contract with you (Art. 6(1)(b)): producing readings, running your subscription and star balance, keeping your history, and settling refund questions with Apple or Google.
• Usage analytics and Android advertising measurement: where consent is required, your consent (Art. 6(1)(a) GDPR and, for access to or storage on your device, § 25(1) TDDDG). Where applicable law permits processing without prior consent, we rely on our legitimate interest in improving the app and measuring advertising performance (Art. 6(1)(f) GDPR, where applicable). You can withdraw consent or object by switching measurement off in Profile without affecting use of the app.
• Your consent (Art. 6(1)(a)): using the camera or your photo gallery, and sending you notifications. You can withdraw either at any time, in the app or in your device settings.
• Our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse and fraud, and fixing faults. We have weighed these against your interests; you may object at any time.
• Legal obligation (Art. 6(1)(c)): keeping invoice and tax records for as long as German law requires.

Only add another person’s birth details with their permission. If you ask Pi about that compatibility, we process the details to provide the requested feature, based on our legitimate interest in doing so. The person concerned can contact us to exercise their rights.

Do not include health, religious, political or sexual information in your questions. Such information is not required to use AstroPi. We do not use photographs to identify people or perform biometric recognition.

Where your data is processed

We are established in Germany. Our backend runs on Google Cloud in the United States (region us-central1), and the AI that writes your readings runs there too, with one exception: the model used for coffee-cup readings runs on Vertex AI’s global endpoint, so that request may be served from a Google data centre in any region. Google, RevenueCat and Apple may process data in further countries as part of their own services.

International processing is subject to the safeguards applicable to each provider and service, including adequacy decisions or standard contractual clauses where required. You can request information about these safeguards at info@astropi.app.

How long we keep things

• Photographs: minutes. Deleted the moment the reading finishes.
• Readings, Pi replies, birth profiles and your star balance: until you delete them or close your account. Closing your account removes them from the app at once and you will not be able to see them again; they are held in a separate archive for a further 1 year from the end of the calendar year of the deletion, for the sole purpose of defending a legal claim should one be brought (Art. 17(3)(e) GDPR). A scheduled job destroys the archive when that period runs out.
• Check-ins, ritual state and the iOS usage log: until you close your account, then the same 1-year archive.
• Purchase records: the current archive keeps financial records for 10 years from the end of the account-deletion year. A later purchase or renewal extends that archive’s deadline to 10 years from the end of the latest transaction year. These records are restricted to accounting, tax and dispute handling; statutory retention periods vary by record type.
• Technical and security logs: up to 30 days in the ordinary course, and longer only for a specific record we need to investigate an incident or abuse, for as long as that investigation lasts.
• Crash reports: 90 days, then deleted by Google on its own schedule. Because a report carries your account identifier, it is not reached by deleting your account; it expires on its own within 90 days.
• Analytics: event-level data is retained for 2 months and user-level data for 14 months; the user-level period restarts with new activity. Aggregated reports may remain longer. Switching analytics off stops collection and resets the local analytics identifier; it does not retroactively erase data already received by Google. Account deletion also resets the local identifier. For requests about previously collected data, contact info@astropi.app.
• Correspondence with our support address: up to 2 years after the matter is closed, so we can follow up on a recurring problem.
• Welcome-credit eligibility: a hashed installation record is kept for 730 days to prevent repeat claims. It does not contain your account ID and is not removed with the account.

Deleting your account

Use Profile › Delete Account on either platform. This removes your account, birth profiles, readings, Pi replies, balances and activity records from the live service. The separate archive and provider records follow the retention periods above; account deletion is not a promise that every retained record disappears immediately.

Deleting the account does not cancel a store subscription. Cancel through Apple Account › Subscriptions on iOS or Google Play › Payments & subscriptions on Android. For help or access to retained records, contact info@astropi.app; we may request information needed to identify the records.

Your rights

Wherever you live, you can ask us to give you access to your data, to correct it, to delete it, to restrict how we use it, to object to processing based on our legitimate interests, to receive a copy in a portable, machine-readable format or have it sent to another provider where technically feasible, and to withdraw any consent you gave. Withdrawal does not affect what we did while the consent was valid. You are not subject to any decision with legal effect made solely by automated means; a reading constitutes entertainment and not a decision concerning you.

Email info@astropi.app. We reply within one month, and will say so if a complex request needs up to two months more. Exercising these rights is free and we will not treat you differently for it.

If you are unhappy you can complain to a supervisory authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Alt-Moabit 59–61, 10555 Berlin, datenschutz-berlin.de), but you may equally complain to the authority where you live or work: in the UK the ICO, and in Türkiye the KVKK Authority.

Children

AstroPi is for users aged 13 and over. Where local law requires parental permission or a higher age for digital consent, those requirements also apply. Do not use the app without the required permission.

We do not knowingly collect personal data from children under 13. A parent or guardian can contact info@astropi.app about a child’s account or to withdraw permission. The Terms of Use also set out age and purchase requirements.

How we protect your data

We use encrypted connections, provider encryption at rest, account-based access controls and restricted operational access. No system is completely secure. We handle security incidents and any required notifications under applicable law.

Changes

If we change how we handle your data we will update this page and its date. Significant changes will be announced in the app.

Contact