Privacy Policy
Your privacy matters. This document explains exactly what we collect, why, where it lives, and how you can control it.
This policy is provided for informational purposes and does not constitute legal advice. For specific legal questions, consult qualified counsel in your jurisdiction.
1. Introduction
Welcome to AstroAk ("we", "our", "us"). We are a classical-astrology platform run as a personal, non-commercial project by Raşit Akgül. We are committed to protecting your personal data and being transparent about how it is processed.
This Privacy Policy explains what data we collect when you use our website and services (collectively, the "Service"), how that data is used and shared, where it is stored, and the rights you have under applicable privacy laws including GDPR (EU), KVKK (Turkey), CCPA (California), and LGPD (Brazil).
By accessing or using AstroAk, you agree to the data practices described here. If you do not agree, please do not use the Service.
2. Data Controller
The data controller is Raşit Akgül, a natural person, for personal data processed through AstroAk.
3. Information We Collect
3.1 Information you provide directly
- Account information: email address; when you sign in with Google, we receive only the data you authorize (email, name, profile picture).
- Birth data: full name, birth date, birth time, and birth location (city, country, coordinates, timezone). This is used exclusively to compute your astrology chart.
- People you save: names and birth data of additional people you add to your account for report generation. You can delete these at any time.
- Communication data: messages or feedback you send to support@astroak.com.
3.2 Information collected automatically
- Device and browser information: user agent, language preference, screen size.
- Usage data: pages visited, features used, report generation events (no content of the report itself is logged separately, the report is stored as your data).
- Approximate location: derived from your IP address, never precise GPS. The IP address itself is also used as a rate-limit key on chart, report and other API requests, which sends it to our rate-limit store (see section 6).
- Server logs: IP address, request timestamps, error traces (retained briefly for security and debugging).
3.3 Information from third parties
- Google Sign-In: Google shares your email, name, and avatar with us.
- Open-Meteo: when you type a place name in the chart form, we send only the place text to Open-Meteo to retrieve coordinates. No personal data is attached to that request.
3.4 Forum content you publish
- Forum profile: username, display name, profile picture choice and short bio. The username and the profile page are public.
- Posts, replies and images you publish in the Forum, together with the votes and reactions you give. All of it is public and readable without an account.
- Chart snapshots you choose to attach: planetary positions only. Birth date, birth time, birth place and coordinates are never included.
- Reports you send about another user's content, with the reason you select and any note you add. Reports are visible only to us.
4. How We Use Your Information
4.1 Primary purposes
- Generate personalized natal, health, and synastry reports.
- Calculate accurate astronomical positions via the Celestia engine (Swiss Ephemeris).
- Maintain your account and report history.
- Provide customer support when you contact us.
4.2 Service improvement
- Analyze aggregated usage patterns to improve features.
- Diagnose technical issues using error monitoring (Sentry).
- Develop new modules based on user demand.
4.3 Communication
- Service notifications: account verification and security alerts.
- Reply to your support inquiries from our own mailbox. Account mail is sent by Firebase Authentication, and forum notification mail is sent through Resend.
- Optional product updates only with your explicit opt-in.
5. Report Generation & Automated Decision-Making
AstroAk generates all written interpretations entirely in-house from deterministic templates grounded in classical astrology. We want you to understand exactly how your data is handled.
5.1 In-House Calculation and Generation
All astronomical calculations and all written narratives are produced on our own infrastructure (the Celestia engine wrapping Swiss Ephemeris, and our classical-astrology templates). Your birth data is NEVER sent to any third-party astrology service. Calculations happen on Render.com (EU regional deployment). The same applies to charts requested through our machine interfaces (the MCP server and the public API): birth data is processed for that single reply and is not stored.
5.2 No AI Involved
The reports, the charts and the calculators never involve a language model. Every written narrative comes from our own deterministic classical-astrology templates and from Swiss Ephemeris, and nothing is sent to an AI provider to produce it.
5.3 No Automated Decisions with Legal Effect
AstroAk does not make automated decisions that produce legal or similarly significant effects on you. Astrological narratives are entertainment and self-reflection content, not advice.
IMPORTANT: Astrological content is provided for entertainment and self-reflection only. It does NOT constitute professional psychological, medical, financial, or legal advice.
6. Third-Party Services
We rely on a small set of trusted vendors to operate AstroAk. Each is bound by their own privacy policy.
That vendor policy, linked under each entry below, also governs how long the vendor retains the data and in which regions it processes it; we do not state a retention period or a processing region on a vendor's behalf.
Firebase (Google Cloud)
Authentication and Firestore database
Data: Email, Google account identifier, account profile, reports
Privacy policy →Render.com
Hosts the Celestia (Swiss Ephemeris) calculation engine
Data: Birth date, time and location coordinates for chart calculation.
Privacy policy →Vercel
Web hosting and serverless functions
Data: Server logs, IP addresses, request metadata
Privacy policy →Sentry
Error monitoring and performance
Data: Stack traces, browser info, error context (PII scrubbed)
Privacy policy →Microsoft Clarity
Behaviour analytics (heatmaps, session recordings)
Data: Anonymised interaction data, page navigation, click positions; PII auto-masked
Privacy policy →Upstash Redis
Rate limiting (anti-abuse)
Data: Your account identifier as-is, or your IP address (IPv4 in full, IPv6 shortened to its network prefix), plus a request counter and its expiry. Nothing is hashed
Privacy policy →Open-Meteo
Geocoding (place name to coordinates)
Data: Place name string only, no personal data attached
Privacy policy →Stadia Maps (basemap tiles)
Background map tiles for the astrocartography map
Data: IP address and the requested tile coordinates, only while the astrocartography map is open; served from an EU/US CDN
Privacy policy →Resend
Sending forum notification mails
Data: Your e-mail address, the subject and the body of the mail sent to you
Privacy policy →7. Payment & Billing Data
AstroAk takes no payments and sells nothing on the site: there is no paid tier, no credits and no checkout. Because of that we do not collect, receive or store any payment or billing data: no card number, no CVV, no bank credentials, no billing address.
If you buy a personal reading from Raşit Akgül's Etsy shop, the purchase and payment take place on Etsy, and Etsy processes the payment data and order details under its own privacy policy. AstroAk's website receives no payment data from that purchase. The site only links out to Etsy, and clicking that link sends nothing personal to Etsy beyond what your browser normally sends when it opens a website.
8. Data Storage & Retention
8.1 Where your data lives
- Authentication: Firebase Authentication (Google Cloud, EU region).
- Account data, reports: Firebase Firestore, region europe-west3 (Frankfurt, Germany). EU residency by design.
- Calculation engine: Render.com (EU deployment).
- Frontend: Vercel global CDN; user-facing pages are cached statically where possible.
8.2 How long we keep your data
- Account data: while your account is active. When you delete your account it is erased immediately and irreversibly (see section 8.3).
- Birth data and people: same lifecycle as your account.
- Generated reports: stored under your account until you delete them or your account.
- Server logs: 30 days, then automatically rotated.
- Aggregated, anonymized analytics: up to 24 months.
When you rate an answer as helpful or not helpful, the rating is stored together with your account identifier, where in the app you gave it, any quick labels you select, and the message and session identifiers; it is deleted with your account under section 8.3. Any note you attach is stored with it.
8.3 After account deletion
When you delete your account from /account, all personal data, reports and people are erased immediately and irreversibly. Anonymized aggregate analytics may be retained. For fraud prevention we keep a one-way salted hash that contains no readable personal data. We keep nothing else.
8.4 Forum content
Forum profiles, posts, replies, images, votes and reports are public content and are kept until you delete them or delete your account. Forum images are stored in Google Cloud Storage, part of the same Google and Firebase platform listed in section 6, and are served publicly. When you delete your account under section 8.3, your forum profile, your username reservation and all of your forum posts, replies, images, votes and reports are erased as well. Copies that other people saved or that search engines cached are outside our control.
9. Data Security
We apply layered security controls to protect your data.
- Encryption in transit: TLS 1.3 (HTTPS) for every request, no insecure fallback.
- Encryption at rest: AES-256 in Firebase Firestore and Authentication.
- Authentication: Firebase token-based auth.
- Authorization: Firestore Security Rules ensure each user can only read and write their own data.
- Infrastructure: Google Cloud Platform (SOC 2 Type II, ISO 27001) and Vercel (SOC 2 Type II).
- Rate limiting: Upstash Redis blocks abusive request patterns and brute force attempts.
- Error monitoring: Sentry with PII scrubbing enabled by default. User identifiers (email, name, birth data) are masked by automatic scrubbing rules before any error trace leaves our infrastructure; only anonymized technical traces are retained.
- Periodic review: code audits before each release; dependency updates monitored.
While we apply strong controls, no system is 100 percent secure. We cannot guarantee absolute security against every conceivable threat.
10. Your Rights Under GDPR (EU/EEA)
If you reside in the European Economic Area, you have the following rights regarding your personal data.
10.1 Access and portability
Request a copy of all personal data we hold about you in a portable JSON format. Available as one-click export from your account page.
10.2 Rectification
Request correction of inaccurate or incomplete personal data. Most fields are editable directly from your account.
10.3 Erasure (right to be forgotten)
Delete your account at any time from /account. All personal data is erased immediately and irreversibly.
10.4 Restriction of processing
Request that we limit how we process your data in specific circumstances.
10.5 Object to processing
Object to processing based on legitimate interest, including direct marketing.
10.6 Withdraw consent
Withdraw consent at any time where processing is based on consent. Withdrawal does not affect prior lawful processing.
10.7 Lodge a complaint
You may lodge a complaint with your local data protection authority. We hope you contact us first so we can resolve the issue directly.
To exercise these rights, email privacy@astroak.com or use the in-app account settings. We will respond within 30 days.
11. Users in Türkiye (KVKK)
AstroAk operates in compliance with Türkiye Personal Data Protection Law No. 6698 (KVKK).
11.1 Data Controller
Raşit Akgül, Türkiye. Contact: privacy@astroak.com
11.2 Personal Data Processed
- Email and account data.
- Birth date, time, place.
- Generated reports and saved people.
11.3 Purpose of Processing
Processing serves the purpose of generating personalized astrological reports and maintaining a secure user account.
11.4 Legal Basis
Processing is based on your explicit consent, granted when you create an account and use the Service, and on the necessity of performing the contract.
11.5 International Data Transfers
Data is stored in EU regions (Frankfurt, Germany) by default. Reports and calculations are generated in-house, with no transfer to any language-model service; the chat helper transmits nothing either. International transfer is performed under your explicit consent in accordance with Article 9 of KVKK.
11.6 Your Rights Under KVKK (Article 11)
- Learn whether your personal data is being processed.
- Request information on how it is being processed.
- Learn the purpose of processing and whether the data is used in line with the purpose.
- Know the third parties to whom data is transferred at home or abroad.
- Request rectification of inaccurate or incomplete data.
- Request deletion or destruction.
- Object to results derived solely from automated analysis that adversely affect you.
- Claim compensation for damages arising from unlawful processing.
To exercise your KVKK rights, write to privacy@astroak.com. We respond within the legal time limit (30 days).
12. California Privacy Rights (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the CPRA.
12.1 Right to know
Request the categories and specific pieces of personal information we collected about you in the past 12 months.
12.2 Right to delete
Request deletion of your personal information, subject to limited exceptions (legal compliance, security).
12.3 Right to correct
Request correction of inaccurate personal information.
12.4 Right to opt-out of sale or sharing
We do NOT sell or share your personal information for cross-context behavioral advertising. There is nothing to opt out of.
12.5 Right to non-discrimination
We will not discriminate against you for exercising any of your CCPA rights.
To exercise CCPA rights, email privacy@astroak.com. We respond within 45 days as required by CCPA.
13. International Data Transfers
Your data is primarily stored in the European Union (Frankfurt). When data is transferred outside the EU (for example, via our global content delivery network), we rely on appropriate safeguards.
- Standard Contractual Clauses (SCCs) approved by the European Commission.
- Data Processing Agreements signed with all sub-processors.
- Adequacy decisions where applicable.
- Encryption in transit and at rest for all transferred data.
14. Minors' Privacy
AstroAk is intended for users aged 18 and over. We do not knowingly collect personal data from minors. If the age of majority in your jurisdiction is greater than 18, you must meet that local requirement to use the Service.
If you are a parent or guardian and believe your child has provided personal data without your consent, contact privacy@astroak.com and we will delete it promptly.
16. Changes to This Policy
We may update this Privacy Policy when our practices change or to comply with new regulations. We will notify you of material changes by posting the updated policy with a new "Last Updated" date and, where required by law, by sending an in-app or email notification at least 30 days in advance.
17. Contact Us
Questions, concerns, or requests regarding privacy can be sent to:
We aim to respond within 48 hours; statutory deadlines (KVKK, GDPR, CCPA) apply where relevant.
By using AstroAk you acknowledge that you have read, understood, and agree to this Privacy Policy. Continued use constitutes acceptance of any updates.