Privacy Notice
This tells you what WhenStars does with your personal data, why, and what you can make us do about it. It describes the app as it actually works today. Where something is not yet built, it says so rather than describing an intention.
Who is responsible
COMPANYA s.r.o., registered IČO 51 816 237, IČ DPH SK2120802222, Obchodný register Mestského súdu Bratislava III, oddiel Sro, vložka č. 129873/B, at Pod Vachmajstrom 13973/13, 831 01 Bratislava, Slovakia, is the data controller. That means we decide what is collected and why, and we are the ones you complain to.
For anything about your data, write to hello@whenstars.com. We have not appointed a Data Protection Officer, because the scale of processing here does not require one under Article 37.
What we collect, and why
Everything below is either something you typed or something the service cannot work without. There is no advertising, no profiling for advertising, and no tracking of you across other sites.
| What | Why we have it | Legal basis |
|---|---|---|
| Your email address | It is your login. It is also how we confirm the account is yours and how you reset a forgotten password. | Performance of a contract, Art. 6(1)(b) |
| Your password | Stored only as an Argon2id hash. We cannot read it, and nobody here can tell you what it is. | Performance of a contract |
| Birth date, birth time, birth place and its coordinates | This is the entire purpose of the app. Without the exact moment and place there is no chart to compute. | Performance of a contract |
| The name you give a chart, and your home time zone | To label your charts, and to decide which calendar day "today" is for you. | Performance of a contract |
| Session records: a hash of the session token, and hashes of your IP address and browser identification | To keep you signed in and to notice an account being attacked. We store one-way hashes, not the address itself. | Contract, and our legitimate interest in keeping accounts secure, Art. 6(1)(f) |
| Purchase records: amount, currency, item and date | To sell you things and to satisfy tax law. | Contract, and legal obligation, Art. 6(1)(c) |
| A one-way hash of your email in the free-trial ledger | So that deleting an account and signing up again does not hand out a second free month. This cannot be turned back into an address or read out as a list of people. | Legitimate interest in not having the free trial abused |
| Server logs kept by our web server | Operating the service and investigating faults and abuse. These contain IP addresses. | Legitimate interest in keeping the service running and defending it against attack |
| Support and administration actions taken on your account | So that "why did I lose access" has an answer. | Legitimate interest in accountable support and in being able to explain our own actions |
| Your product-news choice, if you make one | So that news email goes only to people who asked for it, and stops the moment they stop asking. Described fully at Product News by Email. | Consent, Art. 6(1)(a), optional and withdrawable at any time in settings |
Which of this you have to give us: an email address and a password are needed to create an account at all, and a birth date, time and place are needed to compute a chart, because the chart is a calculation over exactly those facts. If you do not provide them, we cannot provide the service; there is no penalty beyond that. The name you give a chart is yours to choose freely, and everything else in the table arises from using the service rather than from being asked.
We do not use cookies for tracking. Exactly one cookie exists: a first-party session cookie that holds your sign-in, set only once you sign in, readable by nobody but this site and not by any script in your browser. It lives for 30 days or until you sign out, whichever is sooner. It is strictly necessary for the service to work at all, which is why no banner asks you to consent to it. No analytics package is loaded. No third-party script runs on our pages.
Because we do not track anyone across other sites, we do not respond to browser "Do Not Track" signals: the service behaves identically with or without one. No third party collects information about your activity over time and across other websites through this service; the only third party your browser ever contacts is OpenStreetMap, described below, and only when you open the map.
No automated decisions are made about you. Readings are computed automatically from chart mathematics, but WhenStars makes no automated decision with legal or similarly significant effect on you in the sense of Article 22.
A note about what a birth chart is
Your birth data is not, in the wording of Article 9, a special category of personal data. It is not health data, and it is not a statement of religion. We are conscious that an argument could be made that using an astrology service says something about a person's philosophical outlook, so we treat this data with the care that argument would demand whether or not it is required: it is stored in the European Union, it is never sold, never shared for advertising, and never used to build a profile of you for anyone else's purpose.
Who else sees your data
Three companies process data on our behalf or receive it as a consequence of how the app works. There are no others.
- DigitalOcean hosts the service. Your data is stored on a server in Frankfurt, Germany, inside the European Union.
- Brevo (Sendinblue SAS, France) sends our email: account confirmation and password resets. They receive your email address and the contents of those messages.
- The OpenStreetMap Foundation serves the map. This one is different and you should understand it: when you open the map to pick a birthplace, your browser talks to OpenStreetMap directly, so their servers see your IP address and which part of the map you are looking at. We never send them your birth data, but the area you browse can obviously suggest where you were born. If you would rather not, you can type a place name instead: the place-name search runs entirely on our own server from a database bundled with the app, and nothing leaves.
Every third party that processes personal data on our behalf is bound by a data processing agreement to protect it to the same standard this notice describes, as the GDPR requires of processors and as the app stores require of us.
When payments go live, Apple and Google will process purchases made through their stores under their own privacy policies. That is not active yet.
We do not sell your personal data. We have never sold it. We do not share it for cross-context behavioural advertising. Everything we hold about you came directly from you.
Where your data goes
Storage and processing happen in the European Union. Brevo is in France. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission has found to provide an adequate level of protection. There are no transfers to the United States at present.
How long we keep it
- Your account and charts: until you delete them. Deletion in the app is immediate and real.
- Sessions: until they expire or you sign out.
- Purchase records: kept for as long as tax law requires. When you delete your account the purchase is unlinked from you, so the amount, date and item survive for the accounts while nothing connects them to a person.
- The free-trial hash: kept indefinitely. It is a one-way hash and cannot be reversed, which is the only reason keeping it is proportionate.
- Records that you agreed to the terms: if you never paid us anything, they are erased with your account. If you ever made a purchase, a pseudonymised copy (a one-way hash in place of your identity, plus the document versions, their fingerprints and the times) is kept for three years after deletion, the limitation period for contract claims, because the law permits keeping what is needed to resolve a dispute about a purchase. After three years it deletes itself.
- Server logs: rotated on the schedule the web server is configured with, normally a small number of weeks.
Your rights
If you are in the European Economic Area or the United Kingdom, you have the right to get a copy of your data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, and to receive your data in a portable form. You can exercise any of them by writing to hello@whenstars.com. We answer within one month.
Two of these deserve a straight answer rather than a formula:
- Correction. If a birth date or time is wrong, you have an unconditional right to have it corrected and we will correct it, free, as many times as it takes. Separately from that right, the app charges for creating an additional chart, because a different birth moment is a different person rather than a correction. If you are fixing a mistake, say so and it is free.
- Portability. There is no self-service export button yet. Ask us and we will send you your data in a machine-readable file. Building the button is on the list.
On consent: exactly one thing here rests on your consent, and that is product news by email, which is optional, asked as its own unticked box, and withdrawable at any time in your settings or by the unsubscribe link such email carries; withdrawing is as easy as agreeing was and affects nothing else about your account. Everything else in this notice rests on the contract between us, on legal obligations, or on the legitimate interests named in the table, which is why the signup checkbox accepts the Terms of Use rather than "consenting" to this notice: a notice is something we owe you, not something you grant us.
You can complain to a supervisory authority: to the one where you live, where you work, or where you think the infringement happened. Our lead authority is the Slovak one, Úrad na ochranu osobných údajov Slovenskej republiky (Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk), because the controller is a Slovak company; complaining to your own country's authority is every bit as valid.
If you are in California or another US state with a privacy law
You have the right to know what we collect, to get a copy, to have it corrected, and to have it deleted, and we will not treat you worse for asking. We do not sell or share personal information as those words are defined by the CCPA as amended, and we have not in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose beyond providing the service. The categories we collect are identifiers, commercial information about purchases, and internet activity in the limited form of server logs, all described above. Write to the same address to exercise any of it.
Children
WhenStars is not for children. You must be at least 16 to hold an account. We do not knowingly collect data from anyone younger, and if we learn that we have, we delete it.
Security
Traffic is encrypted in transit. Passwords are hashed with Argon2id. Session tokens, IP addresses and browser identifiers are stored only as hashes. Chart identifiers are random rather than sequential, so nobody can walk through them to find other people's birth data. Access to the production database is limited to the operator of the service.
No system is perfect. If you find a weakness, please tell us at hello@whenstars.com before telling anyone else, and we will fix it and credit you if you want that.
Changes
If we change this notice we publish a new version with a new number and date. Earlier versions stay available so you can see what you were told at the time. If a change is material, you will be asked to read it the next time you sign in.
Contact
COMPANYA s.r.o.
Pod Vachmajstrom 13973/13, 831 01 Bratislava, Slovakia
hello@whenstars.com