Privacy Policy

1. Scope

This policy describes how the operator of Celestial (“Celestial”, “we”, “us”), located in the United States, collects, uses, stores and discloses information when you use the Celestial web application and its iOS and Android applications (together, the “Service”). It describes our practices since the Service launched in August 2026. You are not required to provide any personal information, but without a birth date the Service cannot compute a chart or hold a sitting.

2. Information we collect

Information you provide. Birth date, and optionally birth time, birth place and a name, for yourself and for other people whose charts you choose to enter (you are responsible for entering another person's information lawfully); questions and other text you submit; audio you dictate; images you choose to submit; answers you give to in-app prompts; notes you send us; and, if you sign in, your email address (with Apple's Hide My Email, the relay address Apple provides) and the account identifiers, and where the provider supplies it the name and profile picture link, provided by Apple or Google. Text you submit may include information that law treats as sensitive (for example about your health, sex life or beliefs); if you include it, it is processed as described in this policy.

Information generated by the Service. Astrological and numerological computations derived from the information above (charts, transits, readings), the text produced in a Council sitting (each seat's counsel, the analysis and the Judgment), and records you create in the Service (rulings, reckonings, kept items, preferences).

Information collected automatically. A random identifier assigned to your browser; usage events (which screens were reached and which actions were taken, such as a chart cast or a card turned, and for two events which life area or introduction you chose; and, on the website only, when you arrive from outside Celestial, one word from a fixed list for where you came from: the campaign tag of the link you followed (such as “instagram”) or the kind of site that sent you (such as a search engine), never the link itself or the address of the page; each recorded with your browser identifier, the page path and the time); timing measurements of each Council sitting you convene (how many milliseconds each part took to reach your screen: the Steward's answer, each sign's counsel, when the table was complete or you left it, and the Judgment), recorded with the sitting's random identifier, its depth, which signs sat and in what order they reached you, whether the page was hidden while it ran, and whether it ran on the website or in the iPhone or Android application, and never the question, a chart, birth data or anything a sign or the Judgment said; your IP address, which we use for rate limiting and, through our hosting provider, to estimate an approximate location (city and time zone), and which may appear in our providers' logs; if you have granted the Service access to your browser's location, the location your browser reports, the last result of which is cached in your browser to localize the sky; and, when you send a note, a summary of your app's state (from the You orb: your browser identifier, viewport size, whether the app is installed, whether a chart is cast and its birth time known, whether a name was entered but not the name, which engine computed the chart, whether a location is stored, and the number of people and rulings you hold; from Help & Support: the first 120 characters of your browser's user-agent string). Neither summary includes a chart's contents.

Cookies and tracking. We set first-party cookies only for memberships, purchases and invitations, and none contains a name or chart data. cl_sub holds the random token that identifies a membership or a purchase; it is refreshed on each visit while the token is present and may persist for up to 400 days after your last visit. cl_own holds the tokens of readings bought in this browser and may persist for up to 400 days after the last purchase. cl_pass holds a signed pass for an invitation redeemed in this browser, and cl_invited marks that one is present; both last up to 90 days. cl_anon holds a random identifier this site issues to a browser the first time the Council's page is opened without an account, while free sittings are offered to visitors; it identifies that browser's one free sitting and nothing else, we store only a one-way hash of it with the sitting's count and identifier, it is read by the server alone, and it may persist for up to 400 days after your last visit; signing in on that browser links it to your account, once. None is removed when a membership lapses or is canceled; “Clear this device” in Settings removes them all, and so does clearing your browser's site data. We do not track your activity across other websites or services, we do not permit third parties to do so through the Service, and we do not use advertising cookies or third-party tracking cookies. Because we do not sell or share personal information, browser Do Not Track and Global Privacy Control signals do not change how the Service treats you.

3. Where information is stored

On your device. Your birth data (including any name you entered), charts, people, rulings and reckonings, kept items, the Horizon and its pictures, the Universe conversation, your answers to in-app prompts, your handle and bio, your membership and purchase tokens, the cached location described above, preferences and related records are stored in your browser's storage on each device you use. Clearing that browser's site data removes that device's copy; in the iOS application there is no site-data control, and the application's storage is removed as a whole only by deleting the application. Some copies are outside site data, including notifications already scheduled by the iOS application (which may contain text derived from your chart and the name of a person you entered, and which are canceled only by “silence it” on the bell), browser history entries for Compare Skies links, whose address contains the birth data they carry, and copies you make yourself (exported files, downloaded images, saved links).

On our systems, including at the providers named in Section 5, we store:

• Sittings. Once you have cast a chart, and unless you turn off “Let the Council learn from my sittings” in Settings on that device (the setting belongs to that browser and does not travel with the account copy), each Council sitting is stored: the question and its sharpened form; the context provided to the model (your placements, transits, the year's house and numbers; the name, numbers and placements of any companion or other person included in the sitting; any context you typed; and, if an earlier version of the Service stored a distilled portrait in your browser, that portrait); your birth date, time and place with coordinates and time zone; each seat's counsel; the analysis; the Judgment; the sitting's depth and date; the date and version of the terms you accepted; and an identifier for you (your account identifier if signed in, otherwise your browser identifier). The Service does not add the name you entered for yourself to this record; any name that appears in text you type is stored with it.
• Question log. For the first turn of each sitting, regardless of the setting above and whether or not you have cast a chart, the question text, the sitting's depth and its stakes grade are stored without any account or browser identifier. Because nothing ties this record to you, it cannot be deleted at your request.
• Account copy. If you sign in and “Sync across devices” is on, a copy of what the Service stores in your browser under its own keys — the items listed under “On your device” above except the Horizon's pictures, your membership and purchase tokens and the cached location, together with your other preferences and any invite token — is stored under your account, with a device description and timestamp. It does not include the settings that record a choice made in one browser (syncing, “Let the Council learn from my sittings” and the terms you accepted), your Founder seat or its token, or your browser identifier. This copy is stored in a form we can access.
• Content you share. Judgments you share, items you share from your Horizon, lines you leave on a person's star, takes and chat messages you post, your open-sky listing if you opt in, and birth data you send in reply to a shared sky (Section 6).
• Operational records. Hashes of membership and purchase tokens, with the payment processor's customer and subscription identifiers and status; push notification subscriptions (the delivery address and keys your browser provides, tied to your account if you are signed in) if you enable the morning bell; usage events; timing measurements of Council sittings; notes you send us; rate-limit and usage-quota counters; records of connections and invitations between accounts; safety records (blocks, mutes and reports made by or about you); and, if you sign in, the sign-in record held by our authentication provider (your email or relay address, the identifiers Apple or Google provide, and any name or profile-picture link you chose to share), which the Service reads to recognize the account that is signed in; and, if you hold a membership given to you as a friend, to show the operator your name (or, where there is none, your email or relay address) on the page where those gifts are managed.

4. How we use information, and the legal bases

To provide the Service, including computing charts and readings and generating Council sittings; to improve the Service, including using stored sittings to develop, train and evaluate the prompts and models that generate Council sittings, and using usage events and notes to identify defects; to operate and secure the Service, including rate limiting; to measure how quickly Council sittings reach you, so that we can make them faster (timing measurements); to process payments and maintain memberships; to deliver notifications you enable; and to respond to you. We do not sell personal information, we do not share it for cross-context behavioral advertising or use it for targeted advertising, and we have not done so since the Service launched. Turning off “Let the Council learn from my sittings” stops stored sittings being used to improve the Council.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with you (providing the Service, processing payments, delivering notifications you enable, responding to you); our legitimate interests in operating, securing and improving the Service (usage events, timing measurements, notes, rate limiting, the question log, stored sittings, the one-trial check); your consent where we ask for it (sign-in, the account copy, push notifications), which you may withdraw at any time in Settings without affecting processing carried out before withdrawal; and compliance with legal obligations.

5. Recipients

We use third-party providers to operate the Service. Each processes information under its own terms and privacy policy. Depending on how the Service is configured, they are: Vercel (hosting; supplies us an approximate location derived from your IP address); Supabase (database, authentication, and sending the sign-in email); Anthropic (generating Council sittings — in which, for a Full Sky sitting or a seat writing a brief or commission, a seat may run up to two web searches through Anthropic's search tool with queries composed from your question — and the Universe conversation); Alibaba Cloud (Model Studio, international edition, in Singapore: when the Service is configured to use it, writing the seats' counsel in a Council sitting — its first round, push-backs, follow-ups, clashes, briefs and commissions — with Anthropic running the web searches a brief or commission makes); Mistral AI (La Plateforme, hosted by default in the European Union: when the Service is configured to use it, writing a seat whose counsel from Alibaba Cloud's model could not be used, with Anthropic writing any seat that neither model's counsel could be used for); OpenAI (speech transcription, when configured, and speech synthesis, when spoken counsel is enabled); ElevenLabs (speech synthesis, when spoken counsel is enabled); Stripe (payment processing, described below); Apple (payment for a membership bought in the iPhone application: Apple takes the payment; with the purchase we give Apple your account's identifier, if you are signed in, so that the purchase can find your account, and Apple's signed record of the subscription reaches us — its identifiers, product, dates, storefront country and price, never your payment details); Upstash (rate-limit and quota counters, keyed by your IP address or a one-way hash of it, the hashed token of your membership, or your account's identifier — the last recording how many times the steps of a free sitting have run for your account, kept so that a free sitting is not run past its bounds — a one-way code derived from the payment processor's identifier for the card a free trial was started with (never the card number), with that trial's subscription identifier, kept for two years so that a second free trial on the same card can be noticed, the counsel of a Council sitting, held for up to two hours, so that its Judgment can be sealed and so that a page whose connection dropped as the sitting ended can be given the words it missed, and, when spoken counsel is enabled, the text of a line to be spoken, held for up to ten minutes under a single-use ticket); Resend (delivering notes you send us); Apple and Google (sign-in, if you choose them); and your browser's push service (Apple's, Google's or Mozilla's, depending on the browser) delivering the morning bell if you enable it. When speech transcription is not configured, as at present, your browser's own speech-recognition service processes dictated audio, which does not reach our servers. Card entry and storage are Stripe's: we never receive the card number or security code. When a purchase is refunded, Stripe's notice to us includes the card's brand, last four digits and expiry, which we do not read or keep. The birthplace search is answered by our own server, from place data published by GeoNames under the Creative Commons Attribution 4.0 license, which we have adapted into a search index; the place name you type goes to no one else.

A Council sitting sends to its model providers (Anthropic and, where they write the seats, Alibaba Cloud and Mistral AI) the question and its sharpened form, your birth date and age, your placements, current transits, the year's house and numbers (the numbers are computed from your birth date and name; the name itself is not sent), the answers you gave to in-app prompts, the chart and name of any companion or other person included in the sitting, any image you submit (a sitting with an image goes to Anthropic only), the prior turns of the sitting, and any distilled portrait an earlier version of the Service stored in your browser; your location, handle and email are not sent. The seating step (the Steward, which a Snap sitting where you choose the seat yourself skips) also receives, as seat names and counts only, which seats' counsel you have followed at least twice and how often it went well; the seats themselves do not receive this. The Universe conversation sends the last twelve turns and your birth date and age, placements, transits and numbers, and, only if you enable it for a named person, that person's principal placements and the angles between your charts. We do not retain on our systems audio you dictate or images you submit to a sitting; the providers that process them do so under their own terms.

We may also disclose information where required by law or legal process, to protect the rights, safety or property of Celestial, our users or others, or to a successor in a merger, acquisition or sale of assets, who will be bound by this policy.

6. Information you choose to share

Card links contain the date, the card and whether it fell reversed, and nothing else. Compare Skies links contain, after the # in the address, the birth date, time and place (with coordinates and time zone) of the sky shared, any name entered for it, whether the sky is given or lent, your Founder seat number if you hold one, and a reply ticket; browsers do not send that part of the address to us, but anyone who holds a link can read what it contains, including the ticket. Creating a Compare Skies link stores an empty ticket record (an identifier and a timestamp, no birth data). If you reply to a shared sky, your birth data (with any name and seat number you hold) is stored under that ticket until it is collected by the holder of the link or removed by us. Judgments you share (the question, each seat's counsel, the analysis, the ruling and the handle you sign with) are stored under a hard-to-guess link; there is no control to remove one yourself and deleting your account does not remove it — use the report link on its page or contact us. Takes and chat messages are visible to anyone who can view the page, under the handle you set or as “Anonymous” if you have not set one. Lines left in commons rooms are stored under a one-way hash of your browser identifier and are periodically deleted once older than 45 days. Items you share from your Horizon are visible to the audience you select. A line you leave on a person's star in your Cosmos is stored under your account identifier and visible only to you and that person. Your open-sky listing is visible to other users until you withdraw it. If you offer your sky to someone in the open sky, your birth data (with any name you give it) is stored at their listing until their device collects it or it is removed by us; only they can collect it, and a search shows others only whether their listing accepts offers.

7. Retention

Data stored in your browser remains until you clear it or your browser removes it. Stored sittings are retained until you turn off “Let the Council learn from my sittings” (which deletes sittings stored under your current identifier), delete your account, or we delete them. The question log, which carries no account or browser identifier, is retained for as long as needed for the purposes in Section 4. The account copy is retained until you use “Delete the copy in my account” or “Delete my account”. Shared content is retained as described in Section 6. Push subscriptions remain until you disable the morning bell or the subscription expires. Usage events, notes and operational records are retained for as long as needed for the purposes in Section 4; timing measurements of Council sittings are deleted 90 days after they are recorded; rate-limit counters expire within minutes, the counsel of a sitting held at Upstash within two hours, and a line held for speech within ten minutes. The record of your free Council sittings (how many were granted, used and reserved, each sitting's identifier, its kind and its estimated and counted cost — never the question or the Judgment) is kept for as long as your account exists and deleted with it; a browser's anonymous session and its one free sitting's record are deleted 400 days after that browser's last visit unless an account claimed it, and retired at once by “Clear this device”.

8. Your choices and rights

In Settings you can export the data stored in your browser, including the Horizon's pictures up to 20 MB (“Export my information”); turn syncing on or off (“Sync across devices” — syncing is also turned on, without the switch, when you cast your chart in the first walk while already signed in, when you bring your account's copy down to a device, and when you restore an exported file that was made while syncing was on); delete the account copy and turn syncing off (“Delete the copy in my account”); stop storing sittings and delete those stored under your current identifier (“Let the Council learn from my sittings”); clear the Service's data from your browser (“Clear this device”); and delete your account (“Delete my account”).

“Clear this device” removes the Service's data from this browser, including the Horizon's pictures, the cookies described in Section 2 and the sign-in session, but not the push subscription on this device or its record on our systems (the morning bell continues until you disable it in Settings), or notifications already scheduled by the iOS application. “Delete my account” deletes the account itself: the sign-in record held by our authentication provider, the account copy, the sittings stored under your account identifier, push subscriptions tied to your account, the Founder seat and the open-sky listing this device holds, and the link between your account and any membership record (a membership bound to the account, and one held by the device you delete from, is set to end at the date already paid for; if one cannot be, the account is not deleted and you are told so; the payment processor keeps its own records of past charges; a membership bought in the iPhone application is billed by Apple and is not ended by the deletion — cancel it in your Apple Account's subscriptions). It then clears the Service's browser data on this device, including the cookies described in Section 2, the sign-in session and stored images. If the deletion does not complete, nothing on the device is removed and you may try again or contact us. Deleting the account does not revoke the “Sign in with Apple” entry under your Apple ID, which you can remove in your Apple ID settings. Records not removed by these controls include sittings stored under a browser identifier before you signed in (turn off “Let the Council learn from my sittings” while signed out on that browser to delete them; we cannot otherwise match them to you), the question log, shared content, your open-sky listing, membership and purchase records, connection records, notes you sent us, safety records and timing measurements of Council sittings (held under the sitting's random identifier rather than your account, and deleted 90 days after they are recorded); contact us to request their removal where we can identify the information as yours.

Depending on where you live, you may have rights to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to lodge a complaint with a supervisory authority. If you are a California resident, you have the right to request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we have disclosed it; to request that we delete or correct it; and not to be discriminated against for exercising these rights. To make a request, email the address in Section 12. We verify requests by confirming the email address on your account; information held only under a browser identifier cannot be matched to a request. You may authorize an agent to make a request on your behalf; we may require the agent's written authorization from you and may ask you to verify your identity directly with us.

9. Security

We use reasonable measures to protect information, including access controls on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. The account copy is not encrypted with a key known only to you.

10. Children

The Service is intended for people aged 13 or older; a person under 18 may use it with the permission of a parent or legal guardian (Terms, “Who may sit”). We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. In the European Economic Area and the United Kingdom, where the law of your country sets a higher age, up to 16, for agreeing to the processing of your information yourself, a person under that age needs the consent of a parent or guardian. If you believe a child under 13 has provided us information, contact us and we will take steps to delete it.

11. International processing and changes

We and our providers may process information in the United States, Singapore, the European Union and other countries whose laws may differ from those of your country. Our providers' terms include their data processing terms, which may include standard contractual clauses for such transfers; contact us for details. We may update this policy; material changes will be posted here with a new date.

12. Contact

Celestial is operated by Pixelated Skies LLC, a Wyoming limited liability company. Questions and requests about this policy: askcelestial.astro@gmail.com.