Privacy Policy

1. Scope and Applicability

This Privacy Policy applies to all users of the DharmaChart mobile application (iOS and Android), the DharmaChart website, and any associated services.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, do not use the Service.

This Policy is designed to comply with the Oregon Consumer Privacy Act (OCPA), effective July 1, 2024, and incorporates protections consistent with the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR), and other applicable privacy laws.

The Service is intended for users aged 18 and older. See Section 11 for details.

2. Information We Collect

2.1 Information You Provide Directly

2.2 Information Collected Automatically

2.3 Information Derived from Your Data

We generate derived data from the information you provide, including:

• Natal chart calculations (planetary positions, house placements, aspects)
• Transit analyses computed from current planetary positions relative to your natal chart
• Pattern detections identifying correlations between journal entries, mood data, and transits
• AI-generated interpretations produced by our AI companion
• Energy scores and practice suggestions derived from your transit data

2.4 Voice Recording Processing

DharmaChart has two distinct voice features, handled differently:

• The real-time voice companion streams your microphone audio to Cartesia for live speech-to-text, and the companion’s spoken replies are synthesized by Cartesia (text-to-speech). Audio is processed in real time and is not stored on our servers.
• Journal voice notes are transmitted to OpenAI’s Whisper API for transcription and converted to text. The audio recording is immediately discarded and is never stored on our servers.

Only the resulting text transcription is retained, subject to the same encryption protections as other user-generated content.

3. How We Use Your Information

We use your information exclusively to provide, maintain, and improve the Service. Specific uses include:

• Calculating and displaying your natal chart, transits, and astrological analyses
• Powering the AI companion with relevant personal context
• Generating personalized transit readings, daily briefings, and practice suggestions
• Processing card readings and providing interpretive context
• Storing and encrypting your journal entries for your private use
• Enabling astrocartography features using your location data
• Detecting crisis situations to surface mental health resources
• Sending transactional emails (magic link authentication, password resets)
• Diagnosing technical issues and improving service reliability
• Processing subscription payments

4. Data Storage and Security

4.1 Encryption

We employ Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256) at the field level for sensitive data. The following categories are encrypted at rest:

• Birth data (date, time, and place of birth)
• Journal entries (content, mood tags, themes)
• Card reading interpretations and questions
• Companion chat messages (both user and AI)
• Transit intentions and reflections
• Synastry partner profiles

Fernet encryption means that even in the event of unauthorized database access, encrypted fields are unreadable without the encryption key, which is stored separately from the database.

4.2 Infrastructure

4.3 Access Controls

• Database access is restricted to the application service account
• Administrative access requires multi-factor authentication
• Encryption keys are stored as environment variables, separate from the database
• All data transmission uses TLS 1.2 or higher

5. We Do Not Sell Your Data

Under the Oregon Consumer Privacy Act and the California Consumer Privacy Act, you have the right to opt out of the sale of personal information. Because we do not sell personal information, there is no sale to opt out of.

6. Third-Party Service Providers

We share limited data with the following third-party service providers, solely to operate the Service. Each provider receives only the minimum data necessary.

In-app analytics (6.8) are collected only with your explicit, opt-in consent, which you can grant or withdraw at any time in Settings → Privacy. PostHog data is processed on EU-based infrastructure (Frankfurt, Germany). Session recording is disabled.

Website analytics (6.9) are distinct from in-app analytics. On the marketing website, PostHog is consent-gated: when you first visit, a banner asks for your consent, and nothing is captured until you accept. If you accept, the site sets a cookie and a persistent identifier, captures your IP address and device, and records your session (with any typed input masked). If you decline, no capture occurs. You can change your choice at any time by clearing the site’s stored data. In-app analytics remain strictly opt-in.

7. Data Retention and Deletion

7.1 Retention

We retain your personal data only for as long as your account is active and as necessary to provide the Service.

• Account data: Retained while your account is active
• Journal entries, card readings, companion chat: Retained while your account is active
• Voice recordings: Never retained; transcribed and immediately discarded
• Geolocation data: Used transiently; historical queries are not logged
• Authentication tokens: Expire automatically; refresh tokens rotate on use

7.2 Deletion — “Delete Means Delete”

We do not maintain backups of deleted data. Once you request deletion, the data is gone.

Data shared with third-party providers prior to deletion is subject to those providers’ respective data retention policies. We select providers that do not retain API inputs for training purposes.

8. Your Rights Under the Oregon Consumer Privacy Act (OCPA)

If you are an Oregon resident, you have the following rights under the OCPA, effective July 1, 2024:

• Right to Know. You can confirm whether we are processing your personal data and access that data.
• Right to Correction. You can correct inaccuracies directly within the app’s Settings.
• Right to Deletion. You can delete individual items or request full account deletion, which permanently removes all data.
• Right to Data Portability. The Service includes a built-in data export feature providing your data in a machine-readable format.
• Right to Opt Out of Sale. We do not sell personal data (see Section 5).
• Right to Opt Out of Profiling. DharmaChart’s analyses are for entertainment and self-reflection only and do not produce legal or similarly significant effects.
• Right to Non-Discrimination. We will not discriminate against you for exercising any privacy rights.

How to Exercise Your Rights

You may exercise your rights by:

• Using in-app features (Settings > Delete Account, Settings > Export Data)
• Emailing us at: privacy@dharmachart.com

We will respond to verified requests within 45 days, as required by the OCPA. If we need additional time, we will notify you within the initial 45-day period.

9. Rights for Users in Other Jurisdictions

9.1 California Residents (CCPA/CPRA)

California residents have rights similar to those in Section 8, including the right to know, delete, correct, and opt out of sale. We do not sell personal information.

9.2 EEA, UK, and Switzerland (GDPR/UK GDPR)

• Legal basis: Consent, contractual necessity, and legitimate interest in maintaining security
• Data transfers: Processed in the United States; we rely on Standard Contractual Clauses where required
• Additional rights: You may lodge a complaint with your local supervisory authority
• Contact: privacy@dharmachart.com

9.3 All Users

Regardless of your jurisdiction, we extend the core rights — access, deletion, portability, and correction — to all users of the Service.

10. Cookies, Tokens, and Local Storage

DharmaChart does not use advertising cookies. In-app product analytics (PostHog — Section 6.8) is consent-gated: it stores a pseudonymous identifier in your browser’s local storage and only after you opt in; you can withdraw consent at any time in Settings → Privacy. On the DharmaChart marketing website, analytics are also consent-gated (Section 6.9): if you accept the cookie banner, an analytics cookie and identifier are set so we can recognise returning visitors; if you decline, nothing is stored.

No data stored locally is transmitted to third parties. Local tokens are used exclusively for authenticating with DharmaChart’s own backend.

11. Children’s Privacy

The Service is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 18.

If we learn that we have collected personal information from a user under 18, we will promptly delete that information and terminate the account.

If you believe a person under 18 has provided us with personal information, please contact us at privacy@dharmachart.com.

12. AI Disclaimer

The Service uses artificial intelligence (Anthropic’s Claude and OpenAI’s models) to generate astrological interpretations, card reading analyses, companion responses, and other content.

If you are experiencing a mental health crisis, please contact the 988 Suicide & Crisis Lifeline (call or text 988) or the Crisis Text Line (text HOME to 741741).

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the “Last Updated” date at the top of this document
• Notify you via in-app notification or email
• Provide at least 30 days’ notice before material changes take effect

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acceptance of the updated terms. If you do not agree, you should discontinue use and delete your account.

14. Contact Us

For privacy rights requests, please include sufficient information for us to verify your identity (the email address associated with your account is typically sufficient).

15. Oregon Consumer Privacy Act — Additional Disclosures

15.1 Categories of Personal Data Processed

• Identifiers (email address)
• Personal characteristics (birth date, birth time, birth location)
• Geolocation data
• User-generated content (journal entries, card readings, companion conversations, voice transcriptions)
• Internet or electronic network activity (usage analytics, error logs)
• Inferences drawn from the above (natal chart calculations, transit analyses, pattern detections)

15.2 Purposes for Processing

As described in Section 3.

15.3 Categories of Third Parties

As described in Section 6.

15.4 Categories of Data Shared

• AI providers (Anthropic, OpenAI): Assembled context data; OpenAI also receives journal voice-note audio for transcription and text embeddings
• Voice provider (Cartesia): live voice-companion audio (speech-to-text and text-to-speech) and daily-reading text
• Mapping provider (Mapbox): Geolocation coordinates
• Email provider (Resend): Email addresses
• Error monitoring (Sentry): Technical error data
• Storage (Cloudflare): Uploaded files
• In-app product analytics (PostHog): Pseudonymous usage events and a hashed user identifier
• Website analytics (PostHog): Anonymous, aggregated page-view and interaction events with no identifier

15.5 No Profiling with Sensitive Data

We do not process sensitive data (as defined by the OCPA) for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.