Privacy Policy

Effective 2026-07-22

Roastrology turns your real birth chart and today's real sky into a daily roast. To do that it handles some personal data. This explains exactly what, why, who sees it, and how to take it back. We collect the minimum and we never sell it.

Who we are

In plain terms: We're the people who run Roastrology, and we're responsible for your data.

Roastrology is operated by Pablo A. Barquero M., an individual doing business as Vanishing Point ("we", "us"), the data controller, based in Costa Rica. For any privacy question or to exercise your rights, contact us at support@roastrology.ai.

What we collect

In plain terms: Your birth date, time, and place; the chart we compute from it; your roasts; and basic technical data.

Birth details you give us: your birth date, birth time (optional — you can say you don't know it), the UTC offset, and the latitude, longitude, and name of your birth place. Birth time and place can be precise, so we treat them carefully.

Derived data: the natal chart we compute from your birth details, your roast history, and the steering choices you make (which lenses or tones you pick).

Identity: an anonymous random ID stored as a token in your browser. No name, no email, no account is required to use Roastrology.

Account (optional): if you sign in, we store your email address as your account identifier. Sign-in is passwordless via a magic link emailed to you — we never store a password.

Approximate location: when you ask us to use your current location, we read the coarse city/region your network suggests (via Cloudflare). It is only stored if you save it as a birth place.

Precise location (optional): if you explicitly grant it, we read your device's exact location to sharpen the reading to your true ground, and note the region or state it falls in to shape the reading's voice. We store these on your account, never share them, and use them only for the reading. You can turn it off any time in Settings (Sensors), which erases them from our records, and they are also deleted when you delete your account. If you never grant it, we fall back to the coarse guess above.

Payments (optional): if you buy a paid feature, your card details go directly to our payment processor, Stripe — we never see or store card numbers. We keep the record that entitles you: what you bought, when, for how much, and the transaction reference, tied to your account.

Technical data: standard request information (IP address, device/browser type, timestamps) processed by our hosting provider to deliver and secure the service.

How you arrived (acquisition source): if the link that brought you here carries campaign tags (like utm_source) or your browser sends a referring site, we record that once, at your first visit, to learn which doors work. When an ad platform's click identifier is present we note only which platform's tag it was — never the identifier itself.

Why we use it (lawful basis)

In plain terms: To make your roast, with your consent for the birth details and necessity for the rest.

We process your birth details on the basis of your consent, which you give when you submit them (we record the moment you consent). You can withdraw consent at any time by deleting your data (see Your rights).

We process the anonymous token and technical data because they are necessary to provide the service you requested and to keep it secure (our legitimate interest in a working, abuse-resistant product).

Who we share it with

In plain terms: A short list of service providers that help generate the roast. We do not sell your data, ever.

We do not sell your personal data and we do not use it for advertising.

We share data only with providers that operate the service on our behalf: Cloudflare (hosting and edge delivery); Anthropic (the AI model that writes the roast — it receives a prompt derived from your chart and the day's signals); Stripe (payment processing — your card goes to Stripe, never to our servers); Resend (delivers the sign-in and account emails we send you); and read-only public data sources we query to gather "world signals" near a location — geocoding, weather, earthquakes, space weather, news, public holidays, and encyclopedic, statistical, and public-trend references. These receive only the location a lookup needs (a place name or coordinates) — never your identity or your generated roast.

International transfers

In plain terms: Some providers are in the US; we rely on standard safeguards.

Some of our providers (including Cloudflare, Anthropic, Stripe, and Resend) process data in the United States and other countries. Where data leaves your region, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

How long we keep it

In plain terms: Until you delete it. Then it's gone.

Our retention rule is simple: we keep your profile, birth details, chart, roast history, steering events, and (if you have one) your account email until you delete them, after which they are erased from our database (deletion cascades across all of the above, including your account and its security log). We keep a short security event log (sign-in and account events) with your IP address stored only as a salted hash, never in the clear; it is erased with your account.

Two things survive account deletion. First, records of purchases that tax and accounting law require us to keep, for the legally required period — the purchase record only, held to that legal minimum, never your birth details or roasts.

Second, our operator action log. When someone on our side looks up or acts on an account — a support lookup, a plan change, a deletion — we record what was done, by whom, to which account email, and when. We keep that record for 24 months and then delete it. We hold it to stay accountable for our own staff's access to your data, and it has to outlive the account it describes, or it could not answer a later question about the deletion itself. It contains no birth details, chart, or roasts.

Your rights

In plain terms: Access it, take it, fix it, or make us forget you — right here on this page.

You have the right to access your data, receive a copy in a portable format, correct it, delete it, and object to or restrict its processing. If you're signed in on this device, the buttons below do this immediately. If we ever send you reminder emails, every one carries a one-click unsubscribe, and you can withdraw marketing consent at any time. You also have the right to lodge a complaint with your local data-protection supervisory authority.

What we store on your device

In plain terms: One session cookie. No advertising or analytics trackers.

Roastrology sets no advertising or analytics cookies and runs no trackers. To keep you signed in we use one strictly-necessary, secure session cookie (HttpOnly — it never leaves to a third party and scripts can't read it); anonymous visitors get the same strictly-necessary session. Because we use no non-essential tracking, there is no consent banner to click.

To block automated abuse we use Cloudflare Turnstile, a privacy-preserving bot check that runs without tracking cookies. Cloudflare processes limited technical data for this check as described in the Cloudflare Turnstile Privacy Addendum.

Security

In plain terms: Encrypted in transit, hardened headers, and as little data as possible.

All traffic is encrypted in transit. We apply hardened security headers, verify every authenticated request cryptographically, and design for anonymity so there is little to expose. No system is perfectly secure, but we minimize what we hold and how long we hold it.

Children

In plain terms: Roastrology is for people 16 and older.

Roastrology is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact support@roastrology.ai and we will erase it.

Changes to this policy

In plain terms: If it changes materially, we'll update the date and tell you where it matters.

We may update this policy as the service evolves. We'll revise the effective date above and, for material changes, surface a notice in the app.

Contact

In plain terms: Email us. A human (or a suspiciously well-informed cosmos) will answer.

Questions, requests, or complaints: support@roastrology.ai.

Your data, right now

In plain terms: if you have a session, take a copy or erase it for good.

Export or delete everything we hold from your account page.