Privacy Policy

NovaOracles is operated by OZGN Studio, which is the data controller responsible for your personal data. We identify ourselves here by the OZGN Studio name and the contact address in section 15. If you need our full identity or contact details to exercise a legal right, ask us at support@novaoracles.com and we will provide them.

Account data, from you: your email address and a password (stored only in hashed form, so we cannot read it), or, if you use a third-party sign-in provider, the email address and name that provider shares with us; your chosen language; the record that you accepted the Terms and confirmed you are 18 or older, with the date and the version accepted; and whether you agreed to receive news and offers by email, with the date of that choice.

Birth and chart data, from you: the date, time and place of birth you enter, with the name or label you attach, any onboarding answers you give, and the charts you save, including charts of other people that you choose to add. We use them to compute your chart and readings. A copy is also kept in your browser's local storage on your device. If you start from a free tool and carry your chart into sign-up, that birth data is held in your browser for up to 7 days, and is stored with your new account.

Content you create, from you: notes, mood entries and other journal content, your tarot collection, and the readings generated for you.

Survey answers, from you: if you answer our short question about why you did not choose a plan, we keep your answer, and any note you add, with your account. A copy without any account link, name or email address is kept so that we can count the answers.

Subscription and payment data: our payment provider collects and holds your payment details and billing information. We pass it your email address and an internal account identifier so that the purchase is linked to your account. If you accepted analytics cookies, we also pass it the analytics identifiers from those cookies, which it returns to us with the payment confirmation so that we can count the purchase in the visit it came from. We receive and store limited information in return: your plan, subscription status, the end of the paid period or free trial, and identifiers of your customer record and subscription at the provider. We do not receive or store your full card number.

Technical data, collected automatically: your IP address, browser and device information, the pages and requests you make, and the cookies and local storage described in section 10. Our hosting provider and our servers keep standard logs. We also count requests per IP address for a short time to limit abuse and keep the paid features and the free tools from being overloaded. Separately, we count clicks on our sign-up and membership buttons per page and per day; these counts hold no identifier, cookie or IP address.

Email data, collected automatically: when you open one of our emails or follow a link in it, we may record on your account which email it was, when, and which link you followed. Opening is noticed through a small image in the email that your mail app loads; if your mail app blocks images, nothing is recorded, and if it loads them in advance, an email may count as opened without being read. Links in our emails pass through our site before they open the page.

Analytics and advertising measurement data, collected automatically and described in section 10: pages viewed, device and browser data, IP address and approximate location derived from it, identifiers in cookies, and the fact that a sign-up, the start of a checkout, a purchase or a renewal took place (with the plan and price). With advertising platforms this can include a one-way hashed copy of your email address when you create an account. This data never includes your birth data, your readings, your notes or your name.

Messages: the content of messages you send us and our replies.

Birth data is not a special category of personal data under the GDPR, but we treat it as sensitive and protect it accordingly.

To create and manage your account, compute your chart, generate and show your readings, and provide the features you ask for: performance of our contract with you (GDPR Article 6(1)(b)).

To take payment, manage your subscription, handle cancellations and refunds, and keep accounting and tax records: performance of our contract with you and compliance with legal obligations (Article 6(1)(b) and (c)).

To keep the service secure, prevent fraud and abuse, enforce our Terms, limit request rates, defend legal claims, and maintain, debug and improve the service: our legitimate interests in running a safe and working service (Article 6(1)(f)), balanced against your rights.

For analytics and advertising measurement, meaning understanding how the service is used and whether our advertising works: our legitimate interests (Article 6(1)(f)). Where the law of your country requires your consent for cookies or similar technologies, we rely on the consent mechanism described in section 10. You can object to this processing at any time with the Decline button or the Cookie settings link.

To see which of our emails are opened and which of their links are followed, so that we send fewer and more useful emails: our legitimate interests (Article 6(1)(f)). You can prevent it by blocking images in your mail app, and every such email has an unsubscribe link.

For any optional marketing message: your consent (Article 6(1)(a)), given with the optional box at sign-up or in Settings, which you can withdraw at any time in Settings or with the unsubscribe link in every such email. We do not send marketing messages unless you have agreed to them. Service emails about your account, your subscription or changes to our Terms are sent regardless, because they are needed to provide the service. If you start a checkout and do not finish it, we may send you one service email about it, within a week, to help you complete it. It contains no offer, and every such email has a one-click link so we do not send it again.

We do not sell your personal data, and we do not use your birth data for advertising.

Your chart is computed from the real positions of the planets by our own engine. Reading texts are written from anonymous astrological categories only, such as zodiac signs and the current transits. No name, email address, identifier, or raw date, time or place of birth is used to write them. The wording depends only on those categories and is the same for everyone who shares them, so it identifies no one.

Your readings are entertainment content. We do not make any decision about you by automated means that has a legal or similarly significant effect on you, and we do not profile you for such decisions.

We share personal data only as needed to run the service, with these categories of recipients, which act on our behalf under contracts that require them to protect it unless stated otherwise: a hosting and content delivery provider; a database and authentication provider; an email delivery provider; our payment provider, which acts as merchant of record and is identified at checkout and which is an independent controller for the payment and tax data it handles as seller; an analytics provider; advertising platforms, including for server-side measurement of ad conversions, which may act as independent or joint controllers for the data they receive for their own measurement and advertising purposes; a third-party sign-in provider, if you choose to use one; and professional advisers, insurers and authorities where needed.

Messaging services: if you contact us through a messaging app or social network, such as WhatsApp or Instagram, that service handles your messages under its own terms and privacy policy.

Place search: when you type a place of birth, the text you type is sent from your browser to a third-party place-search service so that it can suggest matching places. As with any web request, that service sees your IP address. No account or birth details other than the place text are sent with the search.

We may also disclose data if the law requires it, to enforce our Terms, or to protect the rights, safety and property of our users, us or others. In a sale or reorganisation of the service, data may pass to the successor on the terms of this policy. We do not otherwise share your personal data.

Some of our providers, and the advertising and analytics platforms, process data in countries outside the European Economic Area, which may have different data protection rules. Where we or they transfer personal data outside the EEA, we rely on safeguards recognised by the GDPR: an adequacy decision of the European Commission where one applies, or standard contractual clauses with supplementary measures where needed. You can ask us for more information about the safeguards at support@novaoracles.com.

Account, birth, chart, journal and survey data: for as long as your account exists. You can have your account deleted by writing to support@novaoracles.com from the email address of the account. We then cancel your subscription and delete your account and the data attached to it (profile, saved charts, readings, journal entries, tarot collection, survey answers and subscription record). Copies may remain for a limited time in routine backups of our infrastructure providers until they are overwritten. Data held only in your browser stays on your device until you clear it.

Payment, invoicing and tax records: for the period that tax and accounting law requires, which is held mainly by our payment provider as seller, and by us where we must. Records needed to establish, exercise or defend legal claims: until the claim period has ended.

Messages you send us: as long as needed to handle your request and for a reasonable period afterwards. Security and request-rate data: for a short period only. Records of your acceptance of the Terms and age confirmation: for as long as your account exists, and afterwards where needed to defend a claim.

Analytics and advertising data: for the periods set in the analytics and advertising tools we use, which are limited, and no longer than needed for these purposes. Your cookie choice is stored for 12 months.

You are not required to give us personal data to read our public pages or to use the free tools without an account. To create an account and to receive the paid features we need your email address and birth details, because without them we cannot provide the service or the contract. Payment details are required to subscribe. You can use the service without agreeing to analytics and advertising measurement by declining it. Confirming that you are 18 or older and accepting the Terms is required to create an account.

Subject to the GDPR, you have the right to access your data, to have it corrected or deleted, to receive a portable copy, to restrict processing, to object to processing based on legitimate interests (including analytics and advertising measurement), and, where we rely on consent, to withdraw that consent at any time without affecting processing already carried out.

You can edit your birth details in Settings. To delete your account, or for any other request, write to support@novaoracles.com. We may need to verify your identity first. We respond within one month, as the GDPR requires, and will tell you if a complex request needs longer.

You have the right to lodge a complaint with the data protection authority of your country of residence. We would appreciate the chance to address your concern first.

Strictly necessary and functional technologies: cookies and browser storage that keep you signed in, remember your language, your cookie choice, your chart and saved data on your device, a short-lived marker for the checkout step, and short-lived helper values (up to 10 minutes) that carry your confirmation, language and the source tool across a third-party sign-in. These do not track you across other sites.

Analytics and advertising measurement: we use an analytics provider and advertising platforms to count visits, to see which pages are used, and to measure whether our advertising leads to sign-ups and subscriptions. Browser tags place cookies and identifiers and send data such as the pages you view, your device and browser, your IP address and an approximate location, and the sign-up and purchase events described in section 2.

How the choice works. These analytics and advertising tools are switched on by default and run from your first page view until you decline. A banner on your first visit explains this and offers Decline and Accept. If you decline, we stop the browser tags from using cookies and identifiers for analytics and advertising and stop sending browser events and advertising server events to the advertising platforms. You can change your choice at any time with the Cookie settings link at the bottom of every page. Your choice is stored in a cookie for 12 months.

What continues after you decline. Our servers still send a small number of anonymous, aggregate events to our analytics provider (the creation of an account, the start of a checkout, the purchase of a subscription and its renewals), using a random identifier and no cookies, name, email address or user account identifier. The analytics provider's tag may also send limited cookieless signals when you decline. We use these only to count how the service performs.

Server-side measurement. When you create an account or pay for a subscription and have not declined, our servers also report that event to the advertising platforms we use, with a one-way hashed copy of your email address, advertising identifiers from your cookies and, for a sign-up, your IP address and browser details, so that it can be matched to an advertisement. For a purchase the report includes the plan and the amount paid.

Some features create a link that contains the birth details behind a chart (date, time, place and, if you typed one, a name) in the address itself, in plain encoded form. Nothing is stored for the link: the link is the chart. Anyone who has the link can read those details. The address can also be recorded in the browser history of the people who open it, in server and network logs, and in analytics of the page address. Share such a link only with people you trust, and treat it as public once you have shared it.

When you move from a free tool into sign-up, the chart is carried in the part of the address after the "#", which is not sent to our servers, and is then stored as described in section 2.

We take technical and organisational measures that are appropriate to the risk, including encryption in transit, access controls, and database rules so that each account can reach only its own data. No online service can be completely secure. We will notify you and the authorities of a personal data breach where the law requires.

The service is for adults and is not directed to anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact support@novaoracles.com and we will delete it.

We may update this policy from time to time, for example when our practices, providers or the law change. If a change is material we will notify you in the service or by email. The "last updated" date at the top shows the current version.

Data controller: OZGN Studio, the operator of NovaOracles. Privacy contact for any question, request or complaint: support@novaoracles.com.