Privacy Policy

1. Information we collect

• Account information: your name, email address, date of birth, account identifier, and account setup status. Google Firebase Authentication handles your password, sign-in credentials, and email verification. Our application database does not store your password. If you choose Apple or Google sign-in, Firebase receives the name, email, provider account identifier, and any profile photo URL shared by your chosen provider. Starlit uses your name, email, and account identifier for sign-in; the app does not use the profile photo URL. Apple may provide a private relay email address when you choose Hide My Email. Connecting another sign-in method associates it with your existing Starlit profile; we ask for your agreement before doing so.
• Sign-in provider information: when you use Google sign-in on iOS, Google's sign-in software declares collection of name, email address, phone number, approximate location, user and device identifiers, and other usage and technical data. Google declares sign-in functionality and analytics purposes for this processing. Google may estimate approximate location from your IP address to prevent fraud. Starlit's account forms do not ask for a phone number or GPS access; this disclosure includes information handled by the sign-in provider.
• Reading preferences and activity: the genres you choose, books you save or mark as reading, finished, or set aside, and related dates and recommendation records.
• Tarot readings: the cards drawn for your account, their interpretations, the reading type, and dates and times associated with a draw or reveal. We keep these records so you can return to your readings.
• Device and notification information: your device's time zone, operating-system platform, push notification token, notification preferences, and records of notification attempts and delivery results.
• Technical records: requests to our services, timestamps, IP addresses available to our servers or providers, browser or app identifiers in request headers, response status, and error information. Request paths can contain your account identifier.
• Support correspondence: your email address and information you choose to send when you contact us.

The optional question you type before a weekly tarot reading stays in the app's current session on your device. Starlit does not send that question to our server or to an AI provider, or save it to your account.

The app also keeps sign-in state and temporary app data on your device to support your session. We use your device's reported time zone, not GPS location, to time reminders and display dates.

2. How we use it

We use this information to create and authenticate your account, derive your zodiac sign from your birth date, display readings and book recommendations, remember your preferences and library, send notifications you allow, respond to requests, and maintain and protect the service.

Book selections follow Starlit's recommendation rules. Your genres and library activity help determine which selections you see. AI writes interpretive copy; it does not make the season's book-selection decisions.

Starlit does not sell your personal information or share it for cross-context behavioral advertising. The current app does not include advertising trackers. Our sign-in providers may process the information described above for authentication, security, and analytics associated with their sign-in services.

Where applicable law requires a legal basis, we process information to provide the service you request, pursue legitimate interests in keeping it secure and reliable, meet legal obligations, or act on your consent where required. When processing depends on consent, you may withdraw it; withdrawal does not affect processing that was lawful beforehand.

3. AI-generated content

We use OpenAI's API to write horoscopes, tarot interpretations, and explanations that accompany book recommendations.

For a personal tarot interpretation, we send the cards drawn and your zodiac sign. The request may also include seasonal astrological context associated with that sign. We do not include your name, email address, full birth date, account identifier, password, or private tarot question in these prompts.

Shared horoscope and seasonal copy is generated from astrological context and book information, rather than an individual reader's profile.

OpenAI's published API terms state that API inputs and outputs are not used for model training by default; an organization can choose to opt in. OpenAI may retain prompts and responses for abuse monitoring, generally for up to 30 days unless longer retention is legally required, and may keep temporary processing data. See OpenAI's data controls. This is distinct from Starlit's storage of the completed reading in your account.

4. Who receives information

We use service providers to operate Starlit. The information they receive depends on the service they perform:

• Google Firebase: authentication information and associated technical records for sign-in, verification, password reset, and account security. See Firebase's privacy information.
• Apple and Google sign-in: authentication requests and the provider information described in section 1. See Apple's sign-in privacy information and Google's sign-in disclosure guidance. Google's privacy manifest for the iOS sign-in software used by Starlit lists its declared data categories and purposes.
• Railway: hosting for our backend, database, and operational logs, including the account and activity information stored there.
• OpenAI: the content-generation inputs described in section 3.
• Expo, Apple, and Google: device push tokens, notification contents, and delivery information needed to send notifications. The delivery service used depends on your device. See Expo's notification information.
• Google Workspace: the email service we use to receive and answer your support messages, including your email address and correspondence.

People authorized to operate and support Starlit may access information for those purposes. We may also disclose information when required by law, to protect legal rights or the safety and security of the service, or as part of a merger, acquisition, or transfer of the business, subject to applicable privacy obligations.

Book purchase links open external retailers such as Amazon or Bookshop.org. Those retailers handle their own accounts, orders, payments, and privacy practices. Links can contain an affiliate identifier that credits Starlit for a purchase. We do not add your Starlit name, email address, birth date, or account identifier to those links. Retailers may collect browser and device information when you visit them.

5. Retention and deletion

We keep account information, preferences, library activity, and tarot history while your account remains active so the service can remember them.

To delete your account in the app, open Account, choose Delete account, and confirm with your password, Apple, or Google, depending on your connected sign-in methods. For accounts connected to Apple, we also revoke Starlit’s Apple authorization during in-app deletion. This removes your profile, preferences, library activity, tarot history, and notification registrations. If sign-in account removal is temporarily delayed, we finish it automatically; you do not need to submit the request again.

After verifying a deletion request, we delete your account-linked personal data from Starlit's live systems within 30 days and initiate deletion of your Firebase account within that period. This includes your account data, account-linked technical logs, support correspondence, and the temporary record used to complete your request. Copies in backups controlled by Starlit expire within 90 days after deletion from live systems, subject to the limited legal and security exceptions below.

Provider deletion cycles can differ. Google states that Firebase Authentication data is removed from its live and backup systems within 180 days after the customer initiates deletion. OpenAI's processing and retention are described in section 3. These provider periods are separate from the limits for systems controlled by Starlit.

We delete support emails promptly after verifying your request. Google may retain deleted messages for 25 days of administrative recovery, then take up to 180 more days to finish deletion from its systems. See Google's administrative recovery guidance and Cloud Data Processing Addendum.

In-app deletion removes your application data and starts identity deletion. We separately complete any remaining account-linked log and support-record cleanup within the same 30-day deadline. An account is not deleted merely because it is inactive.

We may retain specific information longer when necessary to satisfy legal obligations, resolve a dispute, or investigate security incidents. Any such retention is limited to the information and purpose that justify it. Shared readings and book catalog information that do not identify you may remain after your account is deleted.

Signing out or uninstalling the app does not delete the information in your account.

6. Your choices and rights

You can change genre and notification preferences in the Account screen and manage your saved books in your Library. You can also disable notifications through your device settings. Declining notifications does not prevent you from using the app.

Contact chase.bullock@throughreflection.com to request access to your information, correction of account details, or help with deletion. You can also delete your account directly in the app through Account → Delete account. We may need to verify that the account belongs to you before acting. Do not send your password.

Depending on where you live and the law that applies, you may also have rights to a portable copy of your information, restriction of or objection to certain processing, withdrawal of consent, and a complaint to your local data-protection authority. We will respond within the period required by applicable law and explain any lawful reason we cannot fulfill a request. We will not discriminate against you for exercising privacy rights.

7. Age eligibility

Starlit is for people aged 13 and older, subject to any higher minimum age required by applicable law. If you have not reached the legal age of majority where you live, you need a parent or legal guardian's permission to use Starlit. The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have collected it, we will take steps to delete it as required by law.

If you believe a child has provided information in violation of our eligibility rules, contact chase.bullock@throughreflection.com so we can investigate and take the action required by law.

8. Security and international processing

We use authenticated account access and HTTPS connections to protect information. No internet service or storage system can guarantee complete security.

Starlit and its providers may process information in the United States and other countries where they operate. Firebase Authentication processes information in the United States. Privacy laws in those places may differ from those where you live.

You may contact us to ask about the locations and providers involved in processing your information and the protections that apply. Where the law requires safeguards for an international transfer, we must meet those requirements before making the transfer.

9. Changes and contact

We may update this policy as Starlit changes. We will update the effective date and provide notice of material changes through the app or another appropriate channel. If a change requires consent, we will ask before applying it to the affected processing.

Contact Through Reflection LLC at chase.bullock@throughreflection.com for questions or privacy requests.