What we collect and why.

Who is responsible for your data

The data controller is the operator of Kalendom, whose full legal identity—registered name, address, and P.IVA—is set out in our Terms. For any privacy request or question, email support@kalendom.com.

Birth data

To compute your chart we need your birth date, time (when known), and place. This is used solely to compute your chart. When you search for a birth place, the text you type is sent to Mapbox to turn it into coordinates; we store the result against an opaque chartId attached to your account—never your email or name in the same record. Delete your account (Account → Settings) and the chart record is deleted with it—we do that by hand, and confirm within 30 days.

If you never signed in. The backtest builds a chart without an account, and so does the free calculator when it cannot unlock your days in this browser. Until its days are unlocked in this browser, and for any chart made before this update, that record has a chartId and no owner: no email, no name, nothing that identifies you, and nothing we could use to contact you. It is kept so the result link you were given keeps working. To have it removed, send us that link—it is the only way either of us can identify the record—and see deleting your data.

Birth data is processed under GDPR Article 6(1)(b)—necessary to perform the service you signed up for.

Personal events (optional)

You can log real events on dates to compare them against your chart timeline. Events are tied to your account, private by default, and not shared with anyone.

You can also opt in to the anonymous events pool—a research dataset stripped of all identifying fields (no uid, no email, no city). This is off by default, and two switches turn it on: the box in our privacy banner, which can appear once you are signed in or have unlocked your days, and the toggle in Account → Settings. They set the same choice, and you can switch it off in Settings at any time: new diary entries then stay out of the pool, and those already in it stay, because they carry no account we could find them by. Lawful basis: Article 6(1)(a) consent.

Backtest feedback and share cards

When you backtest a day and tell us whether it matched what you lived, we keep that answer so we can publish honest totals—misses as well as matches. The record holds the date, your answer (match, partly or miss), the life area you picked if you picked one, the scores our astrology engine computed for that day, and the name of its strongest transit. It holds no name, no email, no birth data, no account and no words of yours. The chart it came from is stored only as a one-way key, which cannot be matched back to your chart without a separate secret we keep apart from the database. We publish totals only, and never for a group of fewer than ten.

A share card exists only if you choose to share a backtest. It holds a date, the scores around it and your answer—no birth data and no link to your chart—and we remove it if you send us its link.

Lawful basis: Article 6(1)(f), our legitimate interest in publishing an honest, aggregate record of how the astrology engine performs.

Blind tests

A blind test needs no account and no name. You give your birth date and place (and time, if you know it) and five past days; we build a chart from the birth data, score and rank the five days, and record what you then say each day really was.

For each test we keep the five dates, their scores, the labels you give at the reveal (great, awful or ordinary, and a part of life if you name one), the result, and a one-way key for the chart, which cannot be matched back to it without a separate secret we keep apart from the database. We keep no name, no email and no account.

Your birth data for a blind test is deleted 7 days after the reveal, or 30 days after you set the test up if you never reveal it. Until then the test’s page can show your signs and each day’s reasons; after that, the test keeps only its dates, its scores and its result.

At the reveal we also make the test’s result card, a page at its own unguessable link that you can share: the five scores in the chart’s order, your labels and the result—no dates, no signs, no birth data, and no way back to your test.

The public count shows totals only—never a single test’s dates. Where it splits them by the part of life a host named, it never shows a group of fewer than ten tests. A rehearsal is left out of it. A test run on air or for a publication is shown by name only with the written consent of the person who ran it, and only what they agreed to.

To delete a test, its card and its chart at once, open the test on the device you set it up on and use “Delete this test and the chart”. From another device, email support@kalendom.com the test’s link or its card’s link, or your birth date if you have neither. Once a test’s birth data has been deleted, your birth date no longer finds it, but its links still do.

Lawful basis: Article 6(1)(f), our legitimate interest in publishing an honest, aggregate record of the blind tests, misses included. A test shown by name rests on that person’s written consent.

Who processes your data

We keep the list of third parties short, and each has a specific job:

• ·Google Firebase—authentication and secure storage of your account, chart, and unlock state.
• ·Mollie—payment processing at checkout—we never receive or store your full card details.
• ·Mapbox—birth-place search—turning the place you type into coordinates.
• ·Resend—email delivery.
• ·Plausible—cookieless, EU-hosted aggregate analytics—stores no personal data and cannot identify you (see below).
• ·Sentry (Functional Software, Inc.), EU data region: error reports (the page, the browser, the error), without IP addresses or account details, so we can fix what breaks.

Lawful basis for error reports: Article 6(1)(f), our legitimate interest in finding and fixing what breaks on the site.

Payments

Payments are processed by Mollie. Your card or payment details are entered on the processor's secure page and are never seen or stored by us—we only receive confirmation that a payment succeeded, so we can unlock the right account.

If you use the withdrawal form, we keep what you send—your name, the purchase you name and the email address for our acknowledgement—with the date and time we received it and, if you were signed in, your account; support gets a copy of the acknowledgement. We need it to receive and answer your statement (Article 6(1)(c), a legal obligation), and we keep it as the record of that statement for as long as a claim about the purchase is possible (Article 6(1)(f)); deleting your account does not remove it.

Emails

When you pay for an unlock, we always email you a receipt.

If you sign up with an email and a password, we email you a link to confirm your address, and a new one whenever you ask. A link to reset your password is sent only when you ask for it.

We may also email you a one-time notice about a change to your account—for example, when we added a free month to accounts. It does not sign you up for any other emails.

Heads-up emails are sent only if you ask for them—with the box when you sign up, the offer on your dashboard, or the switch in Settings. They tell you a few days before your strongest and hardest stretches for love, money and work, when your free month is ending, and how your month ahead looks. Days inside your unlocked window are named by date; days after it only by area, tone and week, with a link to the unlock.

Every heads-up email has a one-click unsubscribe link, and you can switch them off in Settings at any time.

We keep the language you signed up in, so our emails to you are written in it, until your account is deleted.

We keep the record of your choice (yes or no, when, and where you made it) for as long as your account exists, and the list of emails we sent you for 13 months.

Receipts are part of the service you buy, and the address and password links part of the account you hold (Article 6(1)(b)); one-time account notices rest on our legitimate interest in telling you about a change to your account (Article 6(1)(f)); heads-up emails rest on your consent (Article 6(1)(a)).

Analytics

We use Plausible, a cookieless EU analytics service that stores no personal data and uses no cookies; it cannot identify you. It counts visits and actions on the site, such as starting a sign-up or a checkout, in aggregate (which pages, from where) so we know the site works. We don’t ask for consent because it sets no cookie and identifies no one, but we tell you anyway.

There are no advertising or cross-site tracking cookies, ever.

Cookies and storage

We use the cookies and local storage strictly required to keep you signed in (your Firebase Auth session) and to remember your unlock and consent choices. This browser also keeps a small proof for each chart made in it, so “Delete everything” can find those charts; it goes as soon as it has been used, or with “Delete everything”. There are no advertising or cross-site tracking cookies.

Separately, a few small notes in this browser help our statistics: they stop a step being counted twice. They are not cookies, they identify no one, and they go once used or when the tab closes.

While a sign-in link we emailed you is waiting to be used, this browser keeps your email address with it and, if you asked for the link from a chart, that chart’s birth details, so the link can finish signing you in here. They are used for 24 hours at most, and deleted when you use the link in this browser, or the next time you open Kalendom after those 24 hours.

If you unlock your days without an account, Firebase Auth gives this browser an anonymous session: a random ID with no email and no name, kept in this browser’s storage (IndexedDB or local storage) so that it finds your dashboard again. Your charts, their 30 days and your diary are kept under that ID on our side. To delete them, open Settings in this browser and choose “Delete everything”: the session, your diary and the charts you made and unlocked in this browser are deleted on our side and in this browser at once. A chart someone else also has, one opened from another person’s link, or one made before this update stays. A session with no email or Google that is not used for 90 days is deleted by us in the same way.

We are also running a small design test, which stores a locally stored experiment flag (two values, no identifier) that keeps the test consistent for you across visits. It tells us nothing about who you are and is removed when the test ends.

If you set up a blind test, this browser keeps the test’s link and a private key for it in local storage, so that you can reveal or delete it from the same device. Clearing your browser’s site data removes them.

How long we keep it

Your birth data, chart, and events are kept for as long as your account is active, and are removed when your account-deletion request is completed—which we fulfil by hand and confirm within 30 days, so the record goes when that is done rather than the moment you ask. Days you unlocked without an account—your list of charts, their days, your diary and the charts you made and unlocked in that browser—are deleted when you choose “Delete everything” in Settings in that browser, or by us once its session has not been used for 90 days. Any other chart built without an account—one someone else also has, one opened from another person’s link, one made before this update, or one whose days were never unlocked—is kept until you ask us to remove it. Records of your purchases are kept for as long as tax and accounting law requires us to keep them.

Backtest feedback is kept for as long as we publish the record it counts toward, and a share card until you ask us to remove it.

A blind test and its result card are kept for as long as we publish the record it counts toward, and its birth data for 7 days after the reveal (30 days after you set it up if you never reveal it).

Error reports are deleted by Sentry after 30 days.

To apply the one-free-month rule, we keep a one-way fingerprint of your email address, which cannot be turned back into the address, for 3 years from the day we record it, including after an account is deleted. Basis: legitimate interest (preventing abuse of the free month).

Each set of birth details unlocks its next 30 days once: to keep to that, we keep a keyed fingerprint of the birth details, never the details themselves and no account ID with it, for 36 months from the day those days are first unlocked, including after a deletion, so the same birth details cannot unlock their 30 days again. The fingerprint is an HMAC, under a secret key kept apart from the database, of the birth date, the birth time to the minute and the birth place to about 1 km, stored with the last day of those 30 days, and it is used for nothing else. A chart without a birth time is keyed instead by the account or session it belongs to, and that key is deleted with it, unless the chart was removed from its list before this update; then it is kept for the same 36 months. Basis: legitimate interest (giving each set of birth details its 30 days once).

Your rights

From the Settings page you can review your data, file a birth-data correction, and request account deletion. Deletion is fulfilled by us manually: we remove your chart, events, backtest feedback and share cards, consent state, and entitlement, and confirm at your account email within 30 days. If you unlocked your days without an account, Settings in that browser deletes them at once instead, with the charts you made and unlocked there; a chart someone else also has, one opened from another person’s link, or one made before this update stays until you ask us. EU residents have additional rights under GDPR—rectification, restriction, portability, objection to what we do under our legitimate interest, and the right to lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali). For any of these, email support@kalendom.com.

When we delete a chart on request, after checking the request, we also delete the blind tests run with the same birth data, with their result cards: every test whose own copy of that birth data we still hold. “Delete everything” in Settings never deletes a blind test: a test goes with its own “Delete this test and the chart”, and its birth data on its own schedule.