ASTRA

Privacy Policy.

Effective: September 17, 2026

The short version. There is no account, no name and no email. Your birth details and saved readings are stored on your phone. Some data does leave it, and this page lists all of it: your birth date, time and place are sent to our server to calculate your chart and are not stored there; questions you type into Ask are sent to OpenAI to write the answer; Google Analytics, Crashlytics and AdMob receive usage, crash and advertising data. In the EU, the UK and several other regions, analytics stays off and ads wait for your consent until you say yes; everywhere, you can change both in Settings. We do not sell data, and nothing you send is used to train AI models.

1. Who we are

Astra: Daily Horoscope & Chart is an Android app published by CodeEnsis Ltd. ("we", "our", "us"), Χριστόδουλου Σώζου 2, EIFFEL TOWER, Floor 3, Flat/Office 301, 1096 Λευκωσία, Κύπρος. CodeEnsis is the controller of the personal data described here. This policy covers the Android app. The website astraastrology.com has its own notice, and the iPhone app Astra Oracle has its own policy.

2. What stays on your phone

The following is kept in the app's private storage and is not uploaded to us:

Your sun sign, the tone you picked and your language.
Your birth date and, if you add them, your birth time and birth place.
Names and signs of people you add for compatibility.
Readings and answers you save, and your notification settings.

Uninstalling Astra deletes all of this.

3. What is sent to our server

Astra's server runs on Google Firebase (Cloud Functions and Cloud Firestore, United States). When you sign in for the first time, Firebase Authentication gives the app an anonymous ID. It is not linked to your name, email or phone number. Every request below carries it.

Horoscopes, tarot and sign profiles: your sun sign, tone, language and the day, week or month requested. The daily reading also sends your Moon sign if the app knows it, and a compatibility reading sends the two signs.
Chinese and druid signs: your Chinese zodiac animal, its element, your druid tree and a year.
Natal chart: your birth date and, if you entered them, your birth time and the coordinates of your birth place. The server uses them to calculate the chart and returns the result. It does not store them. Your phone keeps the result.
Chart notes: planet-in-sign pairs from your chart (for example "Venus in Taurus"), without any birth details.
Ask: the question you type, the voice you picked, your language and the earlier messages of the same conversation. See section 4.

To keep the service from being abused, the server keeps a counter of requests per anonymous ID: the times of your requests over the last 24 hours and a daily count of Ask questions.

4. The AI provider: OpenAI

Readings and answers are written by OpenAI models through OpenAI's API. Currently those are gpt-4.1-mini and gpt-4o for readings and gpt-4o-mini for Ask. What reaches OpenAI:

Readings, tarot, sign profiles, chart notes: only signs, tone, language and dates from section 3. Birth dates, birth places and your anonymous ID are never sent.
Ask: the text of your question and the earlier messages of that conversation. Whatever you write is sent to OpenAI as written, so please do not include your name, contact details, health information or anything else you would not want a third party to process.

Under OpenAI's API terms, data sent through the API is not used to train OpenAI's models, and we have not opted in to share it. OpenAI may keep API data for up to 30 days to detect abuse. See OpenAI's privacy policy.

Our server first checks each question for signs of crisis. If it finds them, the question is not sent to OpenAI and you see crisis-line contacts instead.

5. The shared cache

So that the same reading is not generated twice, answers are cached on our server and shared by everyone with the same inputs. Horoscopes are keyed by sign, tone, language and date. Chart notes are keyed by planet, sign and language. The cache holds no user ID.

The answer to the first question of an Ask conversation is cached for 30 days, keyed by a one-way hash of the question. The question text itself is not stored. The answer may echo what you asked, and someone who asks exactly the same question gets the same answer. Follow-up answers are never cached.

6. Birth place search and map

When you search for your birth place or move the pin, the app asks OpenStreetMap directly: the text you type or the coordinates of the pin go to the Nominatim geocoding service, and map tiles are loaded from OpenStreetMap's tile servers. OpenStreetMap receives your IP address with these requests. See the OpenStreetMap Foundation privacy policy.

7. Analytics and crash reports

Astra includes Google Firebase Analytics and Firebase Crashlytics. Whether they are on by default depends on your region, which Astra decides once, at its first launch, from your phone's language and region setting:

Off until you turn them on in the EU 27, the EEA (Norway, Iceland, Liechtenstein), the United Kingdom, Switzerland, Brazil, South Korea, India and China. Nothing is sent until you do. Astra also keeps them off where Google's ad consent form tells it that EU-style consent rules apply, even if your phone's region setting says otherwise.
On everywhere else, until you turn them off.

Either way, the switch is in Profile → Privacy → Usage stats & crash reports. When you turn it off, nothing more is sent, and crash reports that were not sent yet are deleted from your phone. Your choice is kept across updates.

When they are on:

Analytics receives: the anonymous ID from section 3, an app instance ID, your Android Advertising ID, device model, OS and app version, language, approximate country and city (derived from your IP address), how you got the app (for example a Play Store link someone shared) and events such as screens opened, onboarding steps, readings opened, sharing, ads watched and their revenue, and whether notifications are on. Some events carry the signs you use: sun sign, compatibility signs and score, tarot card, Chinese animal, druid tree and numerology numbers, and whether you entered a birth time and place. Analytics never receives your birth date, time or place, the text of your Ask questions or the names you add.
Crashlytics receives crash and error reports: the stack trace, device model, OS and app version, and a Firebase installation ID.

We use this data to see which features are used and what breaks, and to count ad revenue.

8. Advertising: Google AdMob

Astra shows two kinds of ads, both from Google AdMob:

A native ad at the bottom of the home screen.
Rewarded videos you can choose to watch to unlock the weekly and monthly forecasts, transits, tarot and numerology. So that a video is ready when you tap, the app loads them when it starts.

For every ad request AdMob receives your Android Advertising ID, your IP address and standard device information (model, OS version, language, the app and ad unit). Google uses this to select, show and measure ads, and may show personalised ads. AdMob does not receive your signs, birth details, readings or questions. See how Google uses information from apps that use its services.

Consent in the EEA, the UK and Switzerland. Before any ad is requested there, Astra shows Google's consent form, where you can accept or refuse personalised advertising. Refusing does not block the app: AdMob then shows limited, non-personalised ads, and rewarded unlocks keep working. You can change your answer at any time in Profile → Privacy → Ad privacy choices.

Anywhere, you can also limit personalisation in Android Settings → Google → Ads by deleting or resetting your advertising ID.

9. Other services

Notifications are scheduled on your phone. No push server is used, and nothing about them is sent to us.
Sharing opens Android's share sheet with an image and a Play Store link. The link carries only the kind of card and the signs on it.
Rating uses Google Play's in-app review. Google handles the review, and we only see what you publish on Play.

10. Permissions

Notifications: for the daily reading reminder. You can turn it off in Astra or in Android settings.
Run at startup: so scheduled reminders survive a restart of your phone.
Internet and Advertising ID: for the requests and ads described above.

Astra does not ask for your location, contacts, camera, microphone or photos.

11. Legal bases (GDPR)

Generating readings, charts and answers, including sending your inputs to our server and to OpenAI: performance of the service you asked for (Art. 6(1)(b)).
Request counters: our legitimate interest in preventing abuse (Art. 6(1)(f)).
Analytics and crash reports: your consent in the regions listed in section 7 (Art. 6(1)(a)); elsewhere, our legitimate interest in keeping Astra working and understanding how it is used (Art. 6(1)(f)), with a switch to turn them off. Withdrawing consent does not affect processing that happened before.
Advertising: in the EEA, the UK and Switzerland, your consent given in Google's consent form (Art. 6(1)(a)); elsewhere, our legitimate interest in funding a free app (Art. 6(1)(f)). See section 8.

12. Your rights and deleting your data

You have the right to access, correct, delete, restrict or port your personal data and to object to processing. Analytics and crash reports can be switched off in the app itself (section 7); for everything else, write to support@codeensis.com. You can also complain to your local data protection authority; in Cyprus that is the Commissioner for Personal Data Protection.

On your phone: delete saved items in the app, or uninstall Astra to remove everything.
On our server and in Analytics: everything is tied to the anonymous ID, not to you. Uninstalling Astra discards that ID, so new data can no longer be linked to the old records. If you want those records erased, email us and we will delete the counters we hold and request deletion from Google Analytics for the ID you give us.

13. How long data is kept

On your phone: until you delete it or uninstall the app.
Natal chart inputs: not stored; discarded once the chart is calculated.
Ask answers in the cache: 30 days. Other cached readings contain no personal data.
Request counters and the anonymous ID: until you ask us to delete them.
Analytics: up to 14 months. Crash reports: 90 days.
OpenAI: up to 30 days, as described in section 4.
Support emails: as long as needed to answer, typically no longer than 24 months.

14. International transfers

CodeEnsis is established in Cyprus, EU. Our server (Google Firebase), Google Analytics, Crashlytics, AdMob and OpenAI process data in the United States and other countries. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses in the providers' data processing terms.

15. Children

Astra is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has used Astra and sent us personal data, contact us and we will delete what we can find.

16. Earlier versions

Before v1.0.1 (May 2026), saved readings were also stored in Firestore under the anonymous ID. Later versions copy any such records to your phone on first launch and delete them from our server.

17. Changes to this policy

When Astra starts handling data differently, we update this page and the date at the top.

18. Contact

Questions or requests about this policy: support@codeensis.com. A human reads every message.