Soraya

Privacy Policy

Last updated: 12 October 2026

This is a translation. In case of any discrepancy, the German version applies.

1Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

2Overview: which data we process

Soraya is an astrology application. To provide its features we process the following personal data:

• Account data: your email address, an encrypted password (for sign-up and login) and the app language you chose.
• Birth data: name, date of birth, optionally time and place of birth — required to calculate your birth chart, your analyses and the partner match (synastry).
• Quick start without an account: if you enter your date of birth (optionally the time) on the home screen without logging in, it is only sent to our backend to calculate your sun and moon sign and is not stored there. The result stays locally on your device. To prevent abuse, your IP address is briefly counted in memory (at most until the end of the day, not stored permanently).
• Partner invitation: if you share an invitation link, the invited person only sees your first name and your sun sign and your joint result as a percentage – never your date, time or place of birth. If the invited person enters their date of birth, it is only transmitted for the calculation and not stored. We only count how often a link was used. The link is deleted together with your account.
• Data about other people: if you add a second person for a partner match, we process their name and birth data. Please only add such data with the consent of the person concerned.
• Chat content: messages you enter in the dialogue with “Soraya” and the generated answers.
• Technical data: when the app is accessed, the usual access data arise on the server side (e.g. IP address, time, browser type).
• Usage and error events: when you are logged in, e.g. “app opened”, “horoscope loaded” or a technical error message (see section 3).

3Local storage and usage statistics

Soraya stores some information locally in your browser (localStorage), e.g. your session, your language, the app configuration and a cache of your people. This data remains on your device and is used to operate the app. No cookies for advertising or tracking purposes are set and no third-party analytics or advertising services are used.

So that we can detect errors and improve the app, Soraya stores simple usage and error events for logged-in users in our own database (Supabase), together with your user ID: e.g. which section was opened, that a horoscope or analysis was loaded, and technical error messages. Content such as chat messages or birth data is not recorded. The legal basis is our legitimate interest in a stable, working service (Art. 6(1)(f) GDPR). These events are automatically deleted after 180 days and removed immediately together with your account. You can object to this processing at any time by email.

Origin via links: If you open Soraya through a link from one of our social media posts or profiles, the link contains a short code for that post (e.g. “p123”). The app keeps it locally in your browser for up to 7 days. We only count anonymously how often such a link was opened and the quick start was used (pure numbers, not linked to any person). If you then sign in, the code is stored once together with your next usage event, so that we can see which posts lead to new accounts. The same legal basis and the same deletion period as above apply.

4Purposes and legal bases

• Performance of a contract (Art. 6(1)(b) GDPR): providing the account, horoscopes, analyses, partner match and chat.
• Consent (Art. 6(1)(a) GDPR): insofar as you voluntarily enter particularly sensitive information.
• Legitimate interest (Art. 6(1)(f) GDPR): technical security and stability of the service, error detection and improvement of the app (usage and error events, see section 3).

5Recipients and processors

To provide the app we use carefully selected service providers who process data on our behalf (Art. 28 GDPR):

• Supabase — authentication and database (storage of account and birth data).
• Railway — hosting of the backend (“astro-engine”) that processes calculations and chat requests.
• Vercel — hosting and delivery of the web app.
• Resend — sending the emails for your account (e.g. confirming your email address, new password); this processes your email address and the content of these emails.
• Google Fonts — the app loads fonts from Google servers; your IP address is transmitted to Google in the process.
• OpenStreetMap (Nominatim, OpenStreetMap Foundation) — to calculate the coordinates of your place of birth, our backend sends the place name you entered to the Nominatim service. Neither your IP address nor any other personal data is transmitted.
• Anthropic (Claude): processes your chat messages and the context data needed for the answer in order to generate the answers of “Soraya”.

6Transfers to third countries

Some of the service providers mentioned process data (also) outside the EU, in particular in the USA. Transfers are based on appropriate safeguards, in particular the EU Standard Contractual Clauses (Art. 46 GDPR) or — where applicable — an adequacy decision (EU-US Data Privacy Framework).

7Storage period

We store your data as long as your account exists and it is necessary for the purposes mentioned. After your account is deleted, the associated personal data is deleted unless statutory retention obligations apply.

8Deleting your account

You can delete your account and all associated data yourself at any time — directly in the app under Profile → Delete account (at the very bottom). Alternatively, an informal email to the address above is sufficient.

9Your rights

Under the GDPR you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))

To exercise these rights, a message to attilakovacs0604@gmail.com is sufficient.

10Right to lodge a complaint

If you believe that the processing of your data violates the GDPR, you can lodge a complaint with a supervisory authority. For Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna (dsb.gv.at). You can also contact the supervisory authority in your country of residence.

← Back to Soraya