Privacy policy
Last updated [date of publication]
This is a draft under legal review and is not yet in force. Questions about your data go to support@hoshiastro.com.
We don't sell your personal information, and we don't share it for advertising. Hoshi has no ad networks and no data brokers.
This policy explains what Hoshi collects, why, who else handles it for us, and what you can do about it. Hoshi is made by BG Media LLC ("we"). It covers the Hoshi iPhone app and hoshiastro.com.
What we collect
When you use the app:
- Your account and contact details. Your email address and, if you give it, your phone number. We keep your phone number and email only as keyed digests (one-way codes), so friends who have your number can find you on Hoshi. We don't keep them in readable form.
- Your birth details. Birth date, and if you give them, birth time and place. A chart can't be made without them.
- Your readings. The readings and feed Hoshi writes for you, and which ones you've opened.
- The people you add. Their name, relationship to you, pronouns, and the birth details you enter. More on that below.
- Your contacts, only to find friends. If you let Hoshi look through your address book, the numbers and addresses are compared to find who's already here, then discarded. Nothing from your address book is stored.
- Purchases. Subscriptions are sold by Apple. We learn that you subscribed and to what, not your payment details.
- How the app is used. Which screens are opened and which features are used, through Amplitude, so we can tell what works. We don't store IP addresses.
On hoshiastro.com:
- The waitlist. If you join, your email address, the date, the page you joined from, and the campaign that brought you there (for example, "Instagram"). Nothing else.
- How the site is used. Pages viewed and buttons tapped, through Amplitude, without IP addresses. The site sets no cookies and keeps nothing on your device after you close the tab: each visit is counted on its own. No ad pixels.
People who never signed up
To write a compatibility reading, Hoshi needs two charts, and most of the people you'd add don't have Hoshi. So when you add someone by hand, Hoshi keeps the name, birth date and the optional birth time and place you enter.
- It's visible only to you. Nobody else sees it, including the person, and nobody is told you added them.
- It's never used to contact them. Nothing is sent to them unless you share a link or send a request yourself.
- It isn't combined or shared. It isn't matched across users or sold.
- It's deleted when you remove them. Removing someone deletes their profile, and the readings about them are emptied.
Hoshi is stricter than some astrology apps here: a compatibility reading can only be made between people who have connected, or for a profile you created yourself.
If someone added you and you'd like your details removed, email support@hoshiastro.com with your name and, if you know it, who added you. We'll respond within [30] days.
[Lawyer: the lawful basis for keeping birth details about a person who never signed up (legitimate interest?) in each jurisdiction the app ships to.]
How we use it
To make your chart, write your readings and feed, find and connect your friends, send the notifications you've turned on, run subscriptions, answer support requests, keep Hoshi secure, and understand which features work. For the waitlist, to send you one confirmation and the launch email, and later newsletters you can unsubscribe from.
We may use aggregated or de-identified data (for example, "how many readings were written this week") that can't be tied back to you.
Who handles data for us
These service providers process data for us, under contract, and only to run Hoshi:
| Provider | What for |
|---|---|
| Supabase | Database and sign-in |
| Railway | Hosting the app's server |
| Vercel | Hosting this website |
| OpenAI | Writing readings (names and birth details) |
| Searching for birth places (it sees our server and the search text, not you) | |
| Amplitude | Usage analytics |
| Resend | Sending email |
| Apple | Purchases and push notifications |
We also share data when the law requires it (for example, a valid court order), to protect someone's safety, or as part of a merger, sale or reorganization of BG Media LLC, in which case this policy continues to apply to it.
Shared readings
When you share a reading or a link, the people you send it to can see it, and can save or forward it. A shared compatibility reading can indirectly reveal things about the other person in it. Share with care. If a link about you was shared without your agreement, email us and we'll take it down.
Where data is stored
Hoshi is run from the United States and data is stored there [and in: confirm Supabase and Railway regions]. If you use Hoshi from outside the US, your data is transferred to the US. [Lawyer: transfer mechanism for EU/UK users, such as Standard Contractual Clauses.]
How long we keep it
As long as your account exists. Deleting your account deletes your birth details, the people you added, your feed and your contact digests, and empties your readings. A few things go sooner: your address book is never stored, and someone you remove is deleted right away.
Waitlist entries are kept until launch [and for N months after]. If you unsubscribe from our newsletter, we keep your address only to make sure you aren't emailed again; if you use the "remove me" link in the confirmation email, your entry is deleted.
Deleting your account
In the app: open your settings and choose Delete account. If you can't get into the app, email support@hoshiastro.com from your account's address and we'll delete it.
Your rights
Wherever you live, you can ask us to access, correct or delete your data, or for a copy of it. Email support@hoshiastro.com. We'll verify it's you, and answer within [30] days. If we decline a request, we'll tell you why, and you can appeal by replying to that email; we'll answer the appeal within [45] days.
California residents (CCPA/CPRA). In the last 12 months we collected: identifiers (email, account ID), sensitive personal information (birth date, time and place, which we use only to provide Hoshi), contact information (as digests), commercial information (subscriptions), internet activity (app and site usage), and inferences (your readings). We don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive information to infer characteristics beyond providing the service. You can ask to know, delete and correct, through an authorized agent if you prefer, and we won't treat you differently for asking.
Under 18 in California. You can ask us to remove content you posted. Email us.
EU and UK (GDPR). We process your data to provide the service you asked for (contract), with your consent where we ask for it (sending data to OpenAI, contacts, notifications), and for our legitimate interests (security, understanding usage, the people you add). [Lawyer: confirm the bases, and name an EU/UK representative if required.] You also have the right to object, to restrict processing, to data portability, to withdraw consent at any time, and to complain to your data protection authority. We answer within one month.
Do Not Track and Global Privacy Control. Browsers don't agree on what Do Not Track means, so we don't respond to it. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which we don't do anyway.
Children
Hoshi isn't for children under [13]. We don't knowingly collect data from them; if we learn we have, we delete it. If you think a child is using Hoshi, email us.
Security
Data is encrypted in transit and at rest, access is limited to the people who need it, and contact details are kept only as digests. No system is perfectly secure, and we'll tell you without undue delay if a breach affects your data.
Changes to this policy
When we change it, we'll update the date above. If a change is significant, we'll tell you in the app or by email before it takes effect.
Contact
BG Media LLC
233 W 38th St
New York, NY 10018
USA