Legal
Last updated: August 30, 2026
This Privacy Policy explains what data Cosmic Blueprint ("we", "us") collects from you when you use www.cosmic-blueprint.org, how we use it, and who we share it with. We try to keep things simple and collect only what's needed to deliver the Service.
Account information. Your email address — used to sign in (passwordless magic links) and to send transactional messages related to your account.
Birth data you submit. Your first/middle/last name, date of birth, time of birth, and birth city. This data is necessary to compute your astrological chart. It is stored on our servers and tied to your account.
First Seed and guest Guide. The opening Seed experience can temporarily hold a date of birth, optional birth time, birthplace, and the possibility you write in this browser tab for up to two hours. If you provide birth details and continue, the city is sent once for location lookup so the app can calculate a light chart. Only an allowlisted sketch of derived signs—not your raw date, time, city, or coordinates—can accompany a message you choose to send to the Guide. Guest Guide messages are processed only after you press Send. Checkpoints returned from that conversation are stored on this device until you clear its trail or your browser storage.
Free Home. If you use the account-free Home, goals, daily-practice completions, and the related climb streak are kept only in this browser's local storage. These device-local records are not sent to our servers or to an AI provider. Clearing this site's browser data removes them; a future paid-account import would require a separate, explicit confirmation.
Optional voice input. If you use the microphone button, your browser's speech-recognition feature turns audio into editable text. Depending on your browser and operating system, its provider may process that audio under its own privacy terms. Cosmic Blueprint does not operate a speech-to-text service and receives only the resulting text after you choose to send it. You can always type instead.
Generated chart data. The placements, aspects, numerology figures, derived calculator snapshots, and AI-written interpretations produced for you. Stored on our servers and tied to your account. A calculator snapshot contains derived values and a one-way input fingerprint, not your raw name or birth date.
Navigation and reflection data. If you use the three-mountain experience, we store your assessment answers and dated results; the summit statements, corrections, constraints, experiments, outcomes, and reflections you choose to save; and your calculator-context preference.
Optional AI Guide data. If you choose to use an AI Guide feature, we may store the messages you send, the replies you receive, a bounded continuity summary, the memories you explicitly approve, source references, consent records, and usage information such as token counts. Free-form text can contain personal information, so please share only what you are comfortable using for this purpose. The relevant Guide screen explains what is sent before you press Send; pressing Send asks us to process that content to create the reply.
Sensitive information. Your birth details and the reflective text you write can touch on subjects some privacy laws treat as sensitive or "special category" — for example, information that may reveal philosophical or spiritual beliefs, or your mental or emotional state. We process this information only to provide the reflective and navigation features you actively request, on the basis of the consent you give in the product, and you decide what to write, what to save, and what to delete. Please do not submit another person's sensitive information without their consent, and share only what you are comfortable processing for this purpose.
Payment information. We do not directly collect or store payment card information. All payments are handled by Stripe, who provides us only with a customer ID, the email used, and basic purchase or legacy subscription status. See Stripe's privacy policy.
Technical data. Standard request logs (IP address, user agent, timestamps) generated by our hosting provider Vercel during normal operation. Retained for ~30 days for security and debugging.
We use this information only to provide the features you request, protect the Service, diagnose problems, prevent abuse, and meet legal obligations. We do not sell your data. We do not use your information to train our own AI models. Anthropic states that commercial API inputs and outputs are not used for model training by default unless the customer explicitly opts in or submits feedback.
Safety handling. If a message indicates a risk of harm to you or someone else, the Guide is designed to respond with a brief safety message and crisis resources (see the Terms of Service) instead of astrological content. This handling is automated as part of generating the response; we do not actively monitor your conversations, and Cosmic Blueprint is not a crisis, emergency, or mandated-reporting service.
| Provider | Purpose | What they receive |
|---|---|---|
| Vercel | Web hosting | Standard request logs |
| Supabase | Authentication and database | Email and the account, chart, navigation, reflection, consent, and optional Guide data described above |
| Stripe | Payments | Email, billing address you provide at checkout, payment card (handled by Stripe, not us) |
| Anthropic | AI text generation (Claude) | For chart readings: relevant derived chart data and limited profile context. For an optional Guide: the current message and recent conversation so far, plus selected user-approved or relevant map, reflection, assessment, and calculator context. We exclude your account email and raw birth form by default, but text you write may itself identify you. Anthropic says standard API inputs and outputs are generally deleted from its backend within 30 days, subject to safety, legal, feedback, or separately agreed retention exceptions. |
| Resend | Transactional email delivery | Email address, the email content (magic link) |
| OpenStreetMap Nominatim | City-to-lat/lon geocoding | The city name you submit only when you explicitly ask us to calculate your chart |
| Upstash | Abuse prevention and geocoding cache | Pseudonymous rate-limit keys; a one-way hash of a birthplace lookup and its public geocoding result |
| Cloudflare | DNS | None (DNS only) |
Each of these services has its own privacy policy; review them if you want full detail. We have selected providers with strong reputations for data handling but cannot guarantee their independent practices.
We use browser local storage to keep you signed in (Supabase session token), cache your chart and readings for fast loading, keep a random guest device token for enforcing the free daily Guide limit, and retain guest mountain checkpoints, goals, daily-practice completions, and the guest climb streak on this device. An unfinished First Seed draft uses session storage and expires after about two hours or when you sign out, delete your account, or clear the draft. We do not use third-party tracking cookies, analytics cookies, or advertising cookies.
Your account email and saved chart, navigation, assessment, reflection, experiment, consent, and optional Guide data are retained while your account exists or until you use an available delete/clear control or ask us to delete them. Clearing a Guide conversation removes its transcript and continuity summary; non-content usage records may be retained as needed to preserve purchased-credit accounting, prevent abuse, and meet legal obligations. When you delete your account, associated Service data is removed from our active systems within 30 days, subject to required security logs, backups, and legal retention. Stripe and other providers retain their own records under their policies and applicable law.
Depending on where you live, you may have the following rights regarding your data:
To exercise any of these rights, email frankeppsjr@gmail.com from the address associated with your account.
The Service is not directed to children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, please contact us and we will delete it.
The Service is operated from the United States. By using the Service, you consent to your data being transferred to and processed in the United States, where data-protection laws may differ from those in your country.
We use industry-standard practices to protect your data: HTTPS everywhere, hashed/secret API keys, role-based database access (Supabase row-level security), and reputable service providers. No system is 100% secure; we cannot guarantee absolute security but we promptly investigate any incident.
We may update this Privacy Policy from time to time. Material changes will be announced via the Service or by email. The "Last updated" date at the top reflects the most recent revision.
Privacy questions, data requests, or concerns: frankeppsjr@gmail.com.