Your story.
Your perspective.

Lawful bases for processing (GDPR)

Under the General Data Protection Regulation (GDPR, Article 6), we process personal data under specific lawful grounds: Contractual Necessity (Art. 6(1)(b)) to manage your account, compute astrological archetypes, and provide personalized self-reflection questionnaires; Consent (Art. 6(1)(a)) for optional birth time and city details, personal notes, optional AI reflections, and publishing Shareable Cards; and Legitimate Interests (Art. 6(1)(f)) for temporary rate limiting and security logging to protect the platform from unauthorized abuse.

Your rights under GDPR

You hold comprehensive data subject rights under GDPR (Articles 15–22): Right of Access (Art. 15) and Right to Data Portability (Art. 20) via our machine-readable JSON export in Account settings; Right to Rectification (Art. 16) in Account settings and Birth Profile; Right to Erasure (Art. 17) via self-service account deletion cascading through all user-owned tables; Right to Restriction of Processing (Art. 18) by revoking cards or deleting comparisons; Right to Object (Art. 21); and the Right to lodge a complaint with an EU data protection supervisory authority (Art. 77).

Shareable Cards and public links

AstroMirror does not create a public profile for your account, and your account and birth profile stay private. Shareable Cards are private by default. If you explicitly publish a card, AstroMirror creates a public link that shows only that card’s privacy-safe sharing snapshot: the text you chose and, only if you included it, your display name. Publishing a card does not make your AstroMirror profile, answers, notes or birth details public. Links expire after 7 days by default; you can instead choose 24 hours, 30 days or, explicitly, no expiry. You can revoke a link or delete the card at any time from Your cards, although copies someone has already saved cannot be recalled.

Chosen reflections, explicit sharing

Card exports contain only the chosen presentation and any display name you explicitly include. Private cards require your account. Public links are separate, expire by default and can be revoked. Journal notes, raw answers, birth details and technical evidence are excluded. Saved images and recipient copies cannot be recalled.

Sharing is an explicit export of a chosen reflection, not permission to expose your AstroMirror profile.

Private discoveries

Discoveries keep only milestone keys, dates, catalogue version and read state. They contain no answers, birth data, private notes, people, card text or AI prose. They remain private and can survive deletion of the original reflection as a minimal historical action. Account deletion removes them.

Cookies and tracking policy

AstroMirror uses first-party cookies for a secure session (astromirror_session, until the browser session ends), optional “Remember me” sign-in (astromirror_remember, up to 30 days when requested), and your chosen language (astromirror_locale, up to one year). A fourth cookie, astromirror_cookie_notice, remembers acknowledgement of this notice for 180 days. We use no third-party advertising or analytics trackers. “Got it” records that you have read the notice; it does not authorize tracking. You can reopen it using “Cookie notice” in the footer. Clearing browser cookies shows the notice again.

Email verification

AstroMirror sends transactional email to confirm control of the current account email. Verification status and temporary hashed, expiring credentials are stored. Confirmation proves mailbox/link control at that time, not identity, credibility, personality, age or trustworthiness. It is separate from password recovery and is not marketing consent. No verification status is published on cards.

Password recovery

We use the email address you submit to attempt account recovery. Eligible requests receive a transactional reset email through the configured mail service. Reset links expire after one hour and are single-use. Completing a reset revokes previous sign-in sessions and remembered credentials. The email contains no private profile content. Recovery does not create a general verified-email status.

Your account and data controls

Account settings let you update your display name and email, change your password, sign out everywhere, export your personal AstroMirror data and permanently delete your account. Sensitive actions require your current password. Email verification is available in Account Settings. Password recovery is available from the sign-in page.

Account deletion removes hosted private records and makes hosted public card links unavailable. Shared hashed email/IP abuse-prevention buckets are retained temporarily and pruned during normal use; editorial audit entries retain the action with the actor reference cleared. Application logs contain fixed event codes. Hosting backups and their retention are managed separately by the operator. Downloaded or exported files and copies saved by recipients cannot be recalled.

Data controller and inquiries

The hosting operator of this AstroMirror deployment acts as the Data Controller under GDPR. You can exercise all your privacy rights directly through Account settings or reach out to the administrator for any privacy inquiries.