Privacy Policy

Insert Coin Store, Costa Rica. Contact for personal data matters: [email protected].

This policy is governed by Ley 8968 de Protección de la Persona frente al Tratamiento de sus Datos Personales (Costa Rica's personal data protection law).

From your account: your email, your username and your password, which we always store encrypted with a one-way hash algorithm (nobody, not even us, can read it).

If you log in with Google: your email, your name and your profile picture, exactly as Google sends them to us. We do not receive your Google password.

From the souls you create: name, date of birth, time of birth, place of birth and, if you fill them in, gender, MBTI type and personal notes. This includes the data of other people that you enter.

From your use of the service: the reports you generate, your preferences, and technical logs (IP address, browser type) that are stored for security and to diagnose failures.

We do not ask for or store credit card data.

To calculate the charts and reports you request, which is the reason the service exists.

To maintain your account, authenticate you and send you service emails (welcome, password recovery, receipts).

To diagnose errors and improve the product.

To run aggregate statistical analysis on how the product performs: for example, how connection types are distributed, how frequently different configurations appear, or whether the engine is calibrated. This analysis is done on aggregated data without identifying people: we care about the patterns, not about who is who.

We do not sell your data. We do not share it with advertisers. We do not do targeted advertising.

To function, the service relies on external providers that process data on our behalf:

Railway (United States), where the application and the database run.

Resend (United States), which sends service emails. It receives your email address.

Google (United States), only if you choose to log in with your Google account.

Z.ai (China), the provider of the language model that drafts the interpretive readings. When you request an extended reading or use the chat, we send it the first names and the calculated data of the charts involved. We do not send it your email, your password or your IP address.

An external payment processor, when you buy something. It receives the data necessary to charge you; we do not see your card.

This implies that your data may be transferred outside of Costa Rica. By using the service you accept this transfer.

We may also disclose data if a competent authority legally requires us to do so.

All communication between your browser and our servers travels encrypted (HTTPS).

Your password is stored with an irreversible hash, never in plain text.

Access to the database is restricted and accounts are isolated: only you can see the souls and reports of your account.

Now the honest part: birth data is stored without additional encryption at rest within the database. They are protected by the server's access control, not by their own encryption layer. We prefer to tell you rather than promise you something we do not currently do.

We make periodic backups of the database.

The team that operates AstroTwinSoul can access the data stored in the system, including souls and reports, when needed to provide support, diagnose a failure, handle a complaint, or investigate abusive use of the service.

This access is limited to the service's administrative accounts. We do not use your identified data to snoop around, to build commercial profiles, or to sell it to anyone.

As long as your account exists.

When you delete your account, it becomes inactive right away: you can no longer log in, and it no longer appears in the service. Your souls and your reports are kept for one more year, in case you come back. Logging in with the same email and password reactivates everything just as it was.

After that year, we permanently delete your account, your souls and your reports. That cannot be undone.

If you don't want to wait out that year, write to us at [email protected] from your account's email and we'll delete everything sooner.

Security and error technical logs are kept for a limited period and then discarded.

You can ask us at any time: to access the data we have about you, to correct it if it is wrong, or to delete it along with your account. Deleting from Settings comes with the one-year wait described above; if you want it deleted immediately and permanently, request it by email.

To exercise any of these rights, write to us at [email protected] from your account's email. We respond within the deadlines set by Ley 8968.

If you consider that we do not treat your data well, you can turn to the Agencia de Protección de Datos de los Habitantes (PRODHAB) (Costa Rica's personal data protection agency).

When you create a soul with another person's data, that person also has rights over that data.

If someone writes to us at [email protected] asking us to delete their data from our database, we do so, even if it was another user who entered it.

The service is for adults. We do not knowingly collect data from minors. If we find out that an account belongs to a minor, we delete it.

If we make substantial changes to this policy, we will notify you before it becomes effective.