Privacy
Updated 29 October 2026.
Account and personal data
Birth form details are sent to Astravia’s server to calculate a chart. Without an account, your chart stays in the current page. When signed in, the profile entries, charts and conversations you choose to save are kept in Astravia’s dedicated database. Passwords use scrypt hashes; session cookies are HttpOnly and the server stores session token hashes. Both web servers use the same database. Generated card images are stored in Astravia’s dedicated private Google Cloud Storage bucket; the database keeps ownership and usage records. Images are served only through the signed-in owner’s Astravia endpoint, without public storage links. To see how the site is used, Astravia counts how often each page and screen is opened each day; these counts are sent without cookies and stored without IP addresses, accounts or device identifiers.
AI and optional services
The Oracle contacts an AI provider only when you send a question: OpenAI for members (Responses API storage is disabled), and Qwen from Alibaba Cloud Model Studio (its international service in Singapore) for everyone else. Each question goes to that one provider only. It sends the question, recent conversation, relevant chart facts, the confirmed, non-private profile entries you choose to include and, unless you switch it off, a few non-sensitive impressions. Birth form fields and names are not added to the prompt as birth records; anything you write in a message is part of that message. Personal card image creation sends only the portrait and descriptions you select. It does not send your birth form, private entries or conversation history. Google is also contacted when you choose Google sign-in.
Advertising
Pages show ads served by Google AdSense to visitors who are not members; members see none. The AdSense script loads from Google on every page and may use cookies or similar identifiers to show and measure ads, under Google’s own policies. Ad availability depends on Google’s site review, ad supply and the consent requirements that apply to your region. When you choose to watch a rewarded ad for an extra Oracle question, it is served by Google Ad Manager; Astravia records only that a reward was granted to your account. Astravia does not send your birth details, charts, profile or conversations to Google or to advertisers.
Payments
Stripe receives your account email and an internal account reference to handle subscriptions. Astravia does not receive or store your full card number. Chart, profile and conversation content is not sent to Stripe. Financial records retained by Stripe are governed by its own policies.
Your control
You can review, edit, export or delete saved account data in My account. Your personal profile separates entries you write or confirm from unconfirmed impressions the Oracle may organize from your choices and conversations. Impressions are labelled as guesses, filtered for sensitive topics, and can be viewed, deleted or switched off in settings. When learning from your profile is switched off, impressions are neither organized nor sent with questions. Deleting the account cancels active subscriptions and deletes your stored personal content; Stripe retains records it needs for payment processing. Operational logs may contain request addresses, times and technical identifiers; passwords, payment secrets and message bodies are not intentionally logged.