Privacy Policy

This policy explains how Anvaya processes information in the Anvaya iOS app and on this website. Contact [email protected] with privacy questions.

Information you provide

We process your Apple account identifier and relay email where provided, birth date, birth time or uncertainty, birthplace, optional current city, onboarding choices, relationship profiles, private reflections, notification preferences, and support correspondence. Purchases are processed by Apple; we receive transaction and entitlement status rather than payment-card details.

How we use it

We use this information to authenticate your account, calculate charts, generate Today, Life, Love, and Timeline experiences, sync private data, manage subscriptions, deliver requested notifications, provide support, prevent abuse, and maintain reliability.

Protection and separation

Birth payloads, relationship details, and reflection bodies receive versioned authenticated application-layer encryption in addition to database encryption at rest. Sensitive astrology data, profile names, chart degrees, and reflection text are excluded from logs and product analytics. Access is authorized per user.

Analytics

The app and site use consent-gated PostHog EU analytics for limited product interaction and diagnostics. Autocapture and session replay are disabled. We do not use data for cross-company tracking and do not request App Tracking Transparency permission.

Service providers

We use Apple for sign-in and purchases, Firebase for authentication and messaging, MongoDB Atlas for protected application data, AWS for hosting, Cloudflare for DNS and edge security, PostHog EU for consented analytics, and GitHub Container Registry for private deployment artifacts. Providers process data under their terms and security controls.

Retention and deletion

We retain active-account information while the account is open and as needed for service, security, legal, and transaction-record obligations. In-app deletion requires fresh Apple authorization and removes active application records, authentication identity, notification devices, and local state. Residual encrypted backup copies are inaccessible through the active service and expire automatically under the production backup-retention schedule. You may request a machine-readable export before deletion.

Your choices

You can decline analytics, disable notifications, change optional city information, export your data, or delete your account. Depending on where you live, you may also have rights to access, correct, restrict, object, or complain to a data-protection authority.

Children and changes

Anvaya is for adults 18 and older. We may update this policy as the service changes; material updates will be identified by the date above.