Legal
Privacy Policy
Last updated 2026-01-01
What we collect, and why
To compute a compatibility chart we need each person's date of birth, time of birth (if known), and place of birth. Because birth data can reveal sensitive attributes (such as inferred family or relationship information) when combined with other data, we treat it as special-category data and only process it on the basis of your explicit, informed consent — collected at the consent checkpoint, before any chart is computed.
What we store
An anonymous draft holds the birth details you enter and any free snapshot generated from them, tied to a browser session rather than an account. Once you create an account, we also store your profile, purchased reports and the chart data behind them, chat history with the report assistant, your consent records, and your purchase history, including the report access and chat allowance each purchase unlocks.
How long we keep it
Anonymous drafts that are never purchased are deleted after 30 days. Share links you create expire after 30 days by default, and you can revoke any of them sooner at any time. If you delete your account, we purge your data within 30 days. Server logs and request traces are kept for 90 days for debugging and abuse prevention, then deleted.
We never sell your data
Your birth and relationship data is never sold, and it is never shared with anyone for marketing purposes — by us or by any company we work with. It is used only to compute your chart, generate your report, and power the chat feature you use, or as needed to comply with a legal obligation.
Your rights: export and deletion
From your account page you can request a full export of your data, or request deletion of your account, at any time. An export link is valid for 72 hours after we generate it. Deletion removes your account, reports, and chat history, and revokes every share link, within 30 days.
Who else touches your data (our processors)
We use a small number of specialist services to run Hearts & Charts, each used only to provide their service to us and never to run their own marketing: Supabase (database, authentication, and file storage), Google Places API (resolving a birthplace to coordinates), Stripe (payment processing), OpenRouter (routes report and chat text generation to a language-model provider), Langfuse (LLM tracing and quality monitoring), PostHog (product analytics), Sentry (error monitoring), Resend (transactional email), and Vercel (hosting).