Privacy at Astraleria

Astraleria is built for data minimalism, not dressed up for it afterwards. No account, no server, no tracking, no analytics. The app runs entirely on your device. Last updated 2026-06-30.

Controller

Ankarina OÜ, Sepapaja tn 6, Lasnamäe linnaosa, 15551 Tallinn, Estonia, represented by its management board member Anna Lippmann. Contact: hello@ankarina.com. Full legal notice in the imprint.

What we do not collect

Astraleria does not maintain user accounts and operates no backend server that receives your data. The app declares this in its bundled Apple privacy manifest (PrivacyInfo.xcprivacy): no tracking (NSPrivacyTracking = false), no tracking domains, and no Apple data categories collected. We do not use analytics services, advertising networks, attribution SDKs, crash reporters that include user content, or any third-party behavioral measurement.

What stays on your device

Birth data, names and relationship labels you enter, notes, journal entries, saved transit notes, your chart library and dashboard layout, generated readings, share cards and reveal videos, plus app preferences (chosen language, onboarding state, dashboard layout, streak counter, mood check-ins).

This data is stored in a local SwiftData store and in the iOS UserDefaults of the app, both protected with NSFileProtectionComplete (decrypted only while the device is unlocked). It is included in your encrypted iCloud or local device backup at your choice, under your Apple ID and Apple's terms; it is not sent to us or to any third party we control.

The reading engine is on-device: when available, Apple's built-in on-device language model (Apple Intelligence Foundation Models) generates narrative texts; otherwise a bundled deterministic engine runs the same calculation locally. No request containing your chart, your name or your notes is transmitted to a server we operate.

Required-Reason API use

Per Apple's required-reason categories, Astraleria declares the following API use in its privacy manifest: NSPrivacyAccessedAPICategoryUserDefaults, reason CA92.1, to read and write the app's own preferences. The data is used by this app only. No other required-reason API categories (file timestamps, system boot time, disk space, active keyboards) are accessed by the app.

Permissions you may grant

Asked only when you use the related feature. Change every one of them in iOS Settings > Astraleria at any time.

Location, when in use: used by the Sky Compass to point you in the correct cardinal direction for your current location. The reading does not leave the device.
Add to Photos: used when you save a generated card or reveal video to your photo library. The app only adds, it does not read your photos.
Notifications: local notifications you schedule (daily synthesis, exact aspect windows). Produced and delivered locally.
Siri / App Intents and Shortcuts: Apple processes your spoken request, then invokes the app intent. The app receives only the parsed intent parameters. Astraleria does not store voice recordings.

Universal Links and the synastry share loop

When you share a Synastry match link (https://astraleria.app/match#chart=...), the encoded chart sits in the URL fragment after the #. URL fragments are technically not sent to the server, so the chart payload is never received or logged by our host. The receiving device decodes it in the browser or in the app.

Apple App Group

The app group group.com.astraleria.app exists only so widgets and the watch complication (when shipped) can read the same on-device data the main app writes. It is a local sandbox boundary, not a network destination.

Purchases

Subscriptions and the lifetime purchase (com.astraleria.app.monthly, com.astraleria.app.annual, com.astraleria.app.lifetime) are handled by Apple via StoreKit. Apple is the merchant of record. Apple's privacy policy applies to the payment data Apple processes. We receive aggregate, non-identifying sales reports from Apple that do not identify individual customers.

This website

astraleria.com is a static marketing site hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA). The site sets no cookies, runs no tracking and no analytics, and self-hosts its fonts. While delivering the page, the hosting provider processes necessary server log data such as the IP address to ensure delivery and security of the site (Art. 6 (1) (f) GDPR). This is not combined into user profiles. Any transfer to the USA is safeguarded by Cloudflare standard contractual clauses.

The site is also reachable under astraleria.app, which serves the Apple Universal Link manifest for the app and has no separate data processing.

Children

Astraleria is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13.

Your rights (GDPR)

Under the GDPR you have the right to access, rectify, erase and restrict the processing of personal data, and to object and to data portability where applicable. Because the app stores all personal content locally on your device, you can fully exercise these rights by editing or deleting individual entries in the app, using "Reset all data" in Settings (this removes every Astraleria-written UserDefaults key, the SwiftData store and temporary files), or by uninstalling Astraleria.

For questions about the personal data we as the controller process in connection with the website (server log data) or in correspondence with you, contact hello@ankarina.com. You may also lodge a complaint with a supervisory authority.

Changes

If we materially change this policy, we will update the "Last updated" date above and reflect the change at https://astraleria.com/privacy/.

Back to home