Privacy Policy
NEBO is an astrology app. This page explains what personal data we process, why, on what legal basis, for how long, and what your rights are. In short: we store what you enter into your own worlds, we count usage with simple statistics (in Europe without storing anything on your device), and you can delete everything with one button.
Who is responsible (controller)
Controller details (name, postal address and email) will be published here before launch. Until then you can reach us through “Contact us” in the app.
See also the Impressum (legal notice). We have not appointed a data protection officer.
What we collect
- What you enter. For you and for the people you add to your worlds: a name, gender (optional), date, time and city of birth (with its coordinates and time zone), and the names of your worlds. Diary entries if you use the diary. This is needed to calculate the charts.
- Your account. When you create a world, we create an account for it: a random ID and a random device key for each device (we store only a hash of the key).
- If you sign up or sign in. This is optional; it lets you open your worlds on other devices.
- Email and password: your email address and your password as a salted PBKDF2 hash. We never store or see the password itself.
- Code by email: your email address and, for up to 10 minutes, a hash of the one-time code we send you, plus how many times a wrong code was entered.
- Google: the ID of your Google account and, if Google has verified it, your email address. We don't get your Google password, contacts or anything else from your Google account.
- Notifications. If you turn on daily notifications: the push address of your browser or app (a Firebase Cloud Messaging token in the mobile app), whose chart to use (a person ID or the birth data you entered), the hour and time zone, the language and the kinds of notifications.
- Feedback. If you write to us through “Contact us”: your message, the contact you give (optional), the tab, language and device type, and your country and city as reported by our hosting provider.
- Usage analytics. Which tabs are opened, how long they stay on screen, how far they are scrolled, which buttons are pressed, errors on the page, language, device type (phone, tablet or computer), screen size, the site you came from, and your country as reported by our hosting provider from your connection. In the EU/EEA, the UK and Switzerland nothing is stored on or read from your device for analytics: the visit gets a random ID that lives only in the open page and disappears when you close or reload it, and we do not record your city. Elsewhere (and in Europe only if you agreed to it in an earlier version of NEBO) a random visitor ID is kept in your browser so we can see returning visits, and the city is recorded as well. We never record what you type, and we do not store IP addresses.
- Security. To stop abuse we count requests per connection for a short time window, storing only a salted hash of the IP address.
- Server logs. Our hosting provider Cloudflare processes your IP address and technical request data to deliver the site and protect it from attacks.
Purposes and legal bases
- Calculating and showing your charts, saving your worlds, accounts and sign-in, notifications you turn on, answering feedback: Art. 6(1)(b) GDPR (providing the service you asked for).
- Usage analytics (visits and in-app events): Art. 6(1)(f) GDPR (legitimate interest in understanding which parts of NEBO are used and fixing errors). In Europe no information is stored on or read from your device for this purpose, so no consent under § 25 TDDDG / Art. 5(3) ePrivacy Directive is required; where a visitor ID was stored earlier with your consent, Art. 6(1)(a) GDPR applies. You can object at any time - see “Your rights” below.
- Security, rate limiting, bot protection (Turnstile) and server logs: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working service). Data you store only for the app to work (your worlds, language, settings) stays in your browser as strictly necessary storage (§ 25(2) TDDDG).
Who else processes data
- Cloudflare, Inc. (Pages, Workers, D1 database): hosts the site, the functions and the database. Cloudflare Turnstile: an invisible check that helps us stop bots when an account is created.
- Open-Meteo (geocoding): receives the text you type when searching for a birth city, to find its coordinates and time zone. Your browser contacts it directly.
- Open-Meteo (weather forecast and weather archive): to show today's weather and the weather on a birth day, your browser sends it the coordinates of the city and, for the archive, the birth date. It sees your IP address, but no name.
- Wikimedia Commons (Wikimedia Foundation, Inc.): the source of celebrity photos. Your browser loads them from our own domain; our server (Cloudflare) fetches and caches them, so Wikimedia does not see your IP address.
- Wikipedia API (Wikimedia Foundation, Inc.): for “what happened on this day” your browser asks Wikipedia for a day, month and year (today's date or a birth date). It sees your IP address, but no name.
- Google: confirms who you are if you choose to sign in with Google; Firebase Cloud Messaging delivers notifications in the mobile app. In the browser, notifications go through your browser vendor's push service.
- Resend: delivers the emails with sign-in codes, if you choose to sign in with a code.
- Fonts are served from our own server; no font service is contacted.
Some of these providers are located in the USA. Transfers are based on the EU-U.S. Data Privacy Framework where the provider is certified, or on the EU standard contractual clauses (Art. 45, 46 GDPR). We don't sell data, we don't show ads, and we don't share your worlds with anyone.
How long we keep it
- Worlds, people, diary and account (including email address, password hash and Google link): until you delete them.
- Sign-in codes: 10 minutes, deleted once used.
- Notification subscriptions: until you turn notifications off or the push address stops working.
- Analytics (visits and events): up to 18 months, then deleted automatically.
- Feedback: up to 12 months, then deleted automatically.
- Rate-limit counters: a few minutes to one hour.
Your choices and rights
- Delete everything: under your world, press “Delete account and data”. This deletes your account, worlds, people, email address, password hash, Google link and devices from our servers, together with the analytics recorded from your browser, and clears all of it from your browser as well.
- Sign out: in the account window, press “Sign out”. This forgets only the current device; your worlds stay in your account.
- Object to analytics at any time, with effect for the future: Done: analytics are off in this browser. You can also switch analytics off by opening this link.
- You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Write to us through “Contact us” in the app (the controller email will be listed above before launch).
- You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work.
- United Kingdom: if you live in the UK, the UK GDPR and the Data Protection Act 2018 give you the same rights, and you can complain to the Information Commissioner’s Office (ICO), ico.org.uk.
California residents (CCPA/CPRA)
- We don’t sell or share your personal information - not for money, not for cross-context behavioral advertising. We show no ads.
- The categories we collect are listed under “What we collect” above: identifiers (account ID, email if you sign up), the birth data you enter, and internet activity inside NEBO (usage analytics). We use them only for the purposes listed above.
- You have the right to know what we hold about you, to delete it and to correct it, and we won’t treat you differently for using these rights. You can download your data and delete everything yourself in the account window (“Download my data”, “Delete account and data”), or write to us through “Contact us” in the app. We may need to confirm the request comes from you.
Children
NEBO is open to all ages. We don’t ask your age separately: we use the birth date you enter only to calculate the chart and to apply age rules. A kids mode turns on automatically for people under 13: it hides romance, dating and other mature content. If you are under 13 (under 16 in the European Union), a parent or guardian should agree before you create an account. Parents can ask us to export or delete a child’s data at any time - write to us and we will do it.
Changes
If this policy changes in an important way, we will show a notice in the app.