Privacy policy

This Privacy Policy explains what personal data 12astro.com collects, why we collect it, who we share it with, how long we keep it and what rights you have. It applies to everyone who uses the site, wherever they are. We try to collect only what a feature actually needs, and most of the site works without an account.

If you're in Türkiye, our KVKK notice (Turkish) also applies to you.

Who we are and how to contact us

12astro.com is operated from Türkiye by Ömer Tekin, Meşelik Mh. Milas-Bodrum Yolu, No:144, Karia Port, Muğla, Türkiye ("12astro", "we", "us"). We are the controller of the personal data described in this policy.

• Email: hello@12astro.com
• Contact form: 12astro.com/contact
• Representative in the EU (GDPR Art. 27): none appointed at present
• Representative in the UK (UK GDPR Art. 27): none appointed at present
• Data protection officer: none appointed; please use the email address above for all privacy questions

What we collect and why

Using the site without an account

You can read horoscopes, guides and the blog, use the calculators (birth chart, rising sign, synastry, transits, solar return, progressions and others), draw tarot cards, and use the numerology and abjad tools without signing up.

The name, birth date, birth time and birthplace you type into a calculator are processed only to produce the result you asked for. They are not stored on our server. Tarot draws and the readings you view are not stored either.

Your account

When you create an account, we store:

• your first and last name;
• your email address;
• your date of birth (we use it to work out your sign);
• your birth time and birthplace (city), if you choose to add them;
• your gender, if you choose to give it (you can pick "Prefer not to say");
• a one-way hash of your password (we never store the password itself);
• the date you joined, the date you last signed in and the language you want notifications in.

We use this to run your account, to fill in calculator forms for you and to send you what you've asked for. You can change these details in Account settings. We send a link to confirm your email address; if an account isn't confirmed within 7 days, it is deleted.

If you tick "Remember me" when you sign in, we set a sign-in token that keeps you signed in for 60 days. It is deleted when you sign out.

You can download a copy of your data as a JSON file from Account settings, and you can delete your account there at any time. Deleting your account removes your account record, saved items, sign-in tokens, notification subscriptions (including push subscriptions), analyses and shared chart images. Payment records are kept as described in Star membership and payments.

Saved items and shared chart images

As a member you can save horoscopes, charts (including the birth details for each chart), tarot readings (the cards and your question) and notes. Your saved items are visible only to you.

If you share a chart from one of your analysis reports, we create an image of that chart and publish it at a link that can't be guessed. Anyone you give the link to can see it. The image is deleted when you delete the analysis or your account.

Comments

When you post a comment, we store the name you enter (a nickname is fine), your comment and, if you give it, your email address. The name and comment are published; the email address is never published. Comments are moderated before they appear. We delete the email address 180 days after the comment is posted; the comment itself stays. Comments marked as spam are deleted after 30 days.

Contact form

When you use the contact form, we store your name, email address, subject and message so we can reply. Messages are deleted after 365 days.

Horoscope notifications

Notifications are for members only. You choose which signs to follow (one sign, or two with Star), how often (daily, weekly, monthly or yearly) and how you want to receive them. You can change or stop them in Notification settings. We keep a log of how many notifications were sent for 365 days.

Email newsletter

Horoscopes by email are available to Star members. To send them, we use your account email address, the signs you follow and the frequency you chose. We send email through Amazon Simple Email Service (Amazon SES), run by Amazon Web Services in Ireland (EU).

We don't track whether our emails are opened or whether their links are clicked; our emails contain no tracking images or redirected links. From Amazon SES we only receive the list of addresses whose emails bounced or that marked our email as spam, and we stop sending to them. Every horoscope email has a one-click unsubscribe link.

Push notifications

If you turn on push notifications, your browser creates a subscription (an endpoint address and encryption keys), which we store. Notifications are delivered through your browser maker's push service (for example Google, Mozilla, Apple or Microsoft). Their content is end-to-end encrypted (RFC 8291), so the push service can't read it. You can turn push notifications off in your notification settings or in your browser.

Telegram

If you choose to connect your account to our Telegram bot, we store your Telegram chat ID and username. We use them to send you notifications and sign-in codes. You can disconnect at any time by sending /stop to the bot or from your notification settings. Telegram is a separate service run by Telegram FZ-LLC and Telegram Messenger Inc., and its own privacy policy applies to your use of Telegram.

Sign-in codes

After you enter your password, we ask for a 6-digit code to finish signing in. The code is valid for 10 minutes. We send it to Telegram if your account is connected; if not, as a push notification; and if neither works, by email. We don't store the code itself, only a keyed one-way hash of it, for the length of the sign-in.

Star membership and payments

Star is our paid subscription. You can also buy analysis credit packs. Payments are handled by Dodo Payments (Dodo Payments Inc. and its affiliates), our merchant of record: you pay on Dodo Payments' payment page, and Dodo Payments collects your card or other payment details, your billing country and address, and the data it needs for tax and fraud checks. We never receive your card details. For this payment data, Dodo Payments is an independent controller under its own privacy policy.

To open the payment page, we send Dodo Payments your name, email address and what you're buying. Dodo Payments sends back the result of the payment. We store your Dodo customer ID, your subscription ID and its status, your orders (product, amount, date and status), payment and refund IDs, and your account history (Star and credit movements). We need these to give you what you bought, renew or end your Star membership, handle refunds and keep financial records. Payment notifications from Dodo Payments are logged by ID for 30 days so that the same notification isn't processed twice.

Orders, payment records and account history stay in our records after you delete your account, because they are financial records. After your account is deleted, we keep them for 1 year as a legal requirement and then delete them completely. If your subscription is still set to renew when you delete your account, we cancel it at Dodo Payments.

If your Star membership is about to end and won't renew (for example because you cancelled), we remind you once, 3 days before it expires, by email or Telegram.

AI-written analyses

Our horoscopes are written with Anthropic's Claude model, based on real sky data for the period. They contain no personal data.

Star analysis reports (relationship, astro-healing, career, forecast, horary, child–parent and yearly) are also written with Claude. When you request one, we send Anthropic PBC in the United States the details you enter: the name, birth date, birth time and birthplace of the person the report is about (and of the second person, for relationship and child–parent reports), gender if you give it, and any question or note (such as a horary question, a career note or an astro-healing focus), together with the chart data our site calculates. Anthropic writes the report and sends it back. We store the report and the details you entered in your account until you delete them or your account.

Under its commercial terms, Anthropic does not use data sent through its API to train its models. It deletes API inputs and outputs within 30 days, except content flagged for violating its Usage Policy, which may be kept for up to 2 years. The electional astrology tool does not use AI. When a report is ready, we can let you know by push, Telegram or email, if you've turned that on.

Please don't include health details or other sensitive information in your questions or notes unless you want them in your report. Analysis reports are not medical advice; talk to a health professional about decisions concerning your health. If you do include health details, we process them only to prepare the analysis you asked for, and they are deleted when you delete the analysis.

The AI writes a report for you to read. We don't use it to make decisions that have legal or similarly significant effects on you.

Information about other people

Some features ask for another person's details, such as a partner's birth data for a relationship report or a child's birth data for a child–parent report. Please enter someone else's details only if you have the right to share them, for example because they agreed or, for your child, because you are their parent or guardian. We use these details only to produce the report you asked for, and they are deleted along with the analysis or your account.

Security and abuse prevention

Our application doesn't save your IP address in its database. Like almost every website, our web server keeps access logs: each request's IP address, time, requested page, referring page and browser information. We use them to keep the site secure and to diagnose problems, and keep them for up to about 2 months (processed daily and archived monthly; each archive is deleted at the end of the following month). To limit spam and repeated requests on forms, we use a keyed one-way hash (HMAC) derived from your IP address; your IP address can't be read back from it. Our image check (captcha) is our own system and doesn't involve a third party. Our application logs (errors and security events) are kept for 90 days.

Analytics

If you allow it, we use Google Analytics 4 to see how the site is used, for example which pages are visited. Google Analytics is not loaded until you agree, and if you withdraw consent, its cookies are deleted. See our Cookie Policy for details.

Advertising

We show Google AdSense ads to visitors who aren't Star members. We don't show ads on account and payment pages. Unless you allow personalized ads, we ask Google for non-personalized ads, which are chosen based on the page you're reading. Google may still use cookies or local storage for these ads, to limit how often you see an ad, for aggregate reporting and to fight fraud. If you allow personalized ads, Google uses cookies to show ads based on your interests. Google acts as an independent controller for this data. See our Cookie Policy.

We don't use social media tracking cookies or pixels, and apart from advertising cookies there is no third-party tracking on the site.

Legal bases for processing (GDPR and UK GDPR)

If you're in the EU, the EEA or the UK, we rely on the following legal bases under Article 6 of the GDPR / UK GDPR:

What we do	Data	Legal basis
Running the calculators and tools you use	Name and birth details you enter (not stored)	Legitimate interests (providing the tool you asked to use)
Creating and running your account, saved items, data export	Account details, saved items	Contract (Art. 6(1)(b))
Sending horoscope notifications by email, push or Telegram	Email, push subscription, Telegram chat ID and username, chosen signs and frequency	Contract (Art. 6(1)(b)); your browser's permission for push
Sign-in codes and "Remember me"	Hashed code, sign-in token, Telegram/push/email	Contract (Art. 6(1)(b)) and legitimate interests in account security (Art. 6(1)(f))
Star subscription, credits, payments, refunds, reminders	Orders, Dodo customer and subscription IDs, payment IDs, account history	Contract (Art. 6(1)(b))
Keeping financial records	Orders, payments, refunds, account history	Legal obligation (Art. 6(1)(c))
AI-written analysis reports	Details you enter about yourself and others, chart data	Contract (Art. 6(1)(b)); for other people's details, legitimate interests (Art. 6(1)(f)): we process them only to prepare the analysis you asked for, and they are deleted when you delete it
Publishing and moderating comments	Name, comment, optional email	Legitimate interests (Art. 6(1)(f))
Answering contact messages	Name, email, subject, message	Legitimate interests (Art. 6(1)(f))
Security, spam prevention, rate limiting, logs	HMAC of IP address, application logs, web server access logs (IP address, browser information)	Legitimate interests (Art. 6(1)(f))
Analytics	Google Analytics cookies and usage data	Consent (Art. 6(1)(a))
Non-personalized ads	Data Google processes to serve contextual ads	Legitimate interests (Art. 6(1)(f))
Personalized ads	Google advertising cookies	Consent (Art. 6(1)(a))
Handling your privacy requests	Details in your request	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, you can object (see Your rights). Where we rely on consent, you can withdraw it at any time.

To create an account we need your name, email address, date of birth and a password; without them we can't open an account. Everything else, such as birth time, birthplace and gender, is optional.

Who receives your data

We don't sell your personal data. We share it only with the service providers we need to run the site, and with the parties listed below:

Recipient	What for	Where
Amazon Web Services EMEA SARL	Hosting: our servers, database and files	Ireland (EU), eu-west-1 region
Amazon Simple Email Service (AWS)	Sending email; bounce and spam complaint lists	Ireland (EU)
Anthropic PBC	Writing analysis reports (the details you enter); writing horoscopes (no personal data)	United States
Google Ireland Limited / Google LLC	Google Analytics (only with your consent); Google AdSense ads. For advertising, Google is also an independent controller.	Ireland (EU) / United States
Telegram FZ-LLC / Telegram Messenger Inc.	Notifications and sign-in codes, only if you connect your account	United Arab Emirates (Telegram FZ-LLC, Dubai); group companies in the British Virgin Islands. Data of EU and EEA users is stored in data centers in the Netherlands
Browser push services (for example Google Firebase Cloud Messaging, Mozilla, Apple, Microsoft)	Delivering encrypted push notifications, only if you turn them on	Depends on your browser's maker (often the United States)
Dodo Payments Inc. and its affiliates	Merchant of record for Star and credit packs: payment page, payments, subscriptions, taxes, receipts and refunds. Independent controller for the payment data it collects.	United States (Dodo Payments, Inc.)

We may also disclose data to public authorities when the law requires us to.

International transfers

We operate from Türkiye. Our servers and our email service are in Ireland, in the EU. Some providers are outside the EU and the UK:

• United States (Anthropic, Google): the EU–US Data Privacy Framework (and its UK Extension) where the recipient is certified, otherwise the European Commission's Standard Contractual Clauses (with the UK Addendum) in the provider's data processing terms.
• Türkiye (where we operate the site from): we collect your data directly from you as a controller based outside the EU and the UK, and the GDPR and UK GDPR apply to us directly.
• Telegram and browser push services: only if you choose to use them; these services process your data under their own terms and privacy policies.
• Dodo Payments: Dodo Payments, Inc. is based in the United States and is an independent controller for the payment data it collects. It has appointed representatives in the EU and the UK; see its privacy policy.

You can ask us for more information about these safeguards, or a copy of them, using the contact details above.

How long we keep data

Data	How long
Details you enter in calculators; tarot draws	Not stored
Account details	Until you delete your account. Unconfirmed accounts are deleted after 7 days.
Saved items, analyses (inputs and reports), shared chart images	Until you delete them or your account
"Remember me" sign-in token	60 days, or until you sign out
Sign-in code	Valid for 10 minutes; only a hash is kept during sign-in
Push subscription, Telegram connection	Until you turn them off, disconnect or delete your account
Notification send log (counts)	365 days
Comments	While published; email address deleted after 180 days; spam deleted after 30 days
Contact messages	365 days
Application logs (errors, security events)	90 days
Web server access logs (IP address, time, page, browser)	Up to about 2 months
Orders, payments, refunds, account history	1 year after account deletion, as a legal requirement; then deleted completely
Payment notification log (IDs only)	30 days
Data held by Anthropic	30 days at Anthropic (up to 2 years if flagged for a Usage Policy violation); with us, until you delete the analysis or your account
Google Analytics data	No more than 14 months, per our Google Analytics data retention setting
Cookies and browser storage	See the Cookie Policy

Security

We protect your data with technical and organizational measures, including encrypted connections (HTTPS), password hashing, sign-in codes, signed and verified payment notifications and restricted access. No system is perfectly secure, so we can't guarantee absolute security.

Your rights

If the GDPR or the UK GDPR applies to you, you have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• data portability: receive your data in a machine-readable format (you can download it as JSON from Account settings);
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing that happened before.

You can do much of this yourself in Account settings. For anything else, email us at hello@12astro.com or use the contact form. We may need to confirm your identity before acting on a request. We reply within one month; if a request is complex, we may extend this as the law allows and will tell you why.

Some data can't be deleted on request: financial records we must keep by law. Payment data held by Dodo Payments is governed by its own privacy policy.

You also have the right to complain to a data protection authority. In the EU or EEA, you can contact the authority in the country where you live or work, or where you believe the problem happened (see the list of EU authorities). In the UK, you can contact the Information Commissioner's Office (ICO). We'd appreciate the chance to sort out your concern first, but you don't have to contact us before complaining.

Withdrawing consent

• Analytics and personalized ads: use the "Cookie preferences" link at the bottom of any page.
• Push notifications: turn them off in Notification settings or in your browser's site settings.
• Email newsletter: use the unsubscribe link in any newsletter, or change your notification settings.
• Telegram: send /stop to the bot or disconnect it in your notification settings.

Your US state privacy rights

This section applies if you live in California or another US state with a consumer privacy law (for example Colorado, Connecticut, Virginia or Texas). The rights below apply where these laws apply to us.

What we collect

In the last 12 months we have collected the following categories of personal information, from you directly and automatically from your browser or device (including through the Google cookies described in our Cookie Policy):

• Identifiers: name, email address, account details, Telegram username and chat ID, Dodo Payments customer and subscription IDs, cookie and device identifiers.
• Personal information described in Cal. Civ. Code § 1798.80: name and email address.
• Characteristics of protected classifications: date of birth (age) and gender, if you give it.
• Commercial information: Star purchases, credit packs, orders and account history.
• Internet or other electronic network activity: analytics data (with consent) and advertising cookie data.
• Inferences: the astrology reports you request.
• Other information you give us: birth time and birthplace, saved items, notes, comments, contact messages, and details you enter about other people.

We use these for the purposes described in What we collect and why, and we keep them for the periods in How long we keep data. We disclose them for business purposes to the service providers listed in Who receives your data.

Sensitive personal information: we use your account password only to sign you in. We don't use or disclose sensitive personal information to infer characteristics about you.

Selling and sharing

We don't sell your personal information for money. However, if you allow personalized ads, Google's advertising cookies may count as "sharing" for cross-context behavioral advertising, or as a "sale" or "targeted advertising" under some state laws. You can opt out in these ways:

• choose "Reject all" in our cookie window, or open "Cookie preferences" at the bottom of any page and leave "Personalized ads" unticked;
• use the "Do Not Sell or Share My Personal Information" link that Google shows at the bottom of the page in the states where this applies;
• become a Star member: Star members don't see ads.

We do not knowingly sell or share the personal information of consumers under 16.

Global Privacy Control: If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sharing for targeted advertising: we ask Google only for non-personalized ads in that browser, even if you allowed personalized ads in our cookie window.

Your rights

Depending on your state, you have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• delete it;
• correct it;
• opt out of its sale or sharing, and of targeted advertising;
• not be discriminated against for using these rights: we won't deny you the service, charge you a different price or give you a different quality of service because you used them.

To make a request, email us at hello@12astro.com or use the contact form. You can also download or delete your data yourself in Account settings. We'll need to verify your identity: usually by confirming the request from the email address on your account, or by asking you to sign in. We respond within the time the law requires: one month under the GDPR and UK GDPR (extendable where the law allows), and 45 days under US state laws (extendable once by a further 45 days).

Authorized agents: you can ask someone to make a request for you. We may ask for proof that you gave them permission, and we may ask you to verify your identity directly with us.

Appeals: if we decline your request, you can appeal by replying to our answer or by emailing hello@12astro.com with "Appeal" in the subject. We'll respond within the time your state's law requires, and if you're not satisfied with the outcome, you can contact your state attorney general.

Children

12astro is not directed at children under 13. You must be at least 16 to create an account. If you believe a child has given us personal data, please contact us and we will delete it.

A parent can request a child–parent analysis and enter details about their own child for that report. Only a parent or legal guardian should do this.

Links to other sites

The site may link to other websites. Their own privacy policies apply, and we aren't responsible for how they handle your data.

Changes to this policy

We may update this policy when our services or the law change. We'll publish the new version on this page. If we make significant changes, we'll also let members know by email or with a notice on the site.

Contact

For any privacy question or request, email hello@12astro.com, use the contact form, or write to Ömer Tekin, Meşelik Mh. Milas-Bodrum Yolu, No:144, Karia Port, Muğla, Türkiye.