Velara: AI Astrology & Tarot ("Velara") is a mobile app for iPhone and Android that calculates your birth chart from real astronomical data and uses artificial intelligence to put it into plain, personal language. This policy explains what data we collect, why we collect it, what reaches the AI provider and how you can delete it.
01 Data controller
The Velara app and its related services are operated by the person identified below ("Velara", "we", "us"), based in the Republic of Türkiye. We are the data controller for the personal data described in this policy — the party that decides why and how it is processed — under the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU and UK General Data Protection Regulations ("GDPR" / "UK GDPR") where they apply to you, and the other privacy laws listed in Your privacy rights.
02 Data we collect
| Category | Scope | Source |
|---|---|---|
| Account data | E-mail address, Apple or Google account identifier, display name; if you use a password, only a one-way hash of it | You, Apple or Google |
| Birth data (sensitive) | Date of birth, time of birth (if known), place of birth (city, coordinates, time zone) | You |
| People you save (Velara+) | The name or label you give a person, their date, time and place of birth, and the relationship type you choose for a compatibility report (Partner, Family or Friend) | You, about another person |
| Preferences | Reading style, areas of interest, Velara AI persona, daily notification on/off and time, time zone, and your AI consent choice (with the time and version of the consent screen) | You |
| Text you type | Velara AI chat messages, dream descriptions, intentions, questions you ask in I Ching, and the full name you may enter in Numerology | You |
| Generated content | Your readings, interpretations, compatibility reports and history, stored in your account so you can return to them | Created by the app |
| Usage data | In-app events (screens opened, features used, Discover categories opened or closed), device platform (iOS or Android), and technical records of AI requests (which feature, size and cost — not the content) | Automatic |
| Device and technical data | Push notification token (only if you allow notifications); IP address, used briefly to protect the service and rate-limit requests | Automatic |
| Purchase data | Subscription status, plan, store, transaction identifiers and the price reported by the store (card details never reach us) | Apple / Google, via RevenueCat |
People you save. Only add someone if you are entitled to share their birth details with us — for example, because they agreed. You can delete a saved person at any time in Charts of Your People; their data and any compatibility reports with them are deleted with them.
03 Purposes of use
- Calculating your birth chart and transits (deterministically, with the Swiss Ephemeris).
- Personalising daily readings, transit interpretations, Discover features and Velara AI replies.
- Sending the daily notification at the time you choose, if you allow notifications.
- Managing your subscription and verifying your purchases.
- Sending password reset codes and answering your support requests.
- Detecting abuse (excessive requests, off-topic chat attempts) and keeping the service secure.
- Improving the product — through aggregated usage statistics.
Discover personalisation. Discover is ordered and grouped using the areas of interest you choose during sign-up or in Profile → Preferences. The order is calculated from those preferences without AI and is not shared with anyone. We record when you open or close a category, as usage data, to learn whether the layout helps.
We do not use your birth data for advertising and we do not sell it to anyone.
Legal bases (GDPR / UK GDPR): we process your account, birth, preference and purchase data because it is necessary to provide the service you asked for (performance of a contract). Sending data to the AI provider and sending push notifications rely on your consent, which you can withdraw at any time. Abuse detection, security and aggregated product statistics rely on our legitimate interest in keeping the service safe and working; purchase records are kept to meet legal obligations.
04 AI processing
Velara AI and all AI-generated interpretations are produced by OpenAI language models. Anthropic may be configured as a fallback provider for service continuity; if the provider that receives your data changes, we update this policy and ask for your AI consent again.
Your consent comes first
Before anything is sent to the AI provider, the app asks for your permission on a separate screen that explains that a third-party AI service writes the interpretations, what is sent and what is never sent, and links to this policy, which names the provider. You can choose Allow or Not now. Without consent, the calculated parts of Velara keep working — your birth chart, scores, transits, card meanings and other results computed by the app — while AI-written interpretations and Velara AI chat stay off. We record the time and version of your choice on our servers.
You can withdraw your consent at any time with the AI features switch in Profile, and turn it back on the same way. From the moment you withdraw it, nothing new is sent to the AI provider. Content that was already generated stays in your account until you delete your account.
What is sent, and what is not
Astrological calculations — planetary positions, houses, aspects and dates — are always performed by our own deterministic engine, outside the AI. Only computed results are sent to the model: for example "Sun in Cancer, 4th house", transit dates, the meanings of the cards or hexagram you drew, your numerology numbers or your quiz result profile. When you create a synthesis or compatibility report for a saved person, their computed chart is sent the same way.
We never send your name, display name, e-mail address, the name of your birthplace, your coordinates, your date of birth, the names or labels of the people you save, or your account identifiers.
Chat messages and dream descriptions first pass an automated check, also run by the AI provider: chat messages are classified to keep the conversation on topic, and dream texts are checked for signs of a crisis. If a dream text shows such signs, it is not interpreted and not saved; a supportive message is shown instead.
How long the AI provider keeps your data
We send every request with OpenAI's response storage turned off (store: false),
so OpenAI does not keep the request or the reply as saved application state. Like all
traffic to OpenAI's API, requests may be kept in OpenAI's abuse-monitoring logs for up to
30 days, unless the law requires longer, and are then deleted. Data sent through OpenAI's
API is not used to train OpenAI's models.
On our side, chat messages and generated content are stored in your account for as long as it exists; see Retention and deletion. AI-generated content is labelled in the app and can be reported from where it appears. It is never used to make decisions that have legal or similarly significant effects on you.
05 Service providers
Our contractually bound service providers that help us process your data:
| Provider | Role |
|---|---|
| OpenAI | AI text generation (Velara AI, daily readings, interpretations) — only with your AI consent |
| Anthropic | Fallback AI provider (only when enabled; see AI processing) |
| Apple | Sign in with Apple; App Store in-app purchases; delivery of push notifications to iPhones |
| Sign in with Google (only if you choose it); Google Play in-app purchases; delivery of push notifications to Android devices (Firebase Cloud Messaging) | |
| RevenueCat | Subscription status synchronisation between the stores and our servers |
| Expo (650 Industries) | Push notification delivery — your device's push token and the notification text, passed on to Apple or Google |
| Sentry | Error and crash monitoring (configured to exclude request contents) |
| Resend | Delivery of password reset e-mails — only your e-mail address and a one-time code; servers in the EU (Ireland) |
| Hetzner Online | Server hosting and the encrypted database (Germany, EU) |
| Cloudflare | Domain name service, hosting of these web pages and forwarding of e-mail sent to our addresses |
| Cloudflare R2 | Off-site storage of our nightly database backups, encrypted at rest and kept for 7 days |
We do not sell your personal information and do not share it with any other party for advertising. We disclose data to anyone else only when the law requires it.
06 International transfers
Our servers are in Germany (EU). Some providers above — notably OpenAI, Apple, Google, RevenueCat, Expo, Sentry and Cloudflare — process data in the United States or other countries. Where data leaves your country, the transfer relies on the safeguards the law requires, such as the European Commission's Standard Contractual Clauses (and the UK addendum) or an adequacy decision, as offered in each provider's data processing terms.
07 Retention and deletion
We keep your data for as long as your account exists. When you complete Profile → Delete my account in the app, your account and the personal data linked to it (including birth data, birth chart, saved people, chat history, dream, intention and question texts, readings and reports) are deleted permanently and irreversibly. This happens immediately in the live system. If you cannot use the app, you can ask us by e-mail — see Delete your account.
Your data may remain for up to 7 more days in the security backups taken regularly for disaster recovery, after which it is deleted automatically. During this period backups are used only to restore the whole system after a failure; the data of a deleted account is never restored individually or processed again.
Detailed usage events are deleted after 180 days; after that only daily totals that do not identify anyone are kept. A few account milestones (such as when a subscription starts or is cancelled) are kept while your account exists. When an account is deleted, its usage events and AI usage records are kept only in a form that is no longer linked to it.
Purchase records may be kept longer by Apple or Google under their own policies and tax law; RevenueCat keeps the purchase history of a random account identifier (not your name or e-mail address) as a financial record.
08 Your privacy rights
Wherever you live, you can see, correct and delete your data. Account deletion is available directly in the app (Profile → Delete my account), and you can withdraw your AI consent in Profile; every other request can be sent to the address in the contact section. We reply within 30 days at the latest and may ask you to confirm the request comes from your account. Depending on where you live, the following rights also apply.
European Union and United Kingdom (GDPR / UK GDPR)
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format and to withdraw consent. You can also lodge a complaint with your local data protection authority — in the UK, the Information Commissioner's Office (ICO).
United States (including California — CCPA/CPRA)
You have the right to know what personal information we collect and why, to request its deletion and correction, and not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of.
Canada (PIPEDA)
You can access and correct your personal information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada.
Australia (Privacy Act 1988 and the Australian Privacy Principles)
You can access and correct your personal information and complain to us first, and then to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied.
Türkiye (KVKK)
Under Article 11 of KVKK you can learn whether and why your data is processed, request its correction or deletion, object to a result produced solely by automated processing and claim compensation for damage caused by unlawful processing.
09 Data security
Your data is encrypted in transit with TLS and stored in our hosting provider's disk-level encrypted databases. Your session keys are kept on your device in secure storage (the iOS Keychain or the Android Keystore). Access to the admin panel is limited to two-factor authentication (TOTP) and every administrative action is written to an audit log.
10 Age requirement
Velara is intended for adults. You must be at least 18 years old to use it, and we do not knowingly collect data from anyone under 18. If we become aware that we have collected data belonging to someone under 18, we delete it immediately.
11 Changes to this policy
When we make a material change to this policy we notify you in the app before it takes effect. Continuing to use the app after the change means you accept the current policy.