Privacy Policy

Last updated: October 16, 2026

AstroLina is a small, two-person project — a mother and her son. This policy explains what personal information we collect when you use AstroLina, with or without an account, why, who else receives it, and the choices you have. We try to collect as little as possible. This version applies from October 16, 2026, except where a later date is given.

If you have any questions, email us at contact@astrolina.org.

At a glance

• What we collect. For an account, your email address and, if you like, a display name. From the devices where you choose to sync: your charts — the birth details of you and anyone you add, with your notes — and, with Pro, your journal, saved reports and Custom theme. If you buy Pro, your plan and its status (your card number goes to Stripe, never to us). Visit counts you can switch off, security and traffic records, records of what you agreed to and which notices we sent, and any translation report you send. Without an account, we keep nothing about you beyond short-lived security and traffic records, anonymous daily counts and search caches — unless you start signing up (we then hold your address for up to 30 days) or we set up a code or access for your address.
• Who else receives it. Cloudflare runs our hosting and database and sends our automatic emails, in the United States and worldwide. Google holds our mailbox. Stripe takes payments. Place searches go through our servers, without your identity, to komoot's Photon and OpenStreetMap's Nominatim. Your browser fetches the map itself from OpenFreeMap. We don't sell personal information, show ads or use third-party trackers.
• Why. To run your account and sync your work, take payments, send sign-in codes and the notices we're required to send, keep the service secure, count traffic to the website and app, see whether the app is used and in which languages, fix translations you report, and — only if you opt in — send product updates.
• The risks. What you sync, including birth details and notes, is stored outside Canada, in the United States, and travels through Cloudflare's worldwide network: a breach could expose it, and foreign courts and authorities can reach it. Share links and exported files can't be recalled once sent. Anything kept in your browser — including the life events you enter for birth-time rectification — can be read by anyone who uses that browser. Your browser's own page translator may send page text to its maker.
• Your choices. Use AstroLina without an account. Choose, on each device, whether to sync. Switch off visit counting, or ask us to. Product emails are opt-in. Delete anything you've saved, or your whole account, and ask us for a copy of what we hold.

What changed

On October 16, 2026, a correction. A share link now carries the chart's source rating, the code that says how far its birth time can be trusted, so the person you send it to sees that too (see Share links). It still never carries the chart's notes, and like the rest of what a link holds, the rating never reaches us. Why: without it, a birth time that was rectified or only remembered reached the recipient looking like a recorded one. Nothing else changed. You can still read the version dated October 15, 2026.

On October 15, 2026, this policy replaced the one dated September 30, 2026, which you can still read here. What changed then, what it means for you, and why:

• New choices. For you: each is on your account screen, in the tool or an email away, whenever you want it. Why: privacy by default (Quebec's Law 25), your right to object, and deleting what a tool keeps without deleting your account.
  • Sync is a choice you make on each device when you sign in — before, it was on unless you switched it off. Nothing from a device is stored with us until you choose; devices already signed in keep their setting.
  • Visit counting you can stop: a "Count my visits to the app" box on your account screen when you connect from the EU, the EEA, the UK, Switzerland or Quebec, or once your counts are off, and, for anyone, a request by email. Stopping it erases the counts. Counting starts off for accounts created from Quebec, and on for accounts that already existed.
  • A Custom theme left with no changes to the look it started from (whichever look, whatever its name) is removed from our servers when you close its settings; Clear clues empties a rectification case file.
• New tools, described. The street-level view, birth-time rectification, the interface languages with on-device auto-translation, and the Custom theme: what each reads, keeps and sends. For you: nothing changes if you don't use them. Why: so this policy covers each tool as it reaches the app; some aren't there yet.
• New records. Which version of the Terms and of this policy you accepted, when and how; the service and legal notices we send you, which go to every account holder; purchase confirmations and the copies of the Terms we email you; withdrawal and cancellation requests, and our replies to them; reports about content, and what we decided; any translation report you choose to send, with or without your account on it; and, from November 20, 2026, the language the app opens in, added to daily totals for each language and never recorded against your account. For you: nothing to do; the records about you go with your account. Why: consumer law requires some of these, we need to be able to show what was agreed and sent, and we want to fix our translations and see which of them people use.
• Described in more detail. Everything a synced chart holds, including notes, its source rating and both people in relationship charts; the country we read from your IP address (not stored); the human check on the sign-in form; Cloudflare's security cookies on the website and in the app; rate limits on the email you sign in with; access set up before sign-up; who can get a discount code or access we send by hand; data from older versions of the app; billing extras; backups of up to 30 days; logs; the traffic counts Cloudflare keeps for us; search caches; our mailbox at Google (Google Workspace) and how long we keep your messages (up to three years); the list of addresses our email service can't write to; and this website. Three changes: discount codes no longer carry your address at Stripe, and we removed it from earlier codes; we deleted the waitlist, which closed when Pro launched; and the website and the app no longer run two Cloudflare scripts: Web Analytics, which measured pages, and an automatic bot check. For you: apart from these three, nothing changes in what we do. Why: accuracy.
• Where information goes, and your rights. Each provider is named with its country and safeguard, including that foreign authorities can reach information stored abroad. New or fuller sections cover objecting, exports (JSON or CSV), regulators, breaches, automated decisions, other people's information, governance and how we announce changes. We now also say when we may disclose information the law allows but doesn't require us to (to protect someone's life, health or safety, to prevent or report fraud or a crime, or to bring or defend a legal claim), and that professional advisers, such as an accountant or a lawyer, may see what they need. Response times: we used to promise 30 days for every request; a complex request can now take longer, as the GDPR (up to two more months) and PIPEDA (up to 30 more days) allow, and we tell you why. For you: no new kind of recipient apart from our professional advisers, more ways to use your rights, and, for a complex request, possibly a longer wait. Why: Canadian, Quebec, EU and UK law.

As before, we're not selling personal information, showing ads or tracking you across other sites, and apart from our professional advisers, no new kind of company receives it.

Who we are

AstroLina is web-based astrocartography software, available at astrolina.org and at maps.astrolina.org. Its core is free and open source; a free account unlocks the Advanced toolkit, and a paid Pro tier the professional toolkit.

Lina Grosso, operating as AstroLina ("we"), is responsible for the personal information in this policy: under EU and UK law, its "controller". We're based in Ontario, Canada.

• Address: 1 Lomond Dr, Toronto, ON M8X 2Z3, Canada
• Phone: +1 416-231-6020
• Email: contact@astrolina.org

Privacy Officer. Salvatore Grosso is our Privacy Officer. By written delegation from the owner, Lina Grosso, he is the person in charge of the protection of personal information under Quebec's Law 25, and he is accountable for our privacy practices under Canada's PIPEDA. Write to him at contact@astrolina.org or at the address above.

For client information that a professional stores with us, we act for the professional — see Information about other people.

What we collect

We only collect what's needed to run your account and keep the service working. Your email address is all you must give us for an account, and paying for Pro needs the details Stripe asks for at checkout. Everything else is optional — and you can use AstroLina without an account at all.

Your account

• Your email address, for your sign-in codes, notices about your account and our agreement with you, a question about a translation report you sent under your account if we need to ask one, and — only if you opt in — product updates (see Emails we send).
• A display name (optional), shown in your profile and used to greet you in some emails.
• Your product-email choice: whether it's on, the date and place you first said yes (at sign-up or on your account screen), and, while it's off, the date you opted out. We keep the first yes even after you opt out, so we can show we honoured both.
• How you found us (only if you answer). We ask once, after you sign up. We keep the option you picked and anything you typed beside it — or, if you dismiss it, only that we shouldn't ask again.
• Your messages to us at contact@astrolina.org or support@astrolina.org, and our replies.

What you sync

Only from devices where sync is on (see Your charts and sync).

• Your charts — everything in a chart in your library: its label, birth date and time, whether the time is known, the time-zone choice, the birthplace (name and coordinates), its tag and folder, a home location if you set one, your notes, its source rating, and when you last used it. A relationship chart (composite or Davison) also holds both people's birth details.
• Journal entries and saved pins (Pro) — each entry's spot (coordinates, place name and country), its chart and, if you set them, a partner chart and how the two are overlaid, plus your title, notes, category and event date.
• Saved reports (Pro) — the cover text you wrote (such as a title, a client's name and your byline), the places covered, settings, notes, and any map images you added. Drafts you never save to your library stay in your browser.
• Your Custom theme (Pro), described under Your Custom theme.

When you delete one of these in the app on a device that syncs it, it's removed from our servers too (for Pro content, while you're on Pro). Delete it on a device while that device's sync is off, and it's removed when you turn sync back on there, if the device had synced it before; otherwise, ask us and we'll delete it. A small deletion marker stays for about 30 days so the deletion reaches your other devices.

From older versions of the app

If you used AstroLina before late July 2026, or an installed copy from before then, your account may still hold pinned cities or saved places (each a name and coordinates) and an account-wide home location. A current version of the app moves that home location onto a chart and clears it from your account the next time it syncs. The rest stays until you delete your account or ask us to remove it.

Billing

Only if you buy Pro. Payments are processed by Stripe: your card number and billing address go straight to Stripe, to process the payment and work out sales tax, and your card number never touches our servers (when we email you about your plan, we show your card's brand and last four digits, read from Stripe at that moment and not kept). We keep what we need to run your plan:

• your plan (a subscription, or the lifetime purchase paid outright or monthly), its status and next payment or renewal date, whether it's set to end, since when you've had Pro, whether you've used a free trial, and the references linking all this to Stripe's records;
• for each purchase, the date of its first payment and whether its billing address was in the EU, the EEA or the UK, which decides how the app shows the online withdrawal (it's there for every purchase in its first 14 days), and for an upgrade, the plan it replaced and the date that plan would have ended;
• if you stop paying monthly for the lifetime purchase, how your payments became Pro time (amount, currency, date, and the date that time runs to); if you withdraw from an upgrade, the date the time we give back runs to;
• if a payment was refunded or disputed, a flag saying so and when we reviewed it;
• the confirmation we email you for each purchase (the plan, the price, the tax and what was charged) and, if you accept new Terms in the app while you pay for Pro, the copy of them we email you; and when each was sent.

Discount codes (only if we issue you one). We record the code against your email address — that stops anyone else spending it — with who issued it and when it was used. Stripe holds the code and its discount, but not your address: we removed addresses from the codes we issued earlier.

Complimentary access (only if we give you some). We record that Pro was given rather than bought, the course or occasion, and when it ends. For a class link, we also record that you took one of the course's places, when, when we reminded you it was ending, and whether it was withdrawn. We can also set up access for an address before it has an account; we then hold that address with the access waiting for it. We get that address from you, or from whoever arranged the access for you, such as your teacher. We tell you when we first email you, and you can ask us to delete it.

How often you use the app

When you open AstroLina while signed in, we record when you last opened it (the date and time) and add to two counters on your account: on how many separate days you've opened it, and how many times in all. That's all — no page, no feature, no place, nothing you drew on the map — whether or not sync is on.

You decide whether we count. When you connect from the EU, the EEA, the UK, Switzerland or Quebec, or once your counts are off, your account screen shows a "Count my visits to the app" box. Wherever you are, you can also ask us at contact@astrolina.org to stop the counts. Counting starts on for most new accounts, and for accounts that existed before we added it. If your connection appears to come from Quebec when you create your account, it starts off; we don't store the region, only the setting it gave your account. If you live in Quebec and counting started on for you, untick the box, or email us if you don't see it. Either way, stopping the counts erases the date and both counters, keeping only that counting is off and when it changed.

Stopping them doesn't affect what sign-in and sync need: your sign-in sessions record when you signed in and, to within a day, when the app last reached us, and each synced item records when it last changed.

Separately, we keep daily totals — app openings (by guests, free and Pro accounts, and, from November 20, 2026, by the language the app opened in), active counted accounts (overall and, from that date, by language), sign-ins, and sign-in codes sent or failed — as plain numbers with no account, device or address attached. While your visits aren't counted, your account isn't in the active-account totals, overall or by language, but your openings still go into the opening totals. We also count how many charts, journal entries and saved reports each account holds, to see which parts of the app people reach for. To count them we read a few details inside — leaving out the untouched example chart, telling saved pins from entries, and noting whether a home location is set — but only the numbers come out. Stopping your visit counts doesn't change that, because the numbers come from what you sync.

Traffic to the website and the app. Cloudflare, our host, counts the requests that reach astrolina.org and maps.astrolina.org, and shows us how many requests and visitors there were and which countries they came from. It works this out from the requests themselves, without reading or storing anything in your browser. It lets us see the records behind the counts — your IP address, the page, your browser and device type, and your country — for 31 days (Cloudflare keeps them at least that long, under its own rules), and daily totals, which name no one, for about a year. We use only the totals and never tie them to an account, so the "Count my visits to the app" box doesn't affect them.

Security

• Sign-in codes and sessions are stored only in hashed form — never the codes or tokens themselves.
• Rate limits. To stop abuse, we keep short-lived counters keyed on your IP address, the email address you sign in with, or your account. Their windows run from seconds to a day, and each is deleted within a day after its window ends.
• The human check. Our sign-in form runs Cloudflare Turnstile in your browser when it opens, to tell people from bots, and before we send a new code we check its answer with Cloudflare, sending your IP address. A resend while your code is still valid relies on rate limits instead.
• Bot checks. On the website and in the app, Cloudflare may ask a connection that looks suspicious to pass a challenge, and remembers that your browser passed in a cookie (see Cookies and device storage).
• Your country. Cloudflare tells us which country, and in Canada which province, a request comes from. We use it to price in Canadian or US dollars, to show the EU/UK withdrawal information, to decide whether a withdrawal takes effect at once and whether to show the "Count my visits to the app" box, and to set where counting starts for a new account. We don't store it.
• Server logs. Cloudflare keeps logs for us: our admin dashboard's, which name an account's email address when we look it up; a record of requests its security features block or flag, with the IP address and the page asked for; and a record of each email we send and whether it was delivered (for product updates, with a copy of the message itself).

Records of notices and agreements

• What you accepted: which version of the Terms and of this policy you accepted or acknowledged, when, and how — at sign-up, with Accept (or Got it) in the app, or at checkout. Acknowledging an update to this policy records that you've seen it; we never treat it as consent. Stripe keeps its own record of the Terms box you tick at checkout.
• What we sent you: which notices and product updates we sent to your address, when, and whether sending succeeded.
• Withdrawals and cancellations: what you submitted (your name, the purchase or plan, the email address for our confirmation, the statement you confirmed, for a withdrawal whether you said you live in the EU, the EEA or the UK, and for a cancellation whether it was ordinary or extraordinary and the reason you gave), when, whether it took effect at once or waits for our reply, our confirmation and when it was sent, and when any refund was made.
• Copies of the agreement: the purchase confirmations and copies of the Terms we email you, and when each was sent.
• Reports about content: if you report content under the Terms, your report, your name and email address, and what we decided.

Translation reports

Only if you send one. While you're signed in and the app is shown in one of its five translations (not English, and not an Auto-translated language), a Report a translation issue link sits under Settings ▸ Appearance ▸ Language. If you send a report, we keep the language it's about, what you wrote (up to 2,000 characters), when it arrived, and your account, so we can follow up if we need to. Tick Send anonymously and the report is stored without your account — and without your email address, IP address or browser details — so it's not linked to your account. Either way, each account can send up to 10 a day; the counter that keeps that limit is keyed to your account, is short-lived, and isn't linked to the report. If we use wording you suggest, it goes into the app's translation files — some of them public, in the open-source core — without your name or the rest of your report. We keep a report for 365 days; one sent under your account is deleted with your account if that comes first (retention).

Tools that work on your device

Street and Sherlock are our names for the street-level view and birth-time rectification, which may not be in the app for you yet. These tools, the interface languages and the Custom theme's share codes work mostly in your browser. Here is what each reads, keeps and sends.

The street-level view

Part of the Pro toolkit. It shows the city in 3D around the chart's origin — the birthplace, a home location you set, or a pin.

• Your device's sensors. In mobile mode the view turns as you turn your phone or tablet, using its orientation sensors (compass and tilt). On iPhone and iPad your browser asks you first; other browsers don't ask, so when the view opens there, the app checks for a few seconds whether a sensor exists. The readings only steer the view: they stay on your device and aren't stored.
• Never your location. The view assumes you're standing at the origin. The app never asks for your location, and blocks itself from reading it.
• Screen and vibration. In mobile mode the app keeps your screen awake and, on phones that can, vibrates briefly as you face a bearing. Your settings for the view stay in local storage.
• Map tiles. Opening the view makes your browser fetch detailed map tiles from OpenFreeMap for the streets around the origin. OpenFreeMap therefore receives your IP address and that neighbourhood — which may be where someone was born or lives.

Birth-time rectification

Part of the Pro toolkit. It works out an unknown birth time from clues, including life events from a fixed list, each with a date and, if you like, a place. Life events can reveal health, sexuality or gender identity, religion, trouble with the law, violence or loss, and can be about relatives and partners as well as the chart's own person.

• Your clues stay in that browser. A chart's clues and answers — its case file — are kept only in that browser's local storage, in plain text. They're never sent to us; we don't sync, share or back them up, and they never appear in share links or reports. As we can't see them, we can't export or delete them for you.
• Place searches for a clue work like any place search (see Who we share it with).
• Adopting a time writes the hour and minute to the chart, sets its source rating to C, and adds one line to its notes saying the time was rectified, when, from how many clues and within what window of minutes — nothing from the clues themselves. If sync is on, the chart syncs with it.
• Removing a case file. Clear clues empties it at any time. It keeps only what Undo needs: the adopted time and the chart's details from before you adopted it, including its earlier notes. A case file is also deleted after you delete its chart — the next time the app opens, or, if that was the last chart in your library, once the library has a chart again — and when you delete your account on that device; signing out keeps it. Anyone who uses that browser can see it, so on a shared computer, clear your clues when you're done.

Interface languages

• Which language. Besides English, the app can be shown in Spanish, Brazilian Portuguese, Turkish, German or Russian. Until you choose, it follows the language of the link that brought you, if it named one, or else your browser's language settings, which it reads in your browser. It keeps the language you choose, the one a link asked for, and the one it opened in (so it mentions that only once) in your browser's local storage, not on your account. Your browser fetches that language's files from our site like the rest of the app.
• What we count. From November 20, 2026, when the app opens while you're online, it tells us which language it's shown in: English, one of the five translations, or an Auto-translated language, marked as such. We add it to two daily totals for that language — how many times the app was opened in it, guests included, and how many signed-in accounts used it that day, each counted once, in the language of its first opening that day — and to nothing else: it's never recorded against your account or your session. While your visits aren't counted, your account isn't in the second total; your openings are still in the first, like everyone's. A translation report you send does say which language it's about.
• How they're translated. The five translations are machine-made, with an automated review. Where they include the wording you agree to or pay by, a note beside it says that only the English version is legally binding, and a button shows the English. This policy, the Terms and our emails are in English.
• Auto-translated. The menu's Auto-translated languages work differently: their wording is translated by your browser's built-in translator, on your device, from the app's own English — its menus, buttons and Help pages, never your charts, notes, names, places or journal, which are left out before anything is translated. The first time, your browser may download a translation model from its maker. What it translates is cached in your browser (a store named astrolina-i18n), even after you sign out, until you clear your browser's data for AstroLina. The wording you agree to or pay by — sign-up consent, checkout and billing — stays in English.
• Your browser's own translation. A browser's "Translate this page" feature is not ours, and may send the page's text — chart details included — to the browser's maker. That's outside our control; the app offers its own translation instead where it can.

Your Custom theme

• What's stored: the look it started from; the colours, line styles and effects you chose; settings saved by newer versions of the app; its name, if you give it one; and when it was last changed. The name is free text, so please don't put personal information in it. Which theme each device shows is that device's own setting, and a look with no changes of yours (Plain, or any other under Start from) isn't stored with us at all.
• When it syncs: only from devices where sync is on, and only while you have Pro. If Pro ends, your theme stays on our servers, so it's there if you come back — unless it's removed as below.
• Reset clears your colours and effects. Close the theme's settings with nothing changed — after Reset, or after choosing a look under Start from — and the theme is removed, as below; its name goes with it.
• Removing it. When you close your Custom theme's settings with no changes left — on whichever look it started from, and whatever its name — it's removed from our servers the next time that device reaches us, if it syncs, and your other devices drop their copy the next time they sync, show the look their own copy started from, and tell you so. Nothing is removed while that device has the settings open. A device where you'd changed the theme since its last sync asks you whether to delete its copy or keep it as a new theme, and a device that doesn't sync keeps its copy until you clear it there too. We keep only the date it was removed, so an older device can't bring it back, until you delete your account. To have it deleted any other way, or if you're no longer on Pro, email us and we'll delete it.
• Share codes are made and read entirely in your browser. A code holds the theme and its name, nothing else; we never see it, and, like a share link, it can't be recalled once given.

Your charts and sync

With sync off, your account still unlocks everything your plan includes, but what you make on that device stays in its browser. Either way, the maps and lines AstroLina draws, and your other app settings, live only in your browser.

You choose, on each device. When you sign in on a device, the app asks how that device should keep your work: Sync with my account (marked Recommended; pressing Enter chooses it) or Keep on this device only. Nothing syncs until you choose. A device that was already signed in before we added this question keeps the setting it had. You can change it at any time with the sync switch on your account screen.

What the switch covers is your content, not your account. With sync off, the app still checks your session and plan, counts your visits unless counting is off, tells us which language it opened in (for the daily totals, from November 20, 2026), sends us your account actions (billing, email choices, display name) and any translation report you send, and looks up places. Anything synced earlier stays on our servers until you delete it from a device that syncs, ask us to, or delete your account; a deletion made on a device while its sync is off reaches us when you turn sync back on there.

Share links

AstroLina can make a link that opens a chart exactly as you see it. The chart's name, birth date, time, time zone and birthplace (with its coordinates), its source rating, and the map view and any pin you've placed, are encoded in the link itself, after the #. Browsers don't send that part to a server, so the link itself never brings these details to us, and we keep no copy of it. The link doesn't carry the chart's notes, and one made while you're trying out a birth time carries that time without the rating. Links made before October 16, 2026 carry no rating, and those made before late July 2026 carried their details in the address itself, before any #, so opening one of those sends them to our hosting provider, Cloudflare, like any web address.

What we can't do is take a link back. Anyone who has it can open it, and neither we nor you can revoke it. Opening one adds the chart to the recipient's own library, where it's treated like any chart they make (synced if their device syncs). Share these links only with people you trust with those details, and only with the permission of the person they describe.

Exports

Images and PDFs of the map, a chart or a report are made in your browser, and we never receive them. Whatever you include goes wherever you send it.

Cookies and device storage

What AstroLina keeps in your browser is there to run the app for you or to keep it secure; your sign-in cookie also lets us count your visits to the app, as described below. There are no advertising cookies, no analytics scripts and no third-party or cross-site tracking. You can block or delete cookies and site data for AstroLina in your browser's settings at any time: without the sign-in cookie you can't stay signed in, and clearing site data deletes what is kept only in that browser, such as charts that aren't synced and rectification case files.

• Your sign-in cookie. When you're signed in, a secure, HttpOnly cookie (__Host-astro_sess) holds a random token, not your details. It can last up to 400 days, but the session behind it ends after 30 days without the app reaching us, or when you sign out. While your visits are counted, the same cookie also lets us add your visit to the counts described under How often you use the app.
• Cloudflare's security cookies. If Cloudflare, our host, asks your browser to pass a challenge to show it isn't a bot, on the website or in the app, it records that your browser passed in a cookie, cf_clearance, which the website and the app share. It's tied to that browser, not your details. Your browser keeps it for up to a year, but Cloudflare treats a pass as current for about 30 minutes. While the challenge runs, Cloudflare may also set other cookies (cf_chl_rc_i, cf_chl_rc_ni, cf_chl_rc_m) that it uses to spot faults in the challenge itself. They're used only for security, Cloudflare classes them as strictly necessary, and our own code never reads them. If your browser refuses cf_clearance, it can't remember that you passed, so a page that asks for the challenge may not open.
• Local storage. Your settings; a cached copy of your sign-in state (your email, plan and billing summary); your local charts, journal and report library; that device's sync choice; the street-level view's settings; rectification case files; your language choice, the language the last link into the app asked for, which language the app last told you it opened in or couldn't show, and your answers to its notes about translation; a copy of your Custom theme and, while its settings are open, a note that they are, so another tab doesn't sync a half-made change; and short-lived notes the app keeps while you sign in or follow a class or offer link.
• Session storage. Whether you chose Later on an update notice, and a few technical flags that stop the app reloading in a loop, until you close the tab.
• IndexedDB. The images in your reports, and the auto-translation cache.
• Offline cache. The app's own files — the software, astronomical data, language packs and map fonts — so AstroLina loads quickly, works offline and can be installed. Never your charts or account details.
• Device features. Orientation sensors, keeping the screen awake, and vibration — only in the street-level view, as described above.
• The human check. Cloudflare Turnstile runs in your browser while the sign-in form is open.
• Failed loads. As on our website, Cloudflare may ask your browser to keep a reporting rule for 7 days and report app pages that fail to load (Network Error Logging). Loads that work aren't reported.

Emails we send

Replies to our notices reach contact@astrolina.org. Every email that can carry an offer lets you stop offers; unsubscribing (on the page a product update's link opens at maps.astrolina.org, or by replying to a hand-sent offer) stops product updates and offers, while notices about your account still reach you, without offers.

Product updates

Product and feature emails are opt-in: the box is unticked when you sign up, and an account never requires it. Change your mind whenever you like, with the unsubscribe link in any of them or the email choice on your account screen. It takes effect straight away, and never later than 10 business days. Opting out doesn't affect your account.

Why we use it, and our legal bases

Each purpose, what it uses, the legal basis we rely on for people in the EU, the EEA and the UK, and how long it's kept (in detail):

Where we rely on legitimate interests, we've weighed them against yours, and you can object.

In Canada, we rely on your consent: implied when you use a feature that needs the information, and express for product emails. You can withdraw it at any time, subject to legal or contractual limits, and we'll tell you what that would mean for the service.

Who we share it with

We share personal information only as described here.

• Cloudflare acts only on our instructions, under written data-processing terms that require protection comparable to this policy. Its search caches are keyed by what was asked, not by who.
• For the human check, Cloudflare also uses the signals it collects (including your IP address) for its own purpose of improving its bot detection, as an independent controller (Turnstile privacy policy).
• Stripe handles payments for us under its data processing agreement, and also uses payment data on its own account — for example to prevent fraud and to meet financial regulation — under its own privacy policy. It shares back only what we need to run your plan — never your full card number.
• komoot and the OpenStreetMap Foundation act as independent services, not on our behalf, under their published terms, and receive nothing that identifies you. A place search asks Photon only when the app's built-in offline atlas isn't enough. We ask Nominatim to name a spot you tag or pin when the atlas can't, and, when you're zoomed in, to refine the atlas's name.
• OpenFreeMap serves map tiles to your browser directly, as with any online map (its privacy page).
• Our mailbox. Email you send to contact@astrolina.org or support@astrolina.org, and everything we write from those addresses, is held by Google (Google Workspace), which acts for us under its data processing terms.
• If AstroLina changes hands, the new owner would receive what it needs to keep running the service, bound by this policy, and we'd tell you.
• Authorities and legal claims. We disclose information when the law requires it, or where the law allows it and it's needed to protect someone's life, health or safety, to prevent or report fraud or a crime, or to bring or defend a legal claim: only what's needed, and only to the courts, police, regulators or others the matter concerns. Client information we hold for a professional (Information about other people) we disclose only where the law requires it. We'll tell you, unless the law forbids it or telling you could put someone at risk or harm an investigation.
• Our advisers. If we need professional advice, for example from an accountant, a lawyer or an insurer, we share only what they need, and they're bound to keep it confidential.
• Not ours: your browser's maker, which may supply the translation model or translate pages for you (see Interface languages).

We don't sell personal information, and we don't share it for advertising.

International transfers

We're based in Ontario, Canada. Your information is stored and processed outside your province or country: our database is in the United States; Cloudflare, Stripe and Google are based in the United States; and Cloudflare's network serves you from wherever is nearest. Information held in another country can be accessed by that country's courts, law enforcement and national security authorities, under its laws.

We have assessed these transfers — how sensitive the information is, why it goes, the safeguards in place, and the law where it goes — and we do so before any new one.

For people in the EU, the EEA and the UK, each transfer is protected like this:

• To us in Canada: the EU's adequacy decision for Canada, which covers organisations subject to PIPEDA, as we are (confirmed by the European Commission in 2024), and the UK's adequacy regulations for Canada, which cover the same organisations.
• To Cloudflare, Stripe and Google in the United States: each is certified under the EU–US Data Privacy Framework and its UK Extension. Their data processing terms also include the European Commission's standard contractual clauses, with the UK addendum for UK information.
• Elsewhere on Cloudflare's network, and wherever Stripe or Google process information outside the United States: the European Commission's standard contractual clauses in their data processing terms, with the UK addendum for UK information.
• To komoot in Germany, and to the OpenStreetMap Foundation's servers in the Netherlands: inside the EU, so no further safeguard is needed for EU information; for UK information, the UK's adequacy regulations for the EEA.
• To the OpenStreetMap Foundation in the United Kingdom: the EU's adequacy decision for the UK.
• OpenFreeMap isn't a transfer by us: your browser fetches the map from it directly. It is based in Hungary, inside the EU, and serves its maps through Cloudflare's network.

For a copy of the safeguards that apply, email contact@astrolina.org.

How long we keep it

We keep personal information only as long as we need it for the purposes above.

• Your account — your details and choices (including proof of your first email consent, after you opt out), purchase records, class places you claimed (withdrawn ones included), the prepaid-time record, and the records of what you accepted and what we sent you: while your account exists, then deleted with it.
• Complimentary access — that it was given, where from and until when: until it ends or is withdrawn.
• What you sync — until you delete it or your account; deletion markers go after about 30 days. If Pro ends, Pro content is kept, not synced, until Pro comes back, you ask us to delete it, or you delete your account. A removed Custom theme leaves only the date it was removed, until you delete your account.
• Visit counts — until counting is switched off, which erases them, or you delete your account.
• Billing records — deleting your account removes your billing details from our database, and we ask Stripe to close your customer record. Records of completed transactions stay with Stripe, and in our accounting, as long as tax law requires: six years after the end of the tax year they relate to (Canada's Income Tax and Excise Tax Acts), or longer where EU or UK VAT rules require.
• Withdrawals and cancellations — with your account; if you delete it before one is resolved, we keep the request, and for a withdrawal the record of the purchase it's about, until it's resolved (refunded, closed without a refund, or the cancellation done or answered).
• Purchase confirmations and copies of the Terms — the record of what we sent and when: with your account.
• Discount codes — the link to your address lasts while the code can be spent and, once you've used it, until you delete your account; an unused code loses it within about 30 days of expiring or being withdrawn. A code with no end date keeps it until it's used or we withdraw it; we review those every six months. Deleting your account cancels an unused code and leaves a used one only as a transaction record, with nothing pointing back at you. Stripe's own logs of how earlier codes were created may show the address for as long as Stripe keeps them.
• Access set up before you sign up — until you sign up, or until the access ends or we withdraw it. The address is then deleted by our nightly clean-up within two days, or, if that would be sooner than 30 days after the access was first set up, once those 30 days have passed.
• Unverified sign-ups — if you ask for a sign-in code but never finish signing in, the address is deleted after 30 days, or sooner if you ask.
• Translation reports — 365 days, then deleted automatically. Reports sent under your account are deleted with your account. Ones sent anonymously aren't linked to any account, so deleting yours doesn't remove them — they simply age out. What you write is kept as you wrote it, so leave out anything you'd rather we didn't have.
• Sign-in codes — each works for 10 minutes (if you ask for another, the earlier one keeps working until the new one expires); a used code is deleted at once, an unused one within a day after it expires. Sessions — until 30 days pass without the app reaching us, or you sign out. Rate-limit counters — their windows run from seconds to a day, and each is deleted within a day after its window ends.
• Server logs — 7 days, at Cloudflare, and its record of the emails we send, up to 31 days. Security and traffic records — Cloudflare's records of requests its security features block or flag, and of the traffic it handles for us: we can see them for 31 days, and Cloudflare keeps them at least that long, under its own rules; its daily traffic totals, which name no one, about a year. Search caches — 7 days, or 14 for address search.
• Do-not-send list — if an email to you bounces or is reported as spam, Cloudflare's email service keeps your address on a list of addresses we can't write to, until we remove it; ask us and we will.
• Reports about content — until the matter, and any challenge to our decision, is closed.
• Your messages to us — up to three years after our last exchange; ask, and we'll delete them sooner unless we need them for a legal claim or duty. Daily totals, those by language (counted from November 20, 2026) included — indefinitely: no account, device or address is attached to them, so there's nothing in them to delete with your account.
• Backups. Our database keeps a rolling history of up to 30 days (Cloudflare D1 Time Travel), used only to recover from a mistake or a failure. Deleted information leaves it within 30 days, and we can't remove it any sooner.

Deleting your account removes your data from our live database at once, and from backups within 30 days — except the transaction records, any unresolved request and any anonymous translation report described above, and what a legal claim already made, or one we reasonably expect, needs, until it's settled. What's in your own browser stays until you clear it there, except that, on the device where you delete your account, the app also removes your rectification case files and that device's sync choice.

How we protect it

• In transit and at rest. Everything travels over HTTPS. Your account data lives in a Cloudflare D1 database, encrypted at rest and reachable only by our own server code — never directly from a browser. Sign-in codes and session tokens are stored only as keyed hashes. A code works for 10 minutes (if you ask for another, the earlier one keeps working until the new one expires) and is deleted once used, or within a day after it expires.
• Access. Our database can be reached only through our Cloudflare account, which is protected by two-factor authentication, and through our admin dashboard, which sits behind single sign-on and can't open your charts, journal, saved reports or theme. What the dashboard shows and can do is under Our admin dashboard.

Breaches

No system is perfect. If a breach of our safeguards affects your personal information, we will:

• contain it and find out what happened;
• tell you directly, as soon as we can, when it creates a real risk of significant harm (the Canadian test), a risk of serious injury (Quebec's) or a high risk to your rights (the EU and UK test): what happened, what was involved, what we've done, and what you can do;
• report it to the Office of the Privacy Commissioner of Canada, Quebec's Commission d'accès à l'information, the data protection authority of each EU or EEA country where affected people live (we have no lead authority in the EU), or the UK's ICO, when the law requires — within 72 hours where the GDPR or UK GDPR asks for that; and
• record it in our incident register, as we do every incident, however small.

Our admin dashboard

This is what the admin dashboard described under How we protect it shows us and lets us do.

• What it shows: your account (email, display name, and when you signed in and synced), your plan, purchases and billing status, with links into Stripe, your email choices, your visit counts, how many items you've saved and whether a home location is set (never where), the notices you were sent and what you accepted, any withdrawal, cancellation, discount code, complimentary access or class place, and your answer to "How did you hear about us?". It also shows the daily totals, with the language totals only as sums over whole past days and small counts shown as "fewer than 5", and translation reports, read-only, with the sender's name and email address unless the report was sent anonymously.
• What it lets us do: manage plans, complimentary access (including for an address with no account yet), discount codes and class links; handle refunds, disputes, withdrawals and cancellations; re-send confirmations; switch off visit counts when you ask; register new versions of the Terms and this policy; and send notices and product updates.
• What it can't do: open your charts, journal, saved reports or theme.

Scheduled jobs clear expired data, keep plans in step with Stripe, and send or re-send the emails described under Emails we send. Actions taken in the dashboard are logged.

Your rights

Depending on where you live — under Canada's PIPEDA, Quebec's Law 25, the EU or UK GDPR, or similar laws — you have these rights over the personal information we hold about you. Using them is free.

• Access — a copy of your information, and how we use it.
• Correction — of anything wrong or incomplete.
• Deletion — of what we hold about you, except what the law makes us keep or what we need to bring or defend a legal claim.
• Restriction — we stop using information while a question about it is settled.
• Portability — your information in a format you can reuse (below).
• Withdrawing consent — for product emails or your "how you found us" answer, at any time, without affecting what was done before.
• Objection — see below.

Much of this you can do yourself in the app: delete what you've saved, or your whole account; switch sync off; untick visit counting where the box is shown (anyone can ask us by email); change your email choices. For anything else, email contact@astrolina.org — from your account's address, or we'll ask you to confirm from it, so we know it's you. A translation report you sent anonymously isn't linked to your account, so we can't find it unless you tell us what you wrote, roughly when, and in which language.

When we answer: within one month under the GDPR and UK GDPR (up to two more months for a complex request, and we'd tell you why within the first); within 30 days under PIPEDA (extendable by up to 30 more days, with notice to you); and within 30 days under Quebec's law. A full copy is put together by hand, but it's a normal request, and we'll meet those times.

Portability

We'll send your charts, journal entries, saved reports and Custom theme as JSON, and your account and billing summary as CSV — structured, common formats that other software can read. If you ask, and where it's technically feasible, we'll send them straight to another organisation you name.

Your right to object

You can object to any use we base on legitimate interests (listed under Why we use it). Tell us at contact@astrolina.org and we'll stop, unless we have compelling legitimate grounds that override your interests and rights, or need the information for a legal claim. Two objections you can make yourself, at any time: untick "Count my visits to the app" on your account screen where it's shown (anyone can ask us by email), and opt out of product updates (or unsubscribe from the offers in class emails). An objection to marketing is always honoured.

Automated decisions

We make no decisions about you based solely on automated processing that have legal or similarly significant effects. Our rate limits, the human check and Cloudflare's bot checks can block a request automatically; if that happens to you, email us and a person will look at it. Under Quebec law, you can also ask us which information the check used (such as your IP address, the address you signed in with, or how often requests came) and the main reasons, have that information corrected, and send your comments to a person who can review the decision. Birth-time rectification is a tool you run on your own device, and it decides nothing about you.

Complaints

If you're unhappy with how we handle your information, email contact@astrolina.org with "Privacy complaint" in the subject, or write to us at the address above. We'll acknowledge it within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to a regulator:

• Canada: the Office of the Privacy Commissioner of Canada
• Quebec: the Commission d'accès à l'information
• EU and EEA: the data protection authority where you live or work, or where you think the problem arose (list of authorities)
• UK: the Information Commissioner's Office

If we refuse a request to see or correct your information, or don't answer within 30 days, you have 30 days to ask Quebec's Commission d'accès à l'information to examine it. Any refusal from us gives our reasons and these time limits.

Information about other people

Charts often describe someone else — a client, a partner, a parent, a child. Relationship charts hold two people's birth details, and notes, journal entries and reports can mention others.

• If you read for clients professionally, you decide what to collect about them and why. We hold it and sync it back to you on your instructions, as your service provider (under EU and UK law, your processor), under the processing terms in our Terms. You're responsible for having the right to enter it and for telling your clients. We don't contact them or use their information for anything of our own (apart from the counts described under How often you use the app).
• If you use AstroLina for yourself, your family or friends, the GDPR's exemption for personal and household activity (its Recital 18) covers you, but not us: we remain responsible, as the controller, for how we store and protect what you sync.

We don't tell each person whose details are entered into someone's account: we don't know who they are — a chart holds a label and birth details, not contact details — and finding out would mean collecting more about them. We rely instead on Article 14(5)(b) of the GDPR, which allows this where telling them would take disproportionate effort, and publish this policy. Under Canadian law, we rely on you, as the Terms ask, to have the permission of the people whose details you enter; we use their details only to store and sync them for you, and for the counts described under How often you use the app. Life events entered as rectification clues never reach us at all.

If you think your information is in someone's account, write to us. Where we act for a professional, we'll pass your request on to them and act on their lawful instructions; otherwise, we'll deal with it ourselves.

Children

AstroLina isn't directed to children, and you must be 16 or older to create an account. We don't knowingly collect information from anyone under 16. If you believe a child has given us information, email us and we'll delete it.

This website

astrolina.org runs no analytics script and loads nothing from other sites — its fonts, images and video are our own. It sets no cookies of its own; the only ones it can get are Cloudflare's security cookies, if Cloudflare asks your browser to pass a challenge (see Cookies and device storage).

• Hosting. Cloudflare hosts it, so Cloudflare receives your IP address, the pages you request and what your browser sends with them, as any host does, and counts the traffic for us (see How often you use the app).
• Failed loads. Cloudflare may ask your browser to report pages that fail to load (Network Error Logging) to Cloudflare. Visits that work aren't reported.
• Your language. The offer of a translated page, and the language switcher, remember your answer in your browser's local storage under al.lang.offer: that you turned the offer down, or the language you chose. To make the offer, the site reads your browser's language preferences and whether you came from another page of this site — in your browser; it stores neither.

How we govern personal information

This is how we look after personal information inside AstroLina, published as Quebec's Law 25 asks.

• Roles. Salvatore Grosso is our Privacy Officer, by written delegation from the owner, Lina Grosso. He is responsible for this policy and our practices: he approves them, answers requests and complaints, handles incidents and keeps our records. Personal information is reached only for the purposes in this policy, in the ways described under How we protect it and Our admin dashboard.
• Keeping and destroying information. As set out under How long we keep it, with clean-ups every night.
• Privacy impact assessments. Before we build a feature or system that handles personal information, or send it to a new provider or country, we assess the risks and how to reduce them.
• Incidents. We record every confidentiality incident, however small, in an incident register kept for at least five years, and follow the steps under Breaches.
• Complaints are handled as described under Complaints.
• Reviews. We review this policy whenever how we handle personal information changes.

Approved by Salvatore Grosso, Privacy Officer, on October 16, 2026.

Changes to this policy

A material change is one that (a) adds to what you must do or pay, or reduces what we must do; (b) removes or reduces a feature you have paid for; (c) uses personal information for a new purpose, collects a new kind of it, shares it with a new kind of recipient or in a new country, or keeps it longer; or (d) makes it harder to use your rights, cancel or leave. Clearer wording, corrections, new contact details, a renamed feature, a new optional feature that collects nothing new, and anything that only adds to your rights are not material changes.

• Material changes are announced in the app, with a dated summary under What changed, and by email to the account holders they affect. A change that would use information we already hold for a new purpose, collect a new kind of it from everyone, or share it with a new kind of recipient other than a provider acting for us takes effect no sooner than 30 days after we announce it, and only once you've agreed, where the law needs your consent. A new feature or setting that you choose to use, and that collects something new only from the people who use it, takes effect for them when we publish its description here, and only once they've agreed, where the law needs consent.
• A change that describes what we already do, gives you more control, meets a legal duty, or records something only when you do it (such as accepting the Terms or asking to withdraw) takes effect when we publish it, and is still announced if it's material.
• Other changes are published here with a dated summary, and shown in the app (with Got it) the next time you open it.
• We never treat your continuing to use AstroLina as consent to a change in this policy.
• How we protect it and International transfers are also part of the processing terms in our Terms, so changes to them follow the Terms' changes section and take effect as it says.
• Earlier versions stay available under Previous versions. Changes to the Terms follow their own section, which uses the same definition.

Contact

Questions or requests? Email contact@astrolina.org.

• Who we are: Lina Grosso, operating as AstroLina
• Mailing address: AstroLina, 1 Lomond Dr, Toronto, ON M8X 2Z3, Canada
• Phone: +1 416-231-6020

Privacy Officer (person in charge of the protection of personal information): Salvatore Grosso — contact@astrolina.org.

Previous versions

• Privacy Policy, version dated October 15, 2026 — applied until October 16, 2026.
• Privacy Policy, version dated September 30, 2026 — applied until October 15, 2026.

Earlier versions are available on request.