Privacy Policy

Soulra is a personalized service. To create your charts, readings, and AI experiences, and to run our business, we collect a meaningful amount of data, including sensitive inputs such as your date, time, and place of birth, your gender, your mood logs, and the messages you send to our AI companion. We use trusted third parties including Apple, Google/Firebase, Anthropic, RevenueCat,Whop, and Brevo to provide the Service. We may add OpenAI as a future AI provider only after the disclosure and explicit permission described below. We do not sell your personal data for money. Please read the full Policy below.

We collect the following categories of data.

2.1 Account and identity data

• Authentication identifiers from your sign-in method (Sign in with Apple or Google Sign-In), including a user ID.
• Your email address and, where provided by the sign-in provider, your name (Apple may provide a private relay email if you choose to hide your address).
• A device identifier we generate to associate your data and entitlements with your account.

2.2 Profile and birth data (used for astrology features)

• Your name or chosen display name.
• Your date of birth, and optionally your time of birth and place of birth (including coordinates and time zone derived from the place).
• Your gender, relationship status, and your selected main area of interest or concern.
• Your derived astrology data, including zodiac sign, life path number, ascendant, and full natal (birth) chart.
• Profile preferences such as avatar, cosmetics, and app settings.

2.3 Data about other people you add

• If you use compatibility or partner features, the name, birth date, and optionally birth time, place, and gender of the people you add as “partners”. You are responsible for having the right to enter this information.

2.4 Content you create and interact with

• AI companion chat messages and conversations with “Ra”.
• Reading inputs and results, including tarot draws, numerology, horoscopes, compatibility readings, and the generated interpretations.
• Mood logs, including the mood you select and any notes you write, plus contextual data such as the date and related astrological context.
• Bookmarks, history, and similar activity within the Service.

2.5 Purchase and subscription data

• Subscription status and entitlements, product identifiers, transaction and renewal events, and related metadata, processed through Apple and RevenueCat for App Store purchases and through Whop for purchases made on our website. For website purchases, this may include the purchaser's email address, Whop account or membership identifiers, billing country, payment status, plan, renewal, cancellation, refund, dispute, and transaction details. If a partner referral applies, we also process the partner attribution, introductory-discount status, and the commission tier needed to administer that referral. We do not collect or store your full payment card or banking details; Apple or Whop handles that payment information, depending on where you purchase.

2.6 Device, technical, and usage data

• Device type, operating system version, app version, language, region, and similar technical attributes.
• A push notification token (if you enable notifications) used to deliver horoscope and reminder notifications.
• Usage and analytics data, such as screens viewed, features used, sessions, interactions, and diagnostic or crash information.
• IP address and similar connection metadata processed by our infrastructure and security providers.
• The Apple vendor identifier (IDFV) for this device, together with app installs, opens, and the marketing links you follow into the app. We use this to measure which campaign or referral an install came from. The IDFV is issued by Apple, is specific to apps from the same developer, and resets only when you delete every app from this developer from the device.
• We do not collect the Apple advertising identifier (IDFA) and we do not present the App Tracking Transparency prompt. We do not track you across apps or websites owned by other companies for advertising purposes.

2.7 Website data

• If you visit our website, request a free natal chart, create an account, join a waitlist, or purchase a subscription, we may collect the email address, birth details, preferences, and information you submit, checkout and subscription events, plus standard web log and cookie data described in Section 9. We store whether, when, where, and under which notice you enrolled in our email program. When the free natal-chart form clearly states that it includes one useful Soulra email per week, submitting that form enrolls the email address in that program. Every campaign email includes an unsubscribe method.

We do not intentionally collect special-category data beyond what you choose to provide (for example, birth details and mood notes). Please do not enter information you do not want us to process.

We use personal data for the following purposes.

• Provide and personalize the Service: create your account, calculate your natal chart, generate horoscopes, readings, compatibility, mood insights, and AI chat responses, deliver purchases and entitlements, and remember your preferences.
• AI processing: process your inputs (chat messages, questions, birth data, reading inputs) to generate AI Content, including through the specific third-party AI providers named in Section 5.
• Operate, maintain, and improve the Service and our business: debug, analyze usage, develop and test features, improve content quality and AI/personalization, and conduct research and product analytics.
• Analytics and measurement: understand how the Service is used and measure the performance of features and marketing.
• Communications: send service-related messages, push notifications you enable (such as daily horoscopes), respond to support requests, and, where permitted, send marketing or promotional messages (which you can opt out of).
• Security, fraud prevention, and integrity: authenticate users, enforce limits, detect and prevent abuse, fraud, and reward/referral manipulation, and protect the Service, our users, and our rights.
• Legal and compliance: comply with legal obligations, respond to lawful requests, enforce our Terms, and establish, exercise, or defend legal claims.

Where required by law, we rely on the following legal bases (GDPR): performance of a contract (to provide the Service you request), your consent (for example, for certain analytics, marketing, push notifications, or processing of sensitive inputs, which you may withdraw at any time), our legitimate interests (to secure, operate, analyze, and improve the Service and our business, balanced against your rights), and compliance with legal obligations.

Several features rely on artificial intelligence and automated generation. To provide them, relevant data is sent from your device to our secure backend (Google Cloud Functions) and then to a named AI service provider that generates the requested Content. Soulra currently uses Anthropic PBC's Claude API. OpenAI is not currently used for AI processing in Soulra. We may add an OpenAI API service in the future only after updating this Policy and presenting a new in-app disclosure and explicit permission request before any transfer to OpenAI.

• Features: this applies to the AI companion chat ("Ra"), readings, horoscopes, mood insights, and similar AI-generated features.
• Data sent: depending on the feature you use and the information available in your profile, the AI request may include your current question or message; recent conversation messages; an existing AI-generated memory summary and key facts; your name or display name; birth date, birth time, birth place, coordinates, time zone, full natal chart, and derived astrology or numerology data; gender, relationship status, and selected concern; mood entries and notes; tarot cards, reading selections, and other reading inputs; a partner's name, birth date, birth time, birth place, coordinates, time zone, natal chart, and synastry data; app language and local-time context; session metadata such as the date, request source, and message count; and feature, subscription, or quota status needed to generate the response and operate the feature.
• Data not intentionally sent: we do not intentionally include your email address, Apple or Google authentication credentials or identifiers, push token, or full payment-card or banking information in AI prompts.
• Purpose and user action: tapping Send, Generate, or a similar AI action initiates the transfer needed to generate and deliver the requested result. Following an AI chat interaction, Anthropic may also process recent chat content and existing memory context to synthesize or update a personalized memory summary and key facts that Soulra may use to tailor future responses. This follow-up processing may finish in the background after the interaction. If you do not want these transfers, do not use an AI feature. You may stop future AI processing by no longer using AI features and by contacting privacy@soulra.app; this does not affect processing already completed.
• Routing and identity: AI requests are routed through our server-side proxy. We take steps intended to limit exposure of your direct account identity to AI providers, but the content and profile context included in the request are processed by them.
• Provider protections: we use Anthropic as a service provider/processor under applicable commercial and data-protection terms and require the transferred data to receive the same or an equivalent level of protection described in this Policy. Anthropic states that it does not use Anthropic API inputs or outputs to train its models by default unless the customer opts in. Soulra does not opt in to such training and does not permit use of the transferred data for the provider's own advertising or user profiling.
• Provider retention: under Anthropic's standard API retention terms, Anthropic automatically deletes API inputs and outputs from its backend within 30 days, unless different terms apply, longer retention is needed to enforce its Usage Policy, or retention is required by law. Soulra's own retention is described in Section 8.
• AI Content is generated automatically and may be inaccurate. See the Terms of Use for important disclaimers.

We share personal data with the following categories of service providers and partners, only as needed to operate the Service:

• Apple - sign-in (Sign in with Apple), App Store distribution, and all in-app purchases and subscription billing. Payment information is handled entirely by Apple.
• Google / Firebase (Google Cloud) - authentication, cloud database (Firestore), serverless backend (Cloud Functions), app integrity (App Check), push messaging (FCM), and analytics. Firebase processes data on Google infrastructure.
• Anthropic PBC (Claude API) - our current AI provider. Anthropic processes the request data described in Section 4 to generate chat responses, readings, horoscopes, mood insights, and other AI Content.
• OpenAI (OpenAI API; future provider) - is not currently receiving personal data from Soulra. Before enabling an OpenAI-powered route, we will update this Policy and the in-app disclosure to identify the applicable OpenAI entity, the exact data categories, purposes, protections, and retention, and request separate explicit permission before the transfer.
• RevenueCat - subscription and purchase management, validation, and entitlement state.
• Whop - hosted checkout, website payment processing, recurring billing, fraud prevention, refunds, disputes, and subscription management. Whop receives the information required to complete and administer a website purchase. Soulra sends a server-generated account reference and selected plan so the resulting entitlement can be applied to the correct Soulra account. When a partner referral applies, Soulra also sends the Whop affiliate linkage, plan, and discount markers needed to apply the introductory discount and recurring commission. Soulra does not receive the full payment-card number. If you consent to website analytics, the Whop Pixel also receives a safe page category, a pseudonymous first-party visitor identifier, and a small set of named funnel events (for example, lead, registration, content view, and add-to-cart) to measure advertising attribution. Soulra does not add your form answers, birth data, chat text, email address, name, or account identifier to those Pixel events.
• TikTok - consent-gated website advertising measurement. The TikTok Pixel receives page-view and named funnel events such as offer views, registration, checkout initiation, confirmed payment, and activated subscription, together with stable product identifiers, product type, value, currency, and a unique event identifier. When TikTok's enhanced website measurement is enabled, it may also receive the current page URL and metadata, product details, button-like element text and attributes, page performance, scrolling, visibility, and on-page engagement. Soulra does not add birth data, onboarding answers, chat or reading text, payment-card details, email address, name, or Soulra account identifiers to the named funnel event parameters.
• Brevo (Brevo SAS) - transactional delivery of a natal chart or other message you request. When you submit a form that clearly includes our weekly email program, we also synchronize your email address, name (if provided), language, and source to a Brevo audience so we can send that content and relevant Soulra offers. Firestore remains our source of record for the disclosure and submit event. Every campaign message provides an unsubscribe method.
• Airbridge (AB180 Inc.) - mobile attribution, referral, and deep-link measurement. Airbridge receives the Apple vendor identifier (IDFV) described in Section 2.6, app install, open, and session events, and the marketing links you follow into the app. Once you are signed in, it also receives your Soulra account identifier, so an install can be matched to the account that later subscribes; a sign-up event when you finish setting up your profile; and completed in-app purchase events containing the product identifier, the amount charged, and the currency. As with any network request, each event also carries the device and connection data described in Section 2.6, such as device model, operating system version, language, and IP address. Soulra does not add your birth data, onboarding answers, chat or reading text, email address, name, or payment-card details to these events. Airbridge does not receive the Apple advertising identifier (IDFA), because Soulra does not collect it.
• Analytics and diagnostics providers - measurement, performance, and crash diagnostics (for example, Firebase Analytics and crash reporting).

We may also disclose data: (a) to comply with law, legal process, or lawful governmental requests; (b) to enforce our Terms or protect the rights, safety, and security of Soulra, our users, or others; (c) to detect and prevent fraud or abuse; and (d) in connection with a merger, acquisition, financing, or sale of assets, in which case data may be transferred to the successor entity (we will notify you where required).

We will not send personal data to an unlisted AI provider without first updating this Policy and the in-app disclosure and obtaining separate explicit permission before the transfer.

We do not sell your personal data for money. Some analytics and advertising-related data sharing may be considered a “sale” or “sharing” for cross-context behavioral advertising under certain US state laws; see Section 11 for your opt-out rights.

The Service is operated using cloud infrastructure (including Google/Firebase, Anthropic, Whop, and Brevo) that may store and process data in the United States, European Union, and other countries. Future providers identified under Section 5 may also process data internationally if enabled after disclosure and separate explicit permission. If you are located in the European Economic Area, the United Kingdom, or another region with data-transfer restrictions, your data may be transferred to countries that may not provide the same level of protection as your home country.

Where we transfer personal data internationally, we rely on appropriate safeguards where required, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms. You may contact us for more information about these safeguards.

We use technical and organizational measures designed to protect your data, including encryption in transit (TLS) and at rest where provided by our infrastructure, access controls, owner-only database security rules, app integrity checks (App Check), and authentication. No method of transmission or storage is fully secure, and we cannot guarantee absolute security. You are responsible for keeping your device and account credentials secure.

• Account and profile data (including birth data and natal chart) is retained while your account exists and until you delete it or request deletion.
• Readings, chat history, and mood logs are retained while your account exists, unless you delete them earlier where the App allows.
• AI-derived personalized memory (including summaries and key facts) and the source chat data Soulra stores for that memory are retained while your account exists, unless you delete them earlier where the App allows or request deletion.
• Purchase and subscription records are retained as needed for the Service and to meet legal, tax, and accounting obligations.
• Referral and affiliate records (including lifetime attribution, discount-consumption markers, payment audit identifiers, tier history, and provider reconciliation state) are retained as needed to calculate or verify commissions, prevent duplicate rewards, resolve disputes, and meet legal, tax, and accounting obligations.
• Analytics data is retained in aggregated or de-identified form and according to the retention settings of our analytics providers (for example, Firebase Analytics default retention).
• Anthropic API inputs and outputs are deleted by Anthropic from its backend within 30 days under its standard API retention terms, subject to the exceptions described in Section 4.
• Anonymous website natal leads (including email, birth details, calculated chart, language, and the form-disclosure record) are retained while we provide the requested chart and weekly email service and for a reasonable period afterward to maintain service records, document compliance, prevent abuse, or meet legal obligations. Unsubscribing stops weekly marketing but does not by itself delete the underlying natal record; you may request deletion at any time. We may delete or de-identify inactive lead records earlier.
• Brevo campaign contacts are retained while subscribed. After an unsubscribe, Brevo retains the minimum suppression data needed to ensure marketing messages remain stopped, unless a longer period is required by law.
• After account deletion, we delete or de-identify personal data within a reasonable period, except where we must retain certain data to comply with legal obligations, resolve disputes, prevent fraud, or enforce our agreements.

Our app does not use advertising cookies. Our website may use cookies and similar technologies for essential functionality, preferences, analytics, and advertising attribution. Where required by law, we ask for your consent before setting non-essential cookies and provide a way to manage your choices. You can also control cookies through your browser settings.

If you are in the EEA, the UK, or a similar jurisdiction, you have the right, subject to legal limits, to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing, including processing based on legitimate interests and direct marketing.
• Data portability - receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent (this does not affect prior processing).
• Lodge a complaint with your local data protection authority.

You can exercise many of these rights directly in the App (for example, editing your profile or using Delete Account) or by contacting us at privacy@soulra.app. We will respond within the time required by law.

If you are a California resident (CCPA/CPRA) or resident of another US state with privacy legislation, you have the right, subject to legal limits, to:

• Know and access the categories and specific pieces of personal information we collect, use, and disclose.
• Delete personal information we have collected from you.
• Correct inaccurate personal information.
• Opt out of any “sale” or “sharing” of personal information for cross-context behavioral advertising. We do not sell personal data for money; to the extent any analytics-related sharing qualifies as a “sale” or “sharing,” you may opt out by contacting us at privacy@soulra.app or by using the privacy controls described in the App or on our website.
• Limit the use of sensitive personal information to what is necessary to provide the Service.
• Non-discrimination for exercising your rights.

You may exercise these rights by contacting us at privacy@soulra.app. We will verify your request as required by law. You may use an authorized agent where permitted.

The Service is not directed to children under the minimum age stated in our Terms of Use (16+), and we do not knowingly collect personal data from children below that age. If you believe a child has provided us personal data, contact us at privacy@soulra.app and we will delete it.

With your permission, we may send you push notifications (such as daily horoscopes and reminders). If a website form clearly states that submission includes our weekly email program, submitting it enrolls that email address. You can disable push notifications in your device settings or in the App, and you can opt out of campaign emails at any time using the unsubscribe link or by contacting us. Service-related and transactional messages may still be sent.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date and post the revised Policy. For material changes, we will provide notice where required by law. Your continued use of the Service after the changes take effect constitutes acceptance of the revised Policy.

For questions, requests, or to exercise your rights:

privacy@soulra.app

The Service is operated by an individual operator (sole proprietor).

For EU/UK users: We have not appointed an EU/UK representative at this time. If one becomes required as the Service grows, we will designate a representative and update this Policy.