Privacy Policy

Last updated: August 4, 2026

This Privacy Policy explains how MysticOS ("we", "us", or "our") collects, uses, and protects your information when you use our website and services at mysticos.ai (the "Service"). We are committed to being transparent about what data we collect and why.

1. Information We Collect

1.1 Birth Data

To generate astrological and divination charts, we collect:

  • Birth date (day, month, year)
  • Birth time (hour and minute)
  • Birth location (city and country)
  • Gender (required for certain systems like Bazi and Ziwei)

Birth data, particularly in combination with location, can indirectly identify a specific individual. Under GDPR, this is considered personal data.

1.2 Optional Input

Depending on the tools you use, we may also collect:

  • Questions you ask for tarot readings
  • Dream descriptions you submit for interpretation
  • Your name (optional, used only for numerology calculations)

1.3 Account Data

If you create an account, we collect your email address and a hashed password. We do not collect real names, phone numbers, or payment information at this time.

1.4 Technical Data

We automatically collect standard technical data: IP address, browser type, device information, and usage analytics. This is used for security, debugging, and understanding how the Service is used.

2. How Your Data Is Stored

2.1 Before You Log In

When you use our tools without an account, your birth data and reading results are stored locally in your browser's localStorage. This data never leaves your device unless you choose to create an account and persist it.

2.2 After You Log In

If you create an account, your profiles and saved readings are stored in our database hosted on Supabase (a PostgreSQL-based service). Data is encrypted in transit (TLS/HTTPS) and at rest.

3. How Your Data Is Processed

3.1 Chart Calculation

Your birth data is sent to our calculation engine (MiroFate) to compute planetary positions and generate charts. This processing is deterministic and mathematical — no AI is involved in the calculation itself.

3.2 AI Interpretation

To generate natural-language interpretations of your charts, we send your calculated chart data (not raw birth data) to a third-party AI provider (DeepSeek). Please note: DeepSeek is hosted in China. By using the AI interpretation feature, your chart data is transferred outside your country of residence, including potentially to China. This cross-border transfer is necessary to provide AI-powered readings.

3.3 Legal Bases for Processing (GDPR)

  • Consent: You voluntarily provide birth data to receive readings
  • Contract: Processing is necessary to deliver the service you requested
  • Legitimate interest: Technical data for security and service improvement

4. Your Rights

Depending on your jurisdiction (GDPR/CCPA/other), you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Request deletion of your data (the "right to be forgotten")
  • Data portability: Receive your data in a machine-readable format
  • Object: Opt out of certain processing
  • Withdraw consent: At any time, without affecting prior processing

To exercise these rights, email us at privacy@mysticos.ai. You also have the right to lodge a complaint with your local data protection authority.

5. Data Retention

  • Anonymous (pre-login) data: Stored in your browser until you clear localStorage
  • Account data: Retained as long as your account is active; deleted within 30 days of account deletion request
  • Technical logs: Retained up to 90 days for security and debugging

6. Cookies

We use minimal cookies: an authentication session cookie (essential) and optional analytics cookies. We do not use advertising or tracking cookies. You can control cookies through your browser settings.

7. Data Sharing

We do not sell, rent, or trade your personal data. We share data only with:

  • Supabase: Database hosting (account data)
  • DeepSeek: AI interpretation processing (chart data)
  • Service providers: Under strict data processing agreements

8. Children's Privacy

The Service is not directed to children under 13 (COPPA) or 16 (GDPR). We do not knowingly collect data from minors. If you believe a minor has provided data, contact us for immediate deletion.

9. International Transfers

Your data may be processed in the United States (hosting), and chart data may be transferred to China (AI processing via DeepSeek). By using the Service, you consent to these transfers.

10. Security

We use TLS/HTTPS encryption for data in transit, encryption at rest for stored data, and hashed passwords. No method is 100% secure, but we follow industry best practices.

11. Changes to This Policy

We may update this Policy. Material changes will be announced on the website. Continued use after changes constitutes acceptance.

12. Contact

Questions about this Privacy Policy? Email privacy@mysticos.ai.