Privacy Policy

Last Updated: 27/08/2026

Caxapok, LLC (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and disclose information about users (“you” or “your”) of the Astra educational platform (“Astra” or the “Platform”), including astratrainer.com, astratarot.net, and our iOS and Android apps.

1. Information We Collect

1.1 Account and profile information

When you create an account or fill in your profile, we collect what you give us:

• name, display name and email address;
• password (stored only as a cryptographic hash) or, if you sign in with Apple or Google, the identifier that provider gives us;
• profile picture, short bio, and a free-text location if you fill one in;
• date of birth, and whether you allow the day and month of it to be shown to people who follow you;
• the name you want printed on course certificates;
• your chosen learning goal, language and privacy settings.

1.2 Astrology and self-assessment inputs

Some features are calculated from information only you can supply. If you use them, we store what you enter:

• Natal chart: your date of birth, time of birth, place of birth and its coordinates and timezone, together with the chart calculated from them. You provide this yourself; it is not read from your device.
• Current location: a city, country, timezone and its coordinates, used by features that depend on where you are. This comes from the place you select, not from continuous device tracking.
• Self-assessment answers: the questions you answer in balance and reflection exercises, and the results produced from them.
• Order intake: where you buy a personalized reading through Astra Market, the details you supply for it — which may include birth data — are shared with the provider you bought it from so they can perform it.

1.3 Content you create

We store the content you submit and the metadata around it: feed posts, stories, comments, readings, replies to reading tickets, direct messages, circle messages, ratings and reviews, reports you file, and the images you attach to any of these. Direct and circle messages are private between their participants but are not end-to-end encrypted; we can access them, and do so where a message is reported or where the law requires it.

Photographs. Photographs you upload as an avatar, in a post, or with an order are stored as you sent them. If you use a feature that generates images from reference photos, those reference photos are sent to the image model that produces the result. Only upload photographs of yourself, or of people who have agreed to it.

Voice. Where the app offers voice dictation, recording requires your permission and speech recognition runs on your device. The audio is not uploaded to us; only the text you end up with is saved, and only if you submit it.

Assistant conversations. Messages you exchange with the in-lesson assistant are stored together with the model used and processing metadata, and are sent to the AI provider that generates the reply — see §3.

1.4 Purchases

We store a record of what you bought, when, in what currency, and the identifiers our payment processor or the app store gives us for the transaction, together with your subscription status and your balance of Coins and other virtual items. We never receive or store full payment card details.

1.5 Device and usage data

Usage Data may include your IP address, browser type, device model, operating system, app version, language and timezone, approximate location derived from your IP address, pages and screens visited, actions taken within the Service, and interaction timestamps. If you allow notifications, we store the push token for each device so we can send them.

We also keep a detailed record of your activity in the Service — lessons opened and completed, streaks, achievements, quests, purchases, chests opened, cards collected, and similar — because that record is the product: it is what your progress, your streak and your collection are made of.

We do not gather continuous or precise location from your mobile device.

1.6 Session recordings on our websites

On our marketing pages we record browsing sessions so we can see where the pages confuse people. A recording captures the page as it was drawn and what you did with it — scrolling, clicks, taps, and the sequence of pages you visited — along with your IP address, approximate location, device type, screen size, referrer, and any campaign parameters in the link you arrived through.

What is never recorded: anything you type. Every character entered into a form field is masked in your browser before the recording leaves the page, so form contents never reach us.

Recordings are summarised automatically, including by AI-based tools, to identify common patterns. They are deleted on the retention schedule in §6. In the European Economic Area, the United Kingdom and Switzerland this recording only runs if you accept it in our cookie banner.

2. How We Use Your Information

We use the collected information for various purposes, including:

• To provide and maintain the Platform, including your progress, streaks, collection and community feed
• To process and manage user accounts, purchases, subscriptions and virtual item balances
• To operate community features — showing your posts to other users, delivering messages, and running circles, following and blocking
• To moderate content and enforce our Terms, including automated and AI-assisted review
• To communicate with you, including sending you updates, security alerts, support and marketing messages, and push notifications where you have allowed them
• To analyze and improve the performance and functionality of the Platform
• To measure and improve our advertising, and to promote Astra using content you have made public, as described in Section 6 of the Terms
• To detect and prevent fraud, abuse and security incidents
• To comply with legal obligations

2.1 Legal Bases for Processing (GDPR & UK GDPR)

If you are located in the European Union or the United Kingdom, we process your personal data under the following legal bases:

• Consent: analytics and advertising technologies, session recording, marketing messages and push notifications, and the optional features that use birth data or reference photographs.
• Contractual Necessity: creating and running your account, delivering the content and community features you signed up for, and processing your purchases.
• Legitimate Interests: keeping the Service secure, preventing fraud and abuse, moderating content, promoting the Service with content you published publicly, and improving the product — where those interests are not overridden by your rights and freedoms.
• Legal Obligations: tax and accounting records, and responding to lawful requests.

3. Third-Party Services

We use third-party providers to run, measure and support the Platform. This list reflects the services in use at the date at the top of this page; it changes as the product does, and we update it when it does.

3.1 Hosting, infrastructure and communication

• Vercel — hosting, file storage and caching for our websites and API.
• Sentry — crash and error reporting from the website and the apps.
• Resend — transactional email.
• Expo — building and delivering our mobile apps.
• Google Workspace and Telegram — handling messages you send to support. A support email is read into our helpdesk, automatically categorised, translated and summarised, and routed to a member of our team who writes the reply.

3.2 Payments and app stores

• Stripe — payments made on our website. Privacy Policy
• Apple — sign in with Apple, and purchases and subscriptions made inside the iOS app.
• Google — sign in with Google, Google Play Services, and purchases and subscriptions made inside the Android app.

3.3 Analytics and advertising

These services collect information through cookies, device identifiers and similar technologies. In the European Economic Area, the United Kingdom and Switzerland they run only with your consent — see §3.5.

• Google Analytics and Google Ads — measuring website traffic and advertising performance. Privacy Policy
• Meta — the Meta Pixel on our websites, the Meta SDK in our apps, and server-side conversion reporting, used to measure and target our advertising. On iOS the app asks for your permission before it uses your device’s advertising identifier for this. Privacy Policy
• Yandex.Metrica — website behaviour analytics. Privacy Policy
• PostHog — product analytics in the website and the apps. Privacy Policy
• Awin — affiliate tracking, so a partner who referred you is credited.
• ClickHouse — the analytics database our own usage statistics are stored in.

3.4 Artificial intelligence providers

Parts of the Service are produced or assisted by AI models operated by third parties. Where that happens, the text or image involved is sent to the provider to generate a result:

• OpenAI and Google (Gemini) — in-lesson assistant conversations, content generation, image generation from reference photographs, automated content moderation, and the translation and summarisation of support requests.

We do not sell your content, and we do not permit these providers to use it to train their models.

3.5 Cookies and consent

In the European Economic Area, the United Kingdom and Switzerland, non-essential cookies and tracking technologies — everything in §3.3, and the session recording in §1.6 — do not run until you accept them in the banner shown on your first visit. If you decline, they are not loaded at all. You can change your answer at any time using the Cookies link in the site footer, or by clearing cookies in your browser.

Regardless of your answer, three small cookies are always used, because the site cannot work without them:

• the country the request came from, so we can show prices in the right currency;
• the language you selected, so we can show the site in it on your next visit;
• your answer to the cookie banner itself, so we do not ask again.

Outside those regions, the technologies in §3.3 run by default and you can opt out through your browser settings, your device’s advertising settings, or the opt-out tools each provider offers.

4. Data Sharing and Disclosure

4.1 With other users

Astra is a community product, so some of your information is visible to other people by design: your display name, profile picture, bio, verification and author marks, follower counts, and anything you publish to the feed, to stories, to a circle or as a comment or reading. Your streaks, achievements and collection may be visible to people you are connected with. You can make your profile private and opt out of discovery in your settings, and you can block any user.

4.2 Service providers

We share personal data with the providers listed in §3, who process it on our behalf and under our instructions.

4.3 Advertising and analytics partners

We may share limited personal data with analytics and advertising partners to measure performance and deliver relevant ads, where permitted by law and, in the regions named in §3.5, where you have consented.

4.4 Promotion of the Service

Content you have posted publicly, together with your display name and profile picture, may be reproduced in our marketing materials and on our own accounts on third-party platforms, as described in Section 6 of the Terms. Private content is never used this way, and you can ask us to exclude your account from promotional use.

4.5 Legal and corporate

We may disclose information where we are required to by law, to respond to a lawful request, to enforce our Terms, or to protect the rights, safety and property of our users or of Caxapok, LLC. If our business is acquired or merged, information may be transferred as part of that transaction; we will notify you if it happens.

We do not sell your personal data.

5. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area and the United Kingdom, including the United States. Where such transfers occur, we rely on appropriate safeguards, such as Standard Contractual Clauses approved by the European Commission, to ensure an adequate level of data protection.

6. Data Retention

We keep personal data only as long as we need it:

• Account and profile data — while your account is open, and for a short period after you close it so the closure can be reversed if it was a mistake or disputed.
• Content you published — until you delete it or your account is closed. Content in a shared space, such as a message you sent to someone else or a comment on another user’s post, may remain visible to them, and may be retained in anonymised form.
• Stories — deleted automatically when they expire.
• Session recordings — deleted automatically on a rolling schedule.
• Analytics and usage data — retained for the periods set by each provider and by our own analytics configuration.
• Purchase and tax records — for as long as accounting and tax law requires, regardless of whether your account is open.
• Moderation and safety records — retained where necessary to enforce bans and to defend legal claims.

7. Data Security

We employ industry-standard security measures to protect your personal information. However, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, while we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

These measures include administrative, technical, and organizational safeguards designed to protect personal data.

8. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information, including:

• The right to access the personal information we hold about you
• The right to request the correction of inaccurate personal information
• The right to request the deletion of your personal information
• The right to opt out of marketing communications

If you are located in the EU or UK, you also have the rights to restriction, objection, and data portability, the right to withdraw consent at any time without affecting processing already carried out, and the right to lodge a complaint with your national supervisory authority.

To exercise any of these rights, write to support@astratrainer.com from the address on your account. We may need to verify your identity before responding, and we will answer within one month of receiving a complete request, or tell you why we need longer.

8.1 Deleting your account

You can delete your account from the settings screen in the app, or by writing to the address above. Deleting your account closes it, removes your profile from the Service, and starts the deletion of your personal data on the schedule in §6. Some things do not go with it: content you sent into a shared space may remain visible to the people you sent it to or may be kept in anonymised form, and purchase, tax, moderation and security records are retained as described in §6. Coins and other virtual items are forfeited and cannot be restored.

9. Children’s Privacy

Astra is not intended for individuals under the age of 16. We do not knowingly collect personal information from individuals under 16. If we become aware that we have inadvertently collected personal information from an individual under 16, we will take steps to delete such information promptly. If you believe a child has given us their information, write to us at support@astratrainer.com and we will remove it.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. Your continued use of the Platform after any modifications indicates your acceptance of the updated Privacy Policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or your personal data, please contact us at:

Email: support@astratrainer.com

For privacy-related inquiries from the EU or UK, you may contact us at support@astratrainer.com

By using the Astra platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.