Privacy
Last changed: October 26, 2026
Draft, written in plain English for our early launch. A lawyer hasn't checked it yet.
Who we are
Omenfy is run by omenfy.com, based in Lithuania. We decide how your data is used, which makes us its controller under the EU's data protection law (the GDPR). Questions about your data: hello@omenfy.com.
What this policy covers
What we collect when you use omenfy.com, read our emails or open a link someone shared from Omenfy; why we collect it; who else handles it; how long we keep it; and what you can ask us to do with it.
What you give us
Your email address. Your first name. Your birth date, birth place and, if you give it, your birth time. How you mark your readings (“Yes, me” or “Not me”). Your settings, such as your time zone and which emails you want. Anything you write to us by email.
What we make from it
Your birth chart, calculated from your birth details. The readings and daily notes we write for you. A record of what you bought, when, and the amount.
What we collect automatically
Like every website, our servers see technical details with each visit: your IP address, browser and device type, the pages you open, and errors the site runs into. We use them to keep Omenfy working and safe. We keep the network you signed in from for up to 90 days, to protect your account. Cloudflare tells us your approximate time zone, so a page can show your own day; we use it for that page and don't store it.
What we don't collect
Your card details: Stripe takes them and we never see them. Anything you type into the birth form before you sign in: it is not stored. Data from ad networks or social networks. If you sign in with Google, we receive only your name and email address from it.
How we use it
To calculate your chart and write your readings. To sign you in and keep your account safe. To take payment and manage your Premium plan. To send the emails you asked for, and the ones the service needs, such as sign-in codes and receipts. To answer you when you write to us. To spot and stop abuse, such as fake accounts. To understand, in counts, which parts of Omenfy people use, so we can improve it. We don't sell your data, and we don't use it for advertising.
Why the law lets us
Most of it is needed to give you the service you asked for: your account, chart, readings and purchases. Optional emails rest on your consent, which you can withdraw at any time from your email settings or the link in each email. We keep payment records because tax and accounting law requires it. Security, abuse prevention, error reports and our own visit counts rest on our legitimate interest in keeping Omenfy safe and working, and they are built to use as little about you as possible.
Who helps us
A few companies handle data for us, only to provide their service to us. Stripe takes payments. Cloudflare runs our domain name, sends our emails and stores our backups, which are encrypted before they leave our server. Anthropic runs the language model that writes the words of a reading: it receives the placements and dates of a chart, never your name or email. Sentry receives error reports, with request bodies, cookies and anything that looks like birth details or an email address removed. Hostinger hosts our servers and the data on them. Google signs you in, if you choose to sign in with it. Google Analytics tells us which pages are visited and where visitors came from. Ahrefs Web Analytics gives us cookie-free visit counts.
What you choose to share
When you share a card, a friends' game or a calendar feed, anyone with the link sees what it shows. A friends' game shows only your Sun, Moon and Rising signs. You can replace your calendar link at any time, which stops the old one, and we'll turn off any other link you ask us to. Your birth details are never in a link.
Data outside the EU
Our servers, and the data on them, are in the US, with Hostinger. Some of the other companies above also handle data outside the EU, mostly in the US. Each of those transfers is covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.
Cookies
We use only cookies the site needs. One keeps you signed in. One protects forms from forgery. One remembers a device you have signed in on, for up to 400 days, so sign-in stays safe. A friends' game uses one to remember your answers. Your browser may also keep small preferences, such as a tab you last opened. Google Analytics sets two cookies, _ga and _ga_ followed by our measurement ID, to tell one visit from the next; they last up to two years, or 400 days where your browser caps cookies. There are no advertising cookies, and Ahrefs sets none.
How we count visits
We count visits and steps ourselves, on our own servers, and also use Google Analytics and Ahrefs Web Analytics to see which pages are visited and where visitors come from. Our own counts use a code that changes every day, so they can't be linked back to you over time. Private links, reading ids and sign-in codes are removed from addresses before anything is sent to Google or Ahrefs, and your birth details, name and email never go to either.
Your birth details stay out of sight
Birth details are never written to our logs, our analytics, our error reports or the addresses of our pages.
How long we keep it
Your account, birth details and readings: until you delete your account. Payment records: as long as tax and accounting law requires, which in Lithuania can be up to 10 years, unlinked from your account once it is deleted. The network you signed in from: up to 90 days. The device cookie: up to 400 days. Server logs and error reports: a short time, then deleted. If you asked us to stop emailing you, your address stays on a do-not-email list so we keep that promise. Deleted data leaves our encrypted backups as they are replaced.
How we protect it
Every connection is encrypted. Backups are encrypted and kept off-site. Only the people and systems that need data can reach it. No system is perfectly safe, though. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.
Your rights
You can ask to see what we hold about you, to correct it, to delete it, to receive a copy you can take elsewhere, to object to or limit how we use it, and to withdraw any consent you gave. Email hello@omenfy.com from the address on your account. We may ask you to confirm it's you. It's free, and we answer within a month.
Deleting your account
Email hello@omenfy.com from the address on your account. We cancel any Premium plan first, then delete your account, birth details and readings. Payment records stay, unlinked from you, as described above; Stripe keeps its own record of the payment. A self-serve delete button is planned.
Complaints
Tell us first and we'll try to put it right. You can also complain to a data protection authority: ours is Lithuania's State Data Protection Inspectorate (vdai.lrv.lt), or you can go to the one where you live.
Age
Omenfy is for people aged 16 and over. We don't make a chart for a birth date less than 16 years ago, and if we learn an account belongs to someone younger, we delete it.
Changes
When this policy changes, the date at the top changes with it. If a change matters to how we use your data, we'll email you before it takes effect.