Privacy Policy

ELASRA is an app for personal astrology, numerology and daily insight. We take your privacy seriously: we process most data only so that we can provide the service you requested. Optional things (analytics, news, extended check-in) are always separate and you turn them on yourself — the app does not depend on them to work.

1What data we process and why

Category	Data	Legal basis
Account	Email, secured password (stored only in hashed form), login session.	Performance of a contract (running your account).
Profile	Name, gender, relationship status, focus of your insights. Confirmation of age 18+.	Performance of a contract; legitimate interest (age gate).
Data for calculation	Date of birth, optionally time of birth and place of birth (entered manually as a city/country — we do not use your device's precise location).	Performance of a contract (natal chart, daily index, numerology).
Mood / check-in	Short non-clinical scales (mood, energy, focus) and an optional note.	Performance of a contract; explicit consent for the extended check-in.
AI guide Elas	Your questions and answers in the conversation with Elas (we keep them for the lifetime of your account; only a short window of the last few days enters the AI response). Inputs pass through automatic content-safety screening.	Performance of a contract.
Notifications	Your device push token, to deliver the notifications you enabled.	Legitimate interest / consent (depending on device settings).
Security and technical operation	IP address and standard server logs (request time, device/browser type) — generated automatically for every request to the server; they cannot be switched off.	Legitimate interest (protection against abuse, security and stability of the service).
Analytics, stability and advertising measurement	Anonymized data about app usage and crashes; when advertising measurement is on, also a device advertising identifier (advertising ID) and approximate location derived from the IP address — for usage statistics and measuring the effectiveness of our advertising campaigns.	Consent — you manage analytics and advertising measurement in Settings > Privacy and can turn them off at any time.
Payments	Purchase record (Keys / subscription). Payment details are processed by the store (App Store / Google Play).	Performance of a contract; legal obligation (accounting).

We intentionally do not collect sensitive health data — the check-in runs in a “safe” mode without symptoms, diagnoses or health labels.

All communication between the app and our servers is encrypted (HTTPS/TLS) and we store data on secured servers with restricted access.

2Optional consents

During onboarding and in Settings > Privacy you can independently turn on or off:

• Analytics — helps us improve features and stability.
• Advertising measurement — an advertising identifier and approximate location (from your IP) to measure the effectiveness of our advertising campaigns, including via Meta and Google; managed separately from analytics.
• News and offers — marketing messages (entirely separate from analytics).
• Extended check-in — storing daily answers for more personal recommendations.

Each consent is voluntary, separate, and you can withdraw it at any time as easily as you gave it — without affecting the core functioning of the app.

3Cookies and similar technologies on the website

This section covers the elasra.app website. Consents inside the mobile app are managed separately in Settings > Privacy (section 2).

Until you give consent, no measurement or advertising script loads on the website at all — not even your IP address reaches Google, and nothing is stored on your device: no cookie, no browser storage entry. You can consent separately to analytics and to ad personalization, reject everything with a single click, and change your choice at any time later.

Essential — stored even without consent

Name	Purpose	Retention	Recipient
elasra_cookie_consent_v2browser storage	Keeps your cookie banner choice so the site does not ask again on every visit.	Until you clear your browser data.	No one — it stays in your browser.
elasra_cookie_consent_v1browser storage	The same choice in an older format; kept for backwards compatibility.	Until you clear your browser data.	No one — it stays in your browser.
elasra_langbrowser storage	Remembers the language you switched to (CS/SK/EN). Written only when you switch language.	Until you clear your browser data.	No one — it stays in your browser.

Analytics — only with your consent

Name	Purpose	Retention	Recipient
_ga	Distinguishes individual visitors to the website (Google Analytics 4).	13 months (400 days).	Google Ireland Limited.
_ga_P4WKDL44EB	Holds the visit state for our specific Google Analytics 4 measurement ID.	13 months (400 days).	Google Ireland Limited.

Ad personalization — only with your consent

Name	Purpose	Retention	Recipient
_gcl_au	Measures which ad click led to our website (Google Ads).	3 months (90 days).	Google Ireland Limited.
_gcl_lsbrowser storage	A companion record of the same Google Ads measurement in browser storage.	Individual records up to 90 days; the key stays until you clear your browser data.	Google Ireland Limited.

Other third-party services on the website

• Google Tag Manager — the tool that runs measurement scripts according to your choice. It does not load before you give consent. If you reject both analytics and ad personalization, it never loads at all and Google learns nothing about your visit — not even your IP address.
• Google Analytics — measures website traffic. The measurement script is downloaded only once you allow analytics in the cookie bar; until then it is simply not on the page. If you withdraw your consent, measurement stops.
• Fonts — Bodoni Moda and Inter are served from our own server (elasra.app), so nothing is transmitted to Google when the page renders. They used to be downloaded from fonts.googleapis.com, which sent your IP address to Google before you had made any choice; that is no longer the case.

Google Ireland Limited acts as our processor for this measurement; transfers to the USA are covered by an adequacy decision (EU-U.S. Data Privacy Framework) — see section 5.

How to change or withdraw your choice

You can open the cookie settings at any time and change your choice — withdrawing is as easy as giving consent. You can also delete and block cookies directly in your browser settings; the website will keep working.

4Data of other people that you enter into the app

Some features (Resonance, Close ones, synastry, Animal bond) work by you yourself entering another person's data — typically a name and date, and optionally the time and place of birth of a partner, a close person or a pet. We process this data solely for the calculations and interpretations you requested (compatibility, joint readings), and we never use it to contact those people.

• Please enter only the data of people for whom you consider it appropriate — you are responsible towards them for the legitimacy of entering it.
• To generate AI texts we pass the AI provider only the necessary minimum (first name and zodiac sign, never the full date of birth or surname).
• You can delete these people's data at any time by removing the given profile in the app; it is also deleted when you delete your account.
• The person concerned can also exercise their rights (information, erasure) directly with us at hello@elasra.app.

5Who we share data with

We do not share data for the purpose of sale. We work only with the processors we need:

Processor	Purpose	Location / safeguards
App hosting (EU)	Running the servers and database.	EU.
Google Firebase / Google Analytics	Delivering push notifications, app crash reporting and product analytics (Google Analytics for Firebase).	EU/USA — EU-U.S. Data Privacy Framework, SCC.
Meta Platforms Ireland	Measuring and attributing our advertising campaigns and in-app events (app events) — only when advertising measurement is on; on iOS subject to App Tracking Transparency.	USA/EU — EU-U.S. Data Privacy Framework, SCC.
PostHog	Product analytics — only with your consent.	EU (data centre in the EU).
OpenAI	Generating personalized texts (horoscopes, Elas responses). Data is not used to train models.	USA — EU-U.S. Data Privacy Framework, SCC.
RevenueCat	Managing purchases and subscriptions (account identifier and purchase records; neither we nor RevenueCat ever see your payment card).	USA — EU-U.S. Data Privacy Framework, SCC.
Apple App Store / Google Play	Processing of the payment itself.	Under the stores' terms.
Resend	Sending emails (confirmations, password recovery).	USA — SCC.

We have a data processing agreement in place with each processor; transfers outside the EU are covered by an adequacy decision (EU-U.S. Data Privacy Framework) or by standard contractual clauses.

6How long we keep data

We keep data for the lifetime of your account. When you delete your account, we deactivate it immediately and, within 30 days, irreversibly remove all your data from our systems (including check-ins, journal, conversations with Elas and the data of close persons). Short-term backup copies, kept for disaster recovery, rotate continuously — your data disappears from them no later than 60 days after the deletion request. Exceptions: we keep payment records for the period required by accounting and tax regulations, and we keep records of granted consents as proof that they were given — no longer linked to your account, though each record retains technical details about the context of the choice (language, app version, platform, and possibly a device identifier from before sign-in).

Account deletion covers data in our systems. With some processors (see section 5), data remains afterwards: RevenueCat retains the record of your purchases and subscription (account identifier and transaction history), PostHog the analytics events captured before the account deletion, and Meta the advertising-event data sent to it if you had ad measurement enabled — the data at Meta remains permanently and we are technically unable to have it deleted.

7Your rights

To the extent of the GDPR you have the right to:

• access to your data and a copy of it;
• rectification of inaccurate data;
• erasure (the “right to be forgotten”);
• restriction of processing;
• data portability;
• object to the processing;
• withdraw a granted consent at any time.

You can handle most of this directly in the app (Settings > Privacy — consent management, export, account deletion). You can also reach us any time at hello@elasra.app.

A step-by-step guide on how to delete your account (in the app or by email) is available on the Delete account & data page.

If you believe we are processing your data contrary to the regulations, you have the right to lodge a complaint with a supervisory authority — in the Czech Republic this is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz). As an EU resident you may also contact the supervisory authority in your own country.

8Children

ELASRA is intended for persons aged 18 and over. We do not knowingly create or process accounts of younger persons.

9Who the controller is

The controller of personal data is the operator of the ELASRA app — TABERNAUS, s.r.o., company ID (IČO) 27841201, VAT ID (DIČ) CZ27841201, registered office at Boženy Němcové 150/5, Nová Ulice, 779 00 Olomouc, Czech Republic, entered in the Commercial Register kept by the Regional Court in Ostrava, file No. C 43252. For privacy matters, contact us at hello@elasra.app — we will handle your questions as well as requests concerning your rights above.

10Changes to this policy

We may update this policy from time to time. We will inform you of material changes in the app, and you will always find the date of the last update here.