Privacy and cookies

Last updated: 16 October 2026

This page explains what personal data the Oraclea app and website process, what cookies the website uses and what rights you have. It is written in accordance with Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC (ePrivacy Directive), the Codice in materia di protezione dei dati personali (Italian Privacy Code, Legislative Decree 196/2003) and the Guidelines on cookies and other tracking tools of 10 June 2021 issued by the Garante per la protezione dei dati personali (the Italian Data Protection Authority).

1. Data controller

The data controller, that is, the person who decides why and how your data is processed, is Gabriel Gorgone, a natural person, whom you can contact at the email address privacy@ggstudiosh.com. At present Oraclea is a personal project, not a company (see the terms and conditions, section 1). You can also write to us using the form on the Contact page, choosing the topic “Privacy and personal data”.

2. In brief

• The app processes the data it needs in order to work: your account, the profile you choose to complete and what you do in the app. We do not sell your data and we do not use it for advertising; neither the app nor the website contains third-party statistics or advertising tools. For Premium subscriptions we use RevenueCat, which receives only the data needed to manage purchases, not your name or your email.
• The website uses only technical cookies, which are necessary for it to work. It does not use profiling cookies, statistics tools (analytics), advertising, or buttons or embedded content from social networks.
• For technical cookies the law does not require consent, only that you are informed (Art. 122 of the Italian Privacy Code): this is why the website does not ask you to accept anything.
• The public pages of the website (home page, this policy, terms and conditions, account deletion, contact) do not load resources from third-party servers: fonts and scripts are hosted on our server. The exception, for now, is the account area (see section 5).
• You can delete your account whenever you like, from the app or by asking us (see the Delete your account page).

3. Cookies used by the website

They are all first-party cookies (set by this website) and technical cookies. There are no third-party cookies.

The website does not store any other information on your device.

4. How to manage or disable cookies

You can delete or block cookies in your browser settings, usually in the “Privacy” or “Cookies and site data” section (Chrome, Firefox, Safari, Edge and the other browsers all offer this feature). If you block this website's cookies, the pages remain readable, but the contact form and signing in to the account do not work: without the session cookie it is not possible to check that the request really comes from you.

5. Third-party resources

The website's fonts (Fraunces and Hanken Grotesk) are hosted on our server: when you open the public pages, your browser does not connect to the servers of Google or of any other provider.

Account area. The sign-in, registration, password reset and account management pages, and the internal management panel, still load a set of icons (Material Symbols) from the Google Fonts service. When you open those pages, your browser connects to Google's servers (fonts.googleapis.com and fonts.gstatic.com) to download the icons, and Google receives the technical data of the connection: your IP address, the type and version of your browser (user agent) and the address of our website from which the request originates. According to Google, the service does not use cookies. The service is provided by Google Ireland Limited (Ireland) and the data may also be processed by Google LLC in the United States, which participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023 (Art. 45 GDPR). Google processes this data as a third-party provider, under its own privacy policy (policies.google.com/privacy). Legal basis: our legitimate interest in displaying the account pages correctly (Art. 6(1)(f) GDPR). The public pages and the app do not use Google Fonts.

6. Browsing and security data

Like any website, the server that hosts Oraclea receives some technical data with every request, including requests from the app: IP address, page or function requested, date and time, type of browser or app. We use this data only to run the service and to protect it:

• to limit the number of requests coming from the same IP address (protection against abuse and automated submissions);
• to log website errors and submission attempts rejected by the anti-spam checks; this log is deleted automatically after about 30 days.

Legal basis: the controller's legitimate interest in the security and proper functioning of the service (Art. 6(1)(f) GDPR).

Retention: the technical logs of the web server (access and error logs), kept by the hosting provider, for up to 30 days. The anti-abuse counters record the IP address or, for sign-in and password reset attempts, a non-reversible hash of the email address, together with the function called and the time of the last request: the count resets by itself at the end of each check window, which lasts from one second to one hour, and any block after too many attempts lasts one hour at most.

7. Contact form

If you write to us from the Contact page, we process the data you enter: your email address (or, if you are signed in, the address of your account), the topic, the subject and the text of the message. We use this data only to handle your request and to reply to you by email, including a request to delete your account.

Legal basis: the taking of steps at your request or the performance of the service contract (Art. 6(1)(b) GDPR) and, for other kinds of requests, our legitimate interest in replying to those who contact us (Art. 6(1)(f) GDPR). Providing the data is optional, but without an email address we cannot reply to you.

Retention: for the time needed to handle the request and then for up to 24 months after it is closed, so that we can find the conversation if you write to us again on the same topic; after that we delete the data. If you delete your account, we also immediately delete the messages linked to your account or to its email address.

We ask you not to write in your message any data that is not needed, in particular passwords, health data or other special categories of data.

8. Data processed by the app

When you use the app, the data travels from your phone to our server, which stores it and uses it to show you the content. We process:

• the account: username, email address, password (stored only in encrypted, non-reversible form), language, date of registration and date of last sign-in;
• the profile: your zodiac sign and, if you enter them, date, time and place of birth, with the coordinates and time zone of the place, which are needed to calculate the birth chart; your plan (free or Premium) and its expiry date;
• the profile photo, if you choose one (see below);
• what you do in the app: the rituals of the day and their result (card, Moon phase, chakra), the ratings of your day, card readings with the questions you write, diary pages (the note and the answer to the question of the day), the synthesis of your birth chart and your invite codes;
• friends: friend requests, friendships, the users you ignore or block, the ritual reminders you send to friends, and the reports you make or that concern you (category and, if you write one, the description);
• push notifications: the code that Google's notification service assigns to the app on your phone, with the phone's system (Android or iOS) and the app language (see below);
• signing in: when you sign in, the app receives an access code that it stores on the phone; on the server we keep only a non-reversible hash of it, which expires after 30 days.

Legal basis: the performance of the contract you enter into by creating the account, that is, providing you with the service described in the terms and conditions (Art. 6(1)(b) GDPR); for reports, blocks and account security, also our legitimate interest in protecting users and the service (Art. 6(1)(f) GDPR). Without a username, email address and password it is not possible to create the account; birth data is optional, but without it the birth chart cannot be calculated.

Who sees your data. Other users see your username and your sign. Your friends also see your profile photo, if you have added one, whether you have done the ritual of the day and its result, the trend of your chakras over the last few days and the new friendships you make. No other user sees your diary or your birth data.

Profile photo (optional). If you choose a profile photo from your phone's gallery, we upload it to our servers. Before saving it, we crop it to a square, reduce it to 256 × 256 pixels and re-encode it: the data hidden in the original file (for example the GPS location, the phone model, the date the photo was taken) is not kept. The photo can be seen by you and only by the people you have accepted as friends in the app; it is not public and we do not show it to anyone who is not your friend or to anyone you have blocked. When you change it, the old one is deleted immediately; you can remove it at any time from your Profile, and when the account is deleted the photo is deleted together with the rest of your data. Your friends' phones keep a temporary copy of it to show it more quickly, which is deleted when they log out of their account. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by removing the photo.

Push notifications. The app can alert you with a notification on your phone when someone sends you a friend request, when one of your requests is accepted or when a friend sends you a ritual reminder. To deliver notifications we use Firebase Cloud Messaging, a Google service. When you sign in, and then every time it changes, the app receives from Google a code that identifies the app on that phone and sends it to our server, together with the phone's system and the app language, which is used to choose the language of the notifications. To create the code, the phone connects to Google's servers, which receive the technical data of the connection (such as the IP address) and an identifier of the app installation. When there is an alert for you, our server sends Google the code and the notification, which contains only the type of alert and the friend's username (with the number that identifies them in the app): never your cards, your chakras, your readings or your diary. Google processes this data on our behalf, as a processor, only to deliver the notifications. We keep the code as long as you stay signed in on that phone (if you use the account on several phones, we keep the codes of the last 10): we delete it when you log out, when you delete the account or when Google tells us it is no longer valid, for example because you have uninstalled the app. Legal basis: the performance of the contract, because the alerts are part of the friends features (Art. 6(1)(b) GDPR).

You can turn off notifications at any time in your phone's settings (usually Settings → Apps → Oraclea → Notifications); on Android 13 and later you can also deny the permission when the app asks for it. With notifications turned off, the phone no longer shows the alerts, but the code stays registered, so if you turn them back on they work straight away; to delete it from our server, log out of your account.

Data that stays on the phone. The app keeps on the phone the access code, your settings, a copy of the day's content (so that it does not have to download it every time) and, if you use synastry, the name and birth data of the other people you enter: this information about other people is not sent to our server. This data is deleted when you uninstall the app.

Cycle. At present the app does not ask for data about the menstrual cycle. If this feature returns, since this is data concerning health, we will first ask for your explicit consent (Art. 9(2)(a) GDPR).

The texts we show you are chosen on the basis of your sign, your birth data and the cards drawn: this is the service you request, not profiling for commercial purposes. We do not use the app data for advertising and we do not sell it.

9. Minimum age

Oraclea is reserved for people who are at least 18 years old. We do not ask you for any documents: when you register in the app, you confirm your age by ticking the box provided. If we become aware that an account belongs to someone younger, we close it and delete the data linked to it.

10. Place of birth search (OpenStreetMap)

When you search for a place of birth, your own or that of a person you add for synastry, the app sends the name of the place you type directly from your phone to the OpenStreetMap Nominatim search service (nominatim.openstreetmap.org), which replies with the coordinates of the place. Nominatim receives the search text and the technical data of every internet connection (the phone's IP address and an identifier of the app); the request does not contain your username, your email address or your date of birth. Nominatim processes this data as an independent controller, under its own privacy policy. The place you choose, with its coordinates and time zone, is then saved in your profile (for synastry, only on the phone).

11. Artificial intelligence

At present Oraclea does not use artificial intelligence: the texts are composed by our server and no data is sent to providers of artificial intelligence systems. If we use it in the future, we will update this page before enabling it.

12. Premium subscription and payments

Purchase. Premium can be purchased only in the Android app, through the Google Play payment system (see the terms and conditions, section 10). The payment is handled by Google (in the European Economic Area, Google Commerce Limited) as an independent controller, under its own privacy policy: only Google sees your card or account details, not us and not RevenueCat.

RevenueCat. To verify purchases and manage subscriptions we use RevenueCat, Inc., based in the United States, which processes the data on our behalf, as a processor. When you sign in to the Android app, the app connects to RevenueCat with an identifier of your account chosen by our server: it is a random code that contains neither your username nor your email, and it is used to know whether Premium is active and to show you the plans and prices. When you buy or restore a subscription, RevenueCat receives from the app and from Google Play the purchase receipt (a code), the product and plan you chose, the dates (purchase, renewals, free trial, expiry), the store country, the price and currency, and whether automatic renewal is on. It also receives the technical data of the connection: the IP address, the make and model of the phone, the Android version, and the version and language of the app. It never receives your name, your email or your card details. Our server receives the subscription status from RevenueCat and saves the plan and its expiry in your profile (section 8), with a log of the subscription events (purchase, renewal, cancellation, expiry).

This data is used to activate Premium and keep it until it expires, to restore it on another phone, to block fake receipts and to know the subscription figures (how many there are, renewals, revenue). Legal basis: the performance of the contract (Art. 6(1)(b) GDPR); for the subscription figures and fraud prevention, our legitimate interest (Art. 6(1)(f) GDPR).

13. Who processes the data

The data is processed by the controller and by the people on the controller's team who are authorised to do so. The providers needed to run the service process it on our behalf, as processors (Art. 28 GDPR): Hostinger International Ltd., based in Cyprus (European Union), which hosts the website, the app server and the database; the provider of the email mailbox we use to reply to you and to send the service emails (for example the one to reset your password); Google, with the Firebase Cloud Messaging service, which delivers push notifications to your phone; RevenueCat, Inc., based in the United States, which verifies purchases and manages Premium subscriptions (see above). Google and Apple (for downloading the app), Google for the icons of the account area (section 5) and OpenStreetMap (for the place search) process the data they receive as independent controllers or third-party providers, under their own privacy policies. The same applies to Google when it collects the payment for Premium subscriptions through Google Play.

We do not sell the data and we do not disseminate it, except for what other users see as described in section 8.

Transfers outside the European Union. Premium subscription data goes to RevenueCat, Inc., in the United States, with the standard contractual clauses approved by the European Commission (Art. 46 GDPR), contained in RevenueCat's data processing agreement. The technical data Google receives when you open the account area and the push notification data (Firebase Cloud Messaging) may be processed by Google LLC in the United States, which participates in the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). The place search goes to the OpenStreetMap Foundation, based in the United Kingdom, a country recognised as adequate by the European Commission (Art. 45 GDPR). If the email mailbox provider processes data outside the European Union, it does so with the same safeguards provided for by the GDPR (adequacy decision or standard contractual clauses, Articles 45 and 46).

14. How long we keep the data

• Account and app data: as long as the account exists. If you delete it from the app, we delete the data from the database immediately; if you ask us to do it without the app, within 30 days of your request.
• Profile photo: as long as you keep it; when you change or remove it, the previous one is deleted immediately.
• Backup copies: after the account is deleted, your data may remain in the backup copies for up to 90 days; it is then deleted as the copies rotate. The copies are used only to restore the service after a failure and we do not use them for anything else.
• App access code: expires after 30 days.
• Push notification code: as long as you stay signed in on that phone; we delete it when you log out, when you delete the account or when Google tells us it is no longer valid.
• Premium subscription data: as long as the account exists. When you delete the account we delete this data from our database and ask RevenueCat to delete the data linked to your account. The receipts and tax records of purchases kept by Google stay with Google, which handles them under its own rules.
• Log of errors and rejected attempts: about 30 days.
• Messages sent from the Contact page: as stated in section 7.
• Data the law requires us to keep, only for as long as required.

15. Deleting your account

You can delete your account from the app whenever you like: go to Profile, tap “Delete account” and confirm with your password. Deletion is immediate and cannot be undone, and it erases the account and all the data linked to it. If you no longer have the app, ask us from the Contact page, with the topic “Account and sign-in”, stating the email address of your account: we will delete it within 30 days. All the steps are on the Delete your account page. Deleting your account does not cancel your Premium subscription: cancel it in Google Play.

16. Your rights

At any time you can request access to your data (Art. 15 GDPR), its rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and portability (Art. 20), and you can object to processing based on legitimate interest (Art. 21). You can also carry out the erasure yourself, by deleting your account from the app. Oraclea does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22).

To exercise your rights, write to privacy@ggstudiosh.com or use the form on the Contact page with the topic “Privacy and personal data”. We will reply within one month of your request (Art. 12(3) GDPR).

17. Complaint

If you believe that the processing of your data infringes the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (the Italian Data Protection Authority, garanteprivacy.it) or with the supervisory authority of the European Union country in which you live or work (Art. 77 GDPR).

18. Updates

If the app or the website changes, we update this page and the date at the top; if the changes are important, we tell you in advance, in the app or by email. Should the website use cookies other than technical cookies in the future, we will ask for your consent before using them.