Privacy Policy

Stellaxa is operated by a sole proprietor based in Slovenia, European Union. We develop and maintain the Stellaxa mobile application (available on Google Play) and the Stellaxa website at www.stellaxa.com.

For the purposes of applicable data protection laws, including the General Data Protection Regulation (GDPR), Stellaxa acts as the data controller for the personal data described in this policy — both for the website and for the Stellaxa mobile application.

Contact: info@stellaxa.com | Website: www.stellaxa.com

We are committed to data minimisation and only collect what is needed to provide our services. This section covers both the mobile app and the website.

Mobile app — Account data: When you create an account we collect your email address and a password (stored in hashed form by our authentication provider), and the name you choose to share.

Mobile app — Profile and birth data: To personalise readings you may provide your date of birth, time of birth, place of birth, language, and device timezone. Providing birth time and place is optional.

Mobile app — Reading inputs: Depending on which readings you use, we process the content you submit: photos of your palm (palm reading), photos of your coffee cup (coffee reading), dream descriptions, questions you ask, details you enter about another person for compatibility readings (such as their name and birth date — please only enter information you are allowed to share), and your chat messages with Stella, including any photos or documents you choose to attach.

Mobile app — Generated content: The readings and chat replies generated for you are stored in your account so you can revisit them.

Mobile app — Purchases: Purchases are processed by Google Play. We receive purchase state (e.g. which product, whether a subscription is active) via our payments provider (RevenueCat); we never receive your card or bank details.

Mobile app — Community (optional): If you join community matching, add connections or post a take on the daily card, the people you are matched or connected with (and, for takes, other app users) see the name you share, your avatar, sun sign, profile photo and, once you both accept a match, your bio. They never see your birth date, email or exact location. Messages you exchange are stored so both of you can read them.

Mobile app — Device and usage data: push notification token (if you enable notifications), device type and app version. Only if you allow usage analytics: usage events linked to your account — the screens and features you open, what you tap, purchases and their outcome, errors, session length, settings you change, where you installed the app from (for example an ad or a creator's link), and a topic category for questions you type (love, work, money, family or other). We never store the text you type as analytics. Events from before you sign up are linked to a random install identifier and attached to your account when you sign in. Only if you allow crash reports: crash traces, device metadata and your pseudonymous account ID. Advertising identifiers are used only as described in the Cookies and Tracking section and subject to your consent choices. We also store your country, taken from your app store region and, when you buy, from our payment provider.

Website (stellaxa.com) — Waitlist form: email address and interest selections. Automatically collected: our hosting provider (Railway) may collect standard server logs (IP address, browser type, pages visited, timestamps, referring URL).

Website (stellaxa.com) — Account, readings and purchases: You can sign in to the website with your Stellaxa account and get readings there; the account, profile and reading data described above applies. Star packs bought on the website are paid through Stripe: we receive the payment reference, the pack and the amount, never your card or bank details.

We use the data we collect for the following purposes:

Providing readings and the Stella chat — Your reading inputs (photos, questions, birth data, chat messages) are processed to generate your readings and replies. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

AI generation — Reading and chat content is generated with the help of artificial-intelligence models (see Third-Party Services). The content generated is guidance for entertainment and self-reflection; it produces no legal or similarly significant effects about you.

Account management, purchases and entitlements — Managing your account, star balance and subscription status. This includes star packs bought on the website. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Push notifications — Sending daily guidance and app messages if you enable notifications. Legal basis: consent (Art. 6(1)(a) GDPR); you can disable notifications at any time in the app or system settings.

Community — Showing your community profile to the people you are matched or connected with, delivering your messages and takes, and checking each message automatically for abuse before it is delivered. A message that fails the check is not delivered and is kept for review. If you report someone, the report includes the recent messages of that conversation. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) for delivering messages; legitimate interest (Art. 6(1)(f) GDPR) for abuse screening and reports.

Analytics and crash reporting — Understanding how the app is used and fixing errors, only if you allow it in the app's privacy choices. You can withdraw at any time in the app's privacy settings; collection stops from that moment. We keep a record of each choice (what you chose, the policy version and when). Legal basis: consent (Art. 6(1)(a) GDPR).

Advertising — Showing ads in the free tier, subject to the consent choices you make in the ad-consent dialog. Legal basis: consent (Art. 6(1)(a) GDPR).

Security and abuse prevention — Rate limiting and protecting the service. When a welcome bonus or referral reward is claimed, we check your device's identifier (the Android ID on Android, the vendor identifier on iOS) and, for referrals, your IP address, so each device can claim it only once; these are never used for analytics or advertising. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Website waitlist — Sending launch updates you opted into. Legal basis: consent (Art. 6(1)(a) GDPR).

We do not sell, rent, or trade your personal data.

Where Your Data Is Stored: App data (account, profile, readings, chat) is stored with our backend provider Supabase on servers in the European Union (Frankfurt, Germany). The website is hosted on Railway on EU servers (Amsterdam, Netherlands).

How We Protect Your Data: All traffic between the app or your browser and our servers is encrypted in transit (TLS). Photos and chat attachments are stored in private storage accessible only to your account. Access to production systems is restricted.

Retention: Your data is kept while your account exists. When you delete your account, your personal data and readings are deleted. You can delete individual readings in the app at any time. Website waitlist data is retained until you request deletion; server logs are retained per our host's standard period (typically 7–30 days). Usage analytics events are deleted after 90 days, and immediately when you delete your account; they are included when you export your data. Community messages are kept while the conversation exists and are deleted when either account is deleted; blocked messages and reports are kept for moderation until the accounts involved are deleted.

How to delete: In the app, go to Profile → Settings → Privacy & Data → Delete Account, or use the Delete Account page on our website, or email info@stellaxa.com.

As a resident of the European Economic Area (EEA) or where otherwise applicable, you have the following rights regarding your personal data:

Right of Access (Art. 15) — You can request a copy of the personal data we hold about you.

Right to Rectification (Art. 16) — You can ask us to correct inaccurate or incomplete data. You can edit your profile data directly in the app.

Right to Erasure (Art. 17) — You can delete your account and data directly in the app (Profile → Settings → Privacy & Data), via the Delete Account page on our website, or by emailing us.

Right to Restrict Processing (Art. 18) — You can ask us to limit how we use your data.

Right to Data Portability (Art. 20) — You can request your data in a structured, commonly used, machine-readable format by emailing info@stellaxa.com.

Right to Object (Art. 21) — You can object to data processing based on legitimate interests.

Right to Withdraw Consent — Where processing is based on consent (ads, analytics, notifications), you may withdraw it at any time in the app's settings or system settings, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at info@stellaxa.com. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority. In Slovenia, this is the Information Commissioner (Informacijski pooblaščenec): https://www.ip-rs.si | gp.ip@ip-rs.si

Mobile app: The app does not use cookies. Always subject to your choices, it uses an advertising identifier for ads in the free tier (governed by the Google UMP consent dialog shown in the app — you can change your choice in the app's privacy settings), usage analytics linked to your account, and crash reporting (both shown as choices in the app's privacy dialog; we ask again whenever this policy changes materially). For analytics the app uses a random identifier created at install, not the advertising identifier or the Android device ID; reinstalling the app creates a new one.

Website: Our website uses analytics cookies and session recording technologies, activated only after you give explicit consent via our cookie consent banner.

Analytics cookies (Google Analytics 4): _ga — distinguishes unique users, duration 2 years; _ga_* — maintains session state, duration 2 years.

Session recording cookies (Microsoft Clarity): _clck — identifies user across page views, duration 1 year; _clsk — connects session events, duration 1 day.

Consent mechanism: On your first visit, a consent banner is shown before any analytics load. Your choice is stored locally in your browser (localStorage) under the key 'stellaxa-consent'. If you reject, no analytics cookies are set. You can change your choice at any time using the Cookie Settings link in the footer. We implement Google Consent Mode v2, which ensures analytics_storage defaults to 'denied' until explicit consent is granted.

Strictly necessary: The only cookies that may be present without consent are essential functional cookies set by our framework (Next.js) for locale preferences. These do not require consent under GDPR.

We use the following processors and service providers:

Supabase — App backend and database (EU servers, Frankfurt). Data processed: account, profile, readings, chat, photos and attachments.

Google Gemini API (Google) — AI generation of readings and chat replies. Data sent: the inputs needed for your reading (questions, birth details relevant to the reading, palm/coffee photos, chat messages and attachments). Per Google's API terms, this data is not used to train Google's models.

Google Play and Google AdMob (Google) — App distribution, billing, and advertising in the free tier. AdMob shows ads subject to the consent you give in the ad-consent (UMP) dialog. Google's privacy policy: https://policies.google.com/privacy.

RevenueCat — Subscription and purchase management. Data processed: purchase state and pseudonymous app user id. https://www.revenuecat.com/privacy.

Firebase (Google) — App analytics, only with your consent and with advertising signals always off, and push-notification infrastructure.

Expo — Push-notification delivery. Data processed: push token.

Sentry — Crash and error reporting, only with your consent. Data processed: crash traces, device metadata and your pseudonymous account ID.

Stripe — Payment processing for star packs bought on the website. Data processed: your email address, account ID and the payment details you enter with Stripe. https://stripe.com/privacy.

OpenAI — Automatic abuse screening of community messages and takes (Moderation API), with Google Gemini as a fallback. Data processed: the text of the message being checked.

Discord — Internal alerts for our operations. Data processed: pseudonymous account IDs and moderation categories, never the text you write.

Railway — Website hosting (EU). Google Analytics 4 and Microsoft Clarity — website analytics, only after cookie consent (see Cookies and Tracking).

Google Fonts — Typography, self-hosted at build time; no requests reach Google at runtime.

Your core app data is stored in the European Union (Supabase, Frankfurt; Railway, Amsterdam).

Some of our processors are US companies (Google, OpenAI, Stripe, RevenueCat, Sentry, Expo, Discord), and processing a reading or delivering a notification can involve a transfer of the relevant data outside the EEA. Where that happens, the transfer is protected by appropriate safeguards: the EU–US Data Privacy Framework where the provider is certified, and/or Standard Contractual Clauses (SCCs) in the provider's data-processing terms.

We do not transfer your data outside the EEA in any other circumstances.

Stellaxa's website and app are intended for a general audience and are not directed at children. We do not knowingly collect personal data from children under the age of 16 (or the applicable age of digital consent in your jurisdiction).

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at info@stellaxa.com, and we will promptly delete that information.

Stellaxa provides divination and fortune-telling experiences (palm reading, tarot, astrology, the Stella chat, and related readings) for entertainment and self-reflection purposes only. Readings and chat replies are generated with the help of artificial intelligence. They are not a substitute for professional advice in areas such as health, finance, legal matters, or personal decisions.

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make changes, we will update the "Last Updated" date at the top of this policy. For significant changes, we will provide notice on our website. For significant changes to what the app collects, we will also show a notice in the app and ask for your choice again before collecting anything.

We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this privacy policy or our data practices, you can reach us at:

Email: info@stellaxa.com

Website: www.stellaxa.com