Aurenia Group
Privacy policy
1. Who We Are
Cosmic Tea (“we,” “us,” or “our”) is operated by Aurenia Group. We provide an AI-powered astrology relationship advice app available on iOS, Android, and the web.
For EU/EEA users, Aurenia Group acts as the data controller for your personal data. For Canadian users, Aurenia Group is the organization responsible for personal information under PIPEDA.
2. Who This Policy Applies To
This policy applies to all users of the Cosmic Tea app and website globally. By creating an account, you confirm you are at least 18 years old. We do not knowingly collect personal information from anyone under 18.
3. What Data We Collect
Data You Provide Directly
| Data Type | Why We Collect It |
|---|---|
| Email address | Account creation and communication |
| Date of birth, and, if you choose to add them, birth time and birth city | Generating your astrological profile, birth chart, and compatibility readings. A birth city is converted to geographic coordinates on our servers to compute an accurate chart |
| Names and birthdays of people you add to your roster | Generating compatibility readings for those relationships |
| Chat messages | Providing AI-generated relationship advice |
| Conversation screenshots (Receipts, paid tiers) | On Cosmic/Galaxy you can attach a screenshot of a text/DM/work conversation so your guide can read it directly. The image is sent to Anthropic's Claude, through Vercel's AI Gateway, to generate the reply and stored privately in our system (signed-URL access only) until automatic deletion. Screenshots may include messages from people who haven't agreed to this analysis, so only upload conversations you're comfortable sharing. |
| Tarot card photos (paid tiers) | On Cosmic/Galaxy you can photograph your own tarot cards so your guide can read them. The photo is sent to Google's Gemini and Anthropic's Claude, through Vercel's AI Gateway, to identify the cards. We don't store the photo. |
| Subscription and payment information | Processing your subscription via the Apple App Store, Google Play or, if you subscribe on our website, our web checkout, which RevenueCat runs with Stripe processing the payment. Subscription state is managed by RevenueCat. We never see or store your full card number |
Data We Collect Automatically
| Data Type | Why We Collect It |
|---|---|
| App usage and interaction data | App functionality, security, and improving performance (PostHog analytics) |
| Session replays, recordings of screens and taps inside the app, associated with your account | Diagnosing bugs and improving the experience (PostHog session replay; password fields are always masked) |
| Pages you visit on cosmictea.app and the link or campaign that brought you there | Understanding which pages and sources bring visitors (PostHog analytics). The website sets no cookies and stores nothing on your device, and we don't use it to identify you |
| Device type and OS version | Technical compatibility |
| Crash reports and diagnostic data | Identifying and fixing bugs (Sentry) |
| IP address | Security, fraud prevention, and approximate location |
We do not collect GPS location from your device, or data from your contacts, camera, or microphone unless you explicitly grant access for a specific feature. If you enter a birth city, we convert it to precise geographic coordinates on our servers solely to compute birth charts. This is the location of a birthplace you typed, not tracking of your device.
Support Messages
When you contact us through the in-app “Get help” form, we store the message you write, the category you choose, the email address you give us for our reply, and basic technical details that help us diagnose the problem (app version, platform, language, and your subscription tier). We keep these messages so we can answer you and track recurring issues. They are never used for advertising and are not shared with third parties beyond the email provider that delivers our reply.
4. How We Use Your Data
We use your personal data for the following purposes:
- Providing the service: generating AI-powered astrological compatibility readings and relationship advice based on your birth date and chat messages
- Account management: creating and maintaining your account, processing subscriptions
- Communication: transactional emails (receipts, account notices), and if you opt in, marketing communications
- Safety and security: detecting fraud, abuse, and policy violations
- Legal compliance: meeting our obligations under applicable law
- Service improvement: analysing aggregated, anonymised usage patterns (never your chat content)
We do not sell your personal information. We do not use your data for targeted advertising.
5. Legal Bases for Processing (GDPR: EU/EEA | PIPEDA: Canada)
If you are located in the EU or EEA, we process your personal data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Providing the core app service (chat, readings) | Contract performance (Art. 6(1)(b)) |
| Email address (account management) | Contract performance (Art. 6(1)(b)) |
| Date of birth (astrological readings) | Explicit consent (Art. 6(1)(a)) |
| AI processing of chat messages | Contract performance (Art. 6(1)(b)) |
| Marketing communications | Consent (Art. 6(1)(a)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
Note on astrological data: We collect your date of birth for the sole purpose of generating astrological readings. Because astrological interpretations may reflect upon beliefs or characteristics that could be considered sensitive, we treat this data with extra care and process it only with your explicit consent. You may withdraw consent for processing your date of birth at any time, but doing so will prevent us from providing personalised readings, which are core to the service.
Canadian Users, PIPEDA & Quebec Law 25: Cosmic Tea processes your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64). We collect only the personal information reasonably necessary to provide the Service, obtain meaningful consent before collecting sensitive data, and maintain appropriate safeguards. Quebec residents have additional rights under Law 25, including the right to data portability and the right to request de-indexation of certain published information.
6. Who We Share Your Data With
We share personal data only with the service providers below, who act on our instructions as data processors. We do not share data with third parties for their own marketing or advertising purposes.
Our AI Partners (AI Processing)
Your guides are AI. To write chat replies, readings, notifications and memory, we send the data each feature needs to the AI companies below, reached through Vercel's AI Gateway. The same list, with what each one processes and how, is in the app (the “our AI partners” link at the consent step, and You → Privacy & Data) and at app.cosmictea.app/ai-data.
Law Enforcement / Legal Requirements
We may disclose personal data if required by law, court order, or regulatory authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Cosmic Tea, our users, or the public.
7. International Data Transfers
Cosmic Tea is operated globally. Your personal data may be transferred to and processed in countries outside your own, including the United States. For transfers from the EU/EEA, data stored in Supabase is processed within the European Union. Data processed by our AI partners Anthropic, OpenAI and Google (AI), Vercel (hosting and AI Gateway), RevenueCat (subscriptions), Stripe (website payments), PostHog (analytics), and Sentry (crash reporting) is transferred to the United States under Standard Contractual Clauses approved by the European Commission and, where certified, the EU-U.S. Data Privacy Framework.
You may request a copy of the applicable transfer safeguards by contacting privacy@cosmictea.app.
8. How Long We Keep Your Data
We retain personal data only as long as necessary for its original purpose, unless a longer retention period is required by law.
| Data Type | Retention Period |
|---|---|
| Account information (email, birthday) | Duration of your account + 30 days after deletion |
| Chat history | 90 days from each conversation, then automatically and permanently deleted |
| Conversation screenshots (Receipts) | 7 days, then automatically and permanently deleted from our storage |
| AI processing data (our AI partners) | Vercel AI Gateway: deleted when each request completes. Anthropic: deleted within 30 days. OpenAI: up to 30 days. Google: a limited period for abuse monitoring. Any of them may keep data longer if it is flagged for a policy violation or where the law requires |
| Payment transaction records | 7 years (tax and financial compliance) |
| Security and server logs | 30 days |
| Anonymised analytics | Indefinitely (no personal identifiers) |
When you delete your account, we initiate permanent deletion of all personal data within 30 days, except where we are legally required to retain it (e.g. transaction records).
9. Your Rights
All Users
- Access: request a copy of the personal data we hold about you
- Deletion: request deletion of your account and personal data
- Correction: request correction of inaccurate data
- Portability (EU/EEA): receive your data in a structured, machine-readable format
- Objection (EU/EEA): object to processing based on legitimate interests
- Restriction (EU/EEA): request restriction of processing in certain circumstances
- Withdraw consent (EU/EEA): withdraw consent at any time without affecting prior processing
- Complaint (EU/EEA): lodge a complaint with your local data protection authority
California Residents (CCPA/CPRA)
- Know what personal information we collect, use, disclose, and sell
- Delete your personal information
- Correct inaccurate personal information
- Opt out of the sale or sharing of personal information (we do not sell or share your data for advertising)
- Limit use of sensitive personal information
- Non-discrimination for exercising your rights
Canadian Residents (PIPEDA / Quebec Law 25)
- Access the personal information we hold about you
- Request correction of inaccurate or incomplete personal information
- Withdraw consent to collection or use (subject to legal or contractual restrictions)
- Lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca
- Quebec residents: request data portability and de-indexation of published information under Law 25
To make a rights request, contact privacy@cosmictea.app or submit a request through the app under Privacy & Data. We will respond within 45 days (California), 30 days (EU/EEA), or 30 days (Canada / PIPEDA), with one possible 30-day extension.
“Do Not Sell or Share My Personal Information”: Cosmic Tea does not sell or share your personal information for cross-context behavioural advertising.
10. Children's Privacy
Cosmic Tea is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If we discover that a user is under 18, we will immediately terminate the account and delete all associated data. If you believe a child has registered, contact privacy@cosmictea.app.
11. Data Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
- Access controls limiting who within Aurenia Group can access personal data
- Regular security assessments and monitoring
- Contractual data security obligations with all processors
No security measure is perfect. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by push notification or in-app banner, email to your registered address, and by updating the “Last Updated” date at the top of this page. Continued use of Cosmic Tea after changes take effect constitutes acceptance of the revised policy.
13. Contact Us
For any privacy-related questions, rights requests, or concerns:
For EU/EEA users, you have the right to contact your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.