Privacy Policy

• Account data: name, email, hashed password, or (if you use Google Sign-In) your Google profile name, email, and avatar.
• Astrological data: birth date, exact birth time, and birth location (address and geo-coordinates). We use these to compute your natal chart, Sun/Moon/Rising, and daily horoscope.
• Profile content: photos (up to 5), bio, gender, orientation, messages you send.
• Selfie & biometric data (optional): if you use selfie verification, a temporary photo compared to your profile photo via a Vision AI model. See §5.
• Device & usage: IP address, browser type, pages viewed, session duration, and crash logs.
• Payments: we do not store your card number. Stripe processes payments and returns a customer ID + transaction status.
• Anti-abuse: hCaptcha may collect device signals to distinguish humans from bots.

We use your data to: (a) create and secure your account; (b) compute astrological content; (c) surface potential matches; (d) generate AI horoscopes and synastry reports; (e) process payments; (f) detect fraud and abuse; (g) send transactional emails (match notifications, subscription receipts); (h) comply with legal obligations.

We rely on: performance of contract for account and matching functions;consent for optional features like selfie verification and marketing emails;legitimate interests for safety, fraud prevention, and analytics; andlegal obligation for tax, financial, or law-enforcement records.

• With other users: your profile (name, age, photos, bio, Sun/Moon/Rising, verified badge) is visible to potential matches. Your exact birth time, date, and coordinates are never shown to other users.
• Service providers: Stripe (payments), Google (AI horoscope + selfie verification via Gemini), Emergent (hosting + AI key), hCaptcha (anti-bot). Each is contractually bound to protect your data.
• Legal: when required by valid legal process, to protect our rights, or to investigate abuse.
• Business transfers: in a merger, acquisition, or asset sale, with notice to you.
• We do not sell personal information as defined by CCPA / CPRA.

If you opt into selfie verification, we send your live selfie and your profile photo to Google Gemini Vision to compute a match confidence score. The selfie and its embedding are stored only as long as needed to (a) complete verification and (b) resolve any dispute (max 30 days), then deleted. You can request immediate deletion at privacy@soulstar.love. If you reside in Illinois, Texas, Washington, or any state with biometric-privacy legislation, your use of this feature constitutes written consent to this collection and destruction schedule.

We use strictly necessary cookies for authentication (session token) and preferences (verified-only filter, dismissed digest banners). We do not use advertising cookies. hCaptcha may set anti-bot cookies. You can clear cookies at any time in your browser settings.

We retain your data while your account is active and for up to 90 days after account deletion (for fraud/abuse investigations and to complete outstanding subscription cycles). After that, personal data is deleted or irreversibly anonymized, except records we must keep for tax or legal purposes.

Depending on where you live you may have the right to: (a) access your data, (b) correct inaccurate data, (c) delete your data, (d) port your data, (e) opt out of certain processing, (f) withdraw consent. To exercise any of these, email privacy@soulstar.love. We will respond within 30 days.

California residents: you have the additional rights described in the CCPA/CPRA. We do not "sell" or "share" (as those terms are defined) personal data.

Passwords are stored using bcrypt hashing. Data in transit is encrypted via HTTPS/TLS. Object storage (photos) is served over HTTPS with time-limited URLs. Despite our efforts, no system is 100% secure — please choose a strong, unique password.

SoulStar is operated from the United States. If you access the Service from outside the U.S., your data will be transferred to and processed in the U.S. Where required (e.g., EEA/UK), we rely on Standard Contractual Clauses.

SoulStar is strictly for adults 18+. We do not knowingly collect data from children under 18. If you believe a child has provided data, please contact us and we will delete it immediately.

If we make material changes we will notify you by email or in-app at least 7 days before the changes take effect. Continued use after the effective date constitutes acceptance.

Privacy: privacy@soulstar.love. General: support@soulstar.love.