Privacy Policy
Attune collects about as little as a quiz can. This page says exactly what that is, who else sees it, and how to get it deleted. Attune is the controller of the information described here.
1. What we collect
- A first name. Whatever you type. It only has to be what the other person will recognize — a nickname works, and we would rather you used one.
- Your answers to the quiz. These describe how you relate to a partner: how you handle conflict, how much reassurance you want, how quickly you want clarity. Treat them as sensitive, because they are.
- Your email address, in one of two ways. After sending an invite you can ask us to email you when the other person finishes; if you do, we store that address, the time you gave it, and whether you also checked the separate box for occasional Attune updates. Separately, if you buy a Couple Report, Polar passes us the address you paid with so we can send you the link to it — a buyer with no account and a cleared browser would otherwise have no way back to something they paid for. We use that address for that one email and do not store it.
- Technical records that come with any website: the invite token in your link, timestamps for when a result was created, completed, paid for, or refunded, and the identifier of a Polar order when you buy a report.
We ask for your date of birth, which is required, but we never store it: your browser works out your zodiac sign and checks you are 18 or older, and only the sign is saved with your result. We do not ask for your phone number or location, and we do not require an account. We never see your card details — those go straight to Polar.
2. If you ask for a cosmic reading
A reading needs more than the quiz does, and it is kept for less time. When you order one we collect your name, date of birth, birthplace(chosen from a list built into the site, so nothing you type is sent anywhere to be looked up), your email address, and optionally your birth time and gender. Gender is optional and is not used in any calculation; a birth time is optional and decides only whether the reading can include a rising sign and houses.
Your birth details are used to calculate where the planets were at that moment, and to write the reading. Your email address is used to send you the link to it, and to send that link again if you ask us to. It is not used for marketing. We only ask for it for the readings that are kept: Today's Reading is not sent anywhere, so it does not need one.
Today's Reading is never stored at all. It is written while you wait and handed back on the page you asked from — no database row for the reading, none for the birth details it was drawn from, no link and no email. What you send us exists for the length of that one request, and reloading the page ends the reading. For that one, the paragraph below has nothing to delete.
For the readings that are kept, all of it is deleted 7 days after the reading is written — the reading, the birth details, the email address and the link, which stops working at the same moment. An order that never became a reading is deleted within a day. A PDF you downloaded is on your own device and is outside anything we can delete.
If you pay for a reading, Polar handles the payment and keeps its own record of the transaction for accounting and tax, as described in section 5. That record is separate from your reading and outlives it; it does not contain your birth details.
3. Why we are allowed to hold it
Under the GDPR and equivalent laws, we rely on: your consent, given by choosing to submit answers you know will be shared with the person on the other side of the invite; and performance of a contract with you, to deliver and support a Couple Report you have paid for. You can withdraw consent at any time by deleting your result (section 6).
Email is used for exactly two messages: telling you when the person you invited has finished, and sending a buyer the link to the report they just paid for. The second is part of delivering what you bought, which is why it is sent to everyone who buys. We'll only send you anything else — news, tips, offers — if you checked the separate box asking for it, and every one of those has an unsubscribe link that works. We do not sell, rent, or share your address, and we do not use it to build a profile of you.
4. Who sees your answers
The other person in your report does. That is the point of the product, and it is worth being blunt about: when you complete an invite, the person who invited you receives a report built from your answers, and their app receives your answers in order to build it. Do not answer an invite from someone you would not want reading your answers.
Nobody else sees them. Anyone holding your link can open what it opens, so a forwarded link is a disclosure you have made. We do not sell personal information, we do not share it for advertising, and we do not use it to train models.
5. Companies that process it for us
- Supabase — the database that stores results.
- Vercel — hosting and server logs.
- Resend — sending the emails described above, if you asked for them. It receives only your address and the message itself.
- PostHog, Google Analytics and Microsoft Clarity — how the site is used, as described in section 9. None of them receives your invite token or report id, and session recordings are masked so they cannot show your answers or your report.
- Google AdSense — the ads shown on the site, as described in section 9.
- Polar — payments, as merchant of record. Polar receives what it needs to take a payment and issue a receipt; we send it only the identifier of the report being unlocked. Polar's own privacy policy covers what it collects from you at checkout.
These providers process data in the United States and elsewhere. Where data leaves the UK/EEA, the transfer relies on the providers' standard contractual clauses.
6. How long we keep it, and how to delete it
We keep a result for 7 days, then destroy it. The clock runs from the last thing that happened to it: you creating it, the person you invited finishing their answers, starting a purchase, or the Couple Report being paid for — whichever came last. Starting a purchase counts even if you do not finish it, so that a payment we have not finished processing can never be deleted out from under you. When it expires, the whole row goes: both sets of answers, both names, the report built from them, and any email address attached to it. Deletion is permanent and there is no copy to restore from.
Your report names the date. A PDF is generated in your browser rather than on our servers, so a copy you download is on your device and is unaffected by any of this — if you want to keep your report, download it before the date shown on it.
You do not have to wait. You can delete it yourself at any time:
- If you started the quiz: use Delete my data at the bottom of your report. This erases the whole result, including your partner's answers and any report you have paid for. It cannot be undone.
- If you were invited: use Delete my answers at the bottom of your report. This erases only your side — your name and your answers — and leaves the other person's own result alone.
- Your email address on its own: unsubscribe from any update we send, or write to us, and we will remove the address while leaving your result intact.
- Either way: email 028narim@gmail.com with your link and we will do it, normally within a few days and always within one month.
Records we must keep for tax and accounting — that a purchase happened, and its order identifier — are held by Polar as merchant of record for as long as the law requires, and are not deleted by the steps above.
7. Your rights
Depending on where you live you have the right to access, correct, delete, restrict, or object to our use of your information, to receive a copy of it in a portable form, and to withdraw consent. Email 028narim@gmail.com and we will answer within one month, free of charge. You may also complain to your local data protection authority; in Korea that is the Personal Information Protection Commission (PIPC), and in the UK the ICO.
California residents: we do not sell personal information, and we will not discriminate against you for exercising your rights. Advertising is the one place where “sharing” as the CPRA uses the word may apply: Google AdSense can use cookies to show ads based on your visits to this and other sites, which that law treats as sharing for cross-context behavioural advertising. You can stop it either by declining in the cookie banner where one is shown, by turning off personalised ads in Google’s Ad Settings, or by using any browser setting or extension that blocks it. Nothing about your answers, your report or your reading is ever part of it.
8. Storage in your browser
We store one item, attune:session, in your browser's local storage: your name, your answers, and the identifiers for your result. It is what lets you close the tab and come back to your report. It is strictly necessary for the feature, is not used for tracking or advertising, and never leaves your device except as part of the requests described above. Clearing your browser data removes it — and, if you have no other copy of your link, your route back to your report.
9. Analytics and advertising
PostHog runs on every page. It counts visits and the steps of the product — starting the quiz, reaching a report, opening an invite, starting a purchase — and may record how a page was used: clicks, scrolling, where a cursor hesitated. The landing page and these policy pages also load Google Analytics, which tells us how many people arrive and roughly where from, and Microsoft Clarity, which records page use the same way. We use all three to see which parts of the product lose people, not to identify you, and none of them is sent your name, your answers or your birth date.
PostHog and Clarity can replay a visit, so what they are allowed to see is limited on purpose: the questions, your answers, your report and your share card are masked in the page itself before anything is recorded. A replay shows that someone answered a question — never which answer, and never what their report said.
The secret in an invite link or a report link never reaches them. Those addresses open someone's answers, and these tools record the address of the page they run on. So Google Analytics, Clarity and ads do not load on those two pages at all, PostHog does not record sessions there, and PostHog removes the token or id from every address before anything is sent.
Google AdSense shows ads on the other pages. Google and its partners may use cookies to show ads based on your visits to this and other sites; you can turn off personalised ads in Google's Ad Settings, and Google explains how it uses this information at policies.google.com/technologies/partner-sites.
If you would rather not be counted or shown ads at all, any browser setting or extension that blocks these services works here; nothing about the quiz, the report, or a purchase depends on them.
In the EEA, the UK and Switzerland, none of this loads until you say yes. A banner asks first, and analytics and ads stay off unless you accept. The choice is kept in a cookie, attune_consent, for six months; a second cookie, attune_region, only records whether the banner applies to you.
10. Security
Traffic is encrypted in transit, database access is limited to our server-side code, and results are addressed by unguessable identifiers rather than sequential ones. No system is perfect; if we ever discover a breach affecting your information, we will notify you and the relevant authority as the law requires.
11. Children
Attune is for people 18 and over. We do not knowingly collect information from children. If you believe we hold a child's answers, write to us and we will delete them promptly.
12. Changes
Material changes are published here with a new version number and effective date. We record which version was in force when each result was created.
13. Contact
Attune — 028narim@gmail.com