Privacy Policy
Last Updated: October 13, 2026
1. Introduction
This Privacy Policy explains how G Wright Enterprises LLC ("we," "us," or "our"), operating as Cosmic Array, collects, uses, and protects your personal data when you use our website at cosmicarray.io or the Cosmic Array iOS app (together, "the Service").
We are committed to protecting your privacy. Because our server is located in Germany, the EU General Data Protection Regulation (GDPR) and the German Telecommunications-Telemedia Data Protection Act (TTDSG) apply as our baseline compliance framework.
2. Data Controller
G Wright Enterprises LLC DBA Cosmic Array 13027 Victory Blvd, Suite 412 Los Angeles, CA 91606, United States of America Server Location: Germany
Email: [email protected] You may also contact us via our Support page.
3. Data We Collect
A. Birth Data (Provided by You)
- Full name, date of birth, time of birth, and location of birth
- Pronouns (optional, used only for report phrasing)
- Eye color and blood type (optional)
- We find your birth place's coordinates and time zone in a place list stored on our own server, so your birth place is not sent to any other service for this lookup.
B. Biometric Data (Provided by You)
- Palm photographs for palmistry analysis (Alchemist tier and above)
C. Oracle Questions (Provided by You)
- Questions you ask the Oracle (our AI chat), together with a summary of your chart so it can answer about you
D. Beta and Premier Programs
- If you redeem a Beta or Premier invite code: your name and email address
- If you send feedback as a beta tester: your message, the page you sent it from, and your browser information
E. Email List
- If you sign up for the Cosmic Array letter (the 2027 forecast and a monthly email): your email address, which page you signed up on, and when you signed up and confirmed. We don't ask for your name or birth details, and the list is kept apart from everything else. Emails are sent through Cloudflare's email service, which receives your address to deliver them.
F. Payment Data
- Website: payment method details, email address, and billing information are collected directly by Stripe. We never receive or store your full credit card number. Stripe passes us your email address, which we use to send you your access key and keep with a record of the purchase.
- iOS app: purchases are processed by Apple. We receive a transaction identifier to verify the purchase, but not your name, email address, or payment details.
G. Device and Browser Information
- Our web server log records a shortened IP address with the last part removed, your browser's user agent string (browser, operating system, and device type), the page requested, and the referring page. Our API does not keep a log of ordinary requests.
- If our web server hits an error while handling your request, its error log can record your full IP address.
- Our security log records a shortened IP address with the last part removed and your browser family (for example, "Firefox/Windows").
- If the website hits an error in your browser, it sends us the error message, the page address, and your browser's user agent string.
- With your consent only: anonymous usage analytics via PostHog and Cloudflare Web Analytics. This covers pages viewed, approximate location, device type, the site that referred you, and actions such as generating a blueprint (with its tier), starting a checkout or completing a purchase (tier and plan), sharing a card (platform), asking the Oracle a question, joining the Beta or Premier program, or signing up for the email list (with the page you signed up on). These records never include your birth details, name, email address, or what you ask the Oracle, and we remove payment session IDs and the codes in email list links from page addresses before they are sent.
4. How We Use Your Data
| Purpose | Data Used | Legal Basis (GDPR Art. 6) |
|---|---|---|
| Blueprint generation | Birth data, palm photos, name | Consent (Art. 6(1)(a)) |
| Oracle answers | Your question and chart summary | Consent (Art. 6(1)(a)) |
| Payment processing and access keys | Payment details via Stripe or Apple; email (website) | Contract performance (Art. 6(1)(b)) |
| Beta and Premier programs | Name, email, beta feedback | Contract performance (Art. 6(1)(b)) |
| Email list (forecast and monthly letter) | Email address, signup page and dates | Consent (Art. 6(1)(a)) |
| Site security, abuse prevention & error fixing | Shortened IP address, device info, error reports | Legitimate interest (Art. 6(1)(f)) |
| Analytics & improvement | Aggregated usage data | Consent (Art. 6(1)(a)) |
5. Biometric Data (Palmistry)
Your palm photographs are processed in temporary server memory and sent to Google's Gemini AI service to generate your palmistry analysis. We do not store palm images. They are deleted from our server's memory immediately after your analysis is generated. No biometric templates or fingerprints are derived or retained.
6. The Oracle (AI Chat)
When you ask the Oracle a question, your question and a summary of your chart are sent to Google's Gemini AI service to generate the answer. Each question is processed on its own: we do not store your questions or the answers, and no conversation history is kept on our servers or shared between users. On the website and in the iOS app, the conversation is shown on screen only and is not saved.
7. Data Retention
- Birth data, palm images, and Oracle questions: Not stored. Processed in real time and discarded.
- Access keys: We keep a key identifier with its tier, remaining Oracle credits, and activation status. This contains no name or email address and is deleted when the key expires (30 days). Premier keys never expire, so their record is kept until you ask us to delete it.
- Website purchases: For each Stripe checkout and each monthly subscription renewal we keep the checkout or invoice ID, your email address, the tier and credits bought, and when the purchase was completed. The access key itself is removed from this record after 24 hours. The rest of the record has no automatic deletion date. Stripe keeps its own payment records (Stripe's Privacy Policy).
- iOS purchases: We keep the Apple transaction identifier so the same purchase can't be redeemed twice. It has no automatic deletion date. Apple keeps its own payment records (Apple's Privacy Policy).
- Beta and Premier members: Name, email address, access key identifier, and signup time, kept while the program is active or until you ask us to delete them. Invite code records also note the email address that redeemed each code.
- Email list: A signup you don't confirm is deleted after 7 days. A confirmed address is kept until you unsubscribe. Every email has an unsubscribe link, and unsubscribing deletes your address right away. You can also email us to be removed.
- Beta feedback: Kept until we delete it. It has no automatic deletion date.
- Web server logs: Access logs, which store shortened IP addresses, are deleted after 14 days. Error logs, which can include a full IP address when a request fails, are also deleted after 14 days.
- Application logs: Our API and website logs record errors and service events, not ordinary requests or IP addresses. They are deleted after 30 days, as are our daily security summaries, which contain only shortened IP addresses.
- Security log: Events such as failed sign-ins, invite code redemptions, Beta and Premier signups (including the name and email address used), a failed attempt to email your access key (including the email address), and browser error reports. Every entry stores a shortened IP address and your browser family, never your full IP address or full user agent string. The log is kept in size-limited files that are overwritten only once they fill, which at our current volume means it has no practical time limit.
- Backups: Encrypted nightly copies of the purchase, access key, Beta and Premier, feedback, and email list records above are kept for up to 6 months. Backups never contain birth data, palm images, or Oracle questions. Backups made before 12 October 2026 also contain an older security log file with full IP addresses from February 2026; those backups expire by April 2027.
- On your device: The website stores your cookie consent choice, your access key, your tier, and your remaining credits in your browser's local storage. Your consent choice is kept for 12 months, and then we ask again. The other items stay until you clear your browser's site data. The iOS app stores your saved readings, your access key and credits, and whether you have finished the introduction, on your device only. They are removed when you delete the app, and you can clear saved readings in the app.
8. Third-Party Processors & International Data Transfers
To provide the Service, we share specific data with the following third-party processors:
| Processor | Purpose | Location | Transfer Mechanism |
|---|---|---|---|
| Stripe | Website payment processing | United States | EU-US Data Privacy Framework |
| Apple | iOS app purchases | United States | EU-US Data Privacy Framework |
| AI processing (Gemini) for reports, palmistry, and the Oracle; backup email delivery (Gmail) | United States | EU-US Data Privacy Framework | |
| Cloudflare | CDN, DDoS protection, bot management, cookieless web analytics (with consent), email delivery | Global | Standard Contractual Clauses |
| PostHog | Usage analytics (with consent only) | United States | EU-US Data Privacy Framework |
| Hetzner Online | Server hosting | Germany | Within the EU |
| Backblaze | Encrypted backups | United States | Standard Contractual Clauses |
These providers handle your data under their service terms. EU-to-US data transfers rely on the EU-US Data Privacy Framework and, where applicable, Standard Contractual Clauses (SCCs).
We do not sell your data to advertisers or any third parties.
9. Cookies
We use essential cookies to operate the Service and, with your consent, analytics cookies to improve it. For full details, see our Cookies Policy.
10. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the following rights:
- Right of Access (Art. 15): Request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): Request correction of inaccurate personal data.
- Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
- Right to Restriction (Art. 18): Request that we restrict the processing of your data.
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests.
- Right to Withdraw Consent (Art. 7(3)): Withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
- Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For Germany, this is the Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) or your relevant state data protection authority. You may also contact any EU Data Protection Authority in your country of residence.
To exercise any of these rights, contact us via our Support page.
We do not store birth data, palm images, or Oracle questions. If you bought on the website, joined the Beta or Premier program, sent beta feedback, or contacted us by email, we will provide or delete the records we hold about you. Our logs store only shortened IP addresses, which we cannot link back to you. The exception is web server error logs, which are deleted after 14 days. Deleted records are removed from backups as those backups expire (within 6 months).
11. Your Rights Under CCPA (California Residents)
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected.
- Right to Delete: You may request deletion of your personal information.
- Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is necessary.
- Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.
12. Children's Privacy
Cosmic Array is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately.
13. Security
We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), Cloudflare DDoS protection, secure server infrastructure located in Germany, and encrypted backups.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last Updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.
15. Contact Us
For any privacy-related questions or to exercise your data rights, please reach out through our Support page.