1. Introduction

The Realm of Patterns ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

2. Privacy-First Architecture

We use a privacy by design approach with advanced cryptographic techniques to protect your data. Our system is designed so that even we cannot read your personal information.

2.1 Local-First Storage

By default, your birth data stays on your device only. It is stored in your browser's local storage and never transmitted to our servers unless you explicitly enable sync.

2.2 Encryption

If you choose to sync your data, it is encrypted using AES-256-GCM encryption before leaving your device. The encryption key is derived from your device ID using PBKDF2 with 100,000 iterations. This means only your device can decrypt your data.

2.3 Pseudonymization

Your identity is represented by a SHA-256 hash of your device ID plus a server secret. This hash cannot be reversed to identify you. We separate your encrypted identity from your astrological data - so we can analyze patterns without knowing who you are.

2.4 Data Separation

Encrypted Vault: Your birth data (encrypted, we cannot read it)
Astrology Data: Check-ins, vectors, stages (contains no personal information)

3. Information We Collect

3.1 Information You Provide

Birth Data: Date, time, and location of birth - stored on your device only, encrypted if synced
Check-in Responses: Your answers to the daily check-in - linked only by anonymous hash
Email Address: Only if you subscribe - encrypted in our vault
Payment Information: Processed by Stripe; we never see or store card numbers

3.2 Information Collected Automatically

Device ID: A random UUID generated on your device, used for sync
Country Code: For language preferences (not stored with your profile)
Aggregated Analytics: Anonymous usage patterns (no individual tracking)

3.3 What We DON'T Collect

Your name (unless you tell us)
Your exact location or GPS coordinates
Your IP address (beyond the current request)
Your browsing history
Data from other apps or websites

4. How We Use Your Information

Calculate your energy profile
Provide personalized readings and recommendations
Track your pattern over time (history feature)
Process payments and manage subscriptions
Send service-related communications
Improve our services through aggregated analytics
Prevent fraud and ensure security

5. Data Sharing

We do not sell your personal data. We share information only in these limited circumstances:

Service Providers: Stripe (payments), Cloudflare (hosting), necessary third parties
Legal Requirements: When required by law or to protect rights
Business Transfers: In connection with mergers or acquisitions
With Your Consent: When you explicitly agree to sharing

6. Circle (Team) Features

If you join a Circle, certain pattern data may be visible to other Circle members as part of the shared dashboard feature. You can control what is shared through your privacy settings. Circle facilitators can see aggregated coherence metrics but not individual check-in responses unless you choose to share them.

7. Data Storage and Security

Encryption at Rest: All personal data encrypted with AES-256-GCM
Encryption in Transit: HTTPS for all data transmission
Zero-Knowledge: Your birth data is encrypted with a key only your device has
Pseudonymization: Your identity is a one-way hash we cannot reverse
Data Separation: Personal info separated from analytics data
Cloudflare Infrastructure: Enterprise-grade security and global distribution

8. Data Retention

We retain your data as long as your account is active or as needed to provide services. After account deletion, we retain data for up to 30 days for backup purposes, then permanently delete it. Aggregated, anonymized data may be retained indefinitely for research and improvement.

9. Your Rights (GDPR)

We honor GDPR rights for all users worldwide, not just EU residents:

Right to Access (Art. 15): View all data we have about you
Right to Portability (Art. 20): Export your data in JSON format
Right to Rectification (Art. 16): Update your birth data anytime
Right to Erasure (Art. 17): Permanently delete all your data
Right to Object: Opt out of any processing

To exercise these rights, visit Settings or email [email protected]. We respond within 30 days (usually much faster).

10. Cookies and Local Storage

We use:

Essential cookies: For authentication and security
Local storage: For preferences, mode selection, and offline functionality
Analytics: To understand usage patterns (can be disabled)

11. Children's Privacy

Our services are not intended for users under 13. We do not knowingly collect data from children. If we learn we have collected data from a child under 13, we will delete it promptly.

12. International Users

Our services are hosted globally via Cloudflare. By using our services, you consent to the transfer of your data to servers that may be located outside your country of residence.

13. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or prominent notice on our website. Continued use after changes constitutes acceptance.

14. Contact Us

For privacy-related questions or to exercise your rights, contact us at:

Email: [email protected]