Privacy Policy

Last updated: 5 November 2026

NEBO is an astrology app. This page explains what personal data we process, why, on what legal basis, for how long, and what your rights are. In short: we store what you enter into your own worlds, we count usage with simple statistics (in Europe without storing anything on your device), and you can delete everything with one button.

Who is responsible (controller)

Controller: NEBO LABS LLC, Lviv, Ukraine, company code 46483499 · email: hello@neboastrology.com. You can also reach us through “Contact us” in the app.

See also the Impressum (legal notice) and the Terms of Use. We have not appointed a data protection officer.

What we collect

What you enter. For you and for the people you add to your worlds: a name, gender (optional), date, time and city of birth (with its coordinates and time zone), and the names of your worlds. Diary entries if you use the diary. This is needed to calculate the charts.
Your account. When you create a world, we create an account for it: a random ID and a random device key for each device (we store only a hash of the key). We also store the interface language you use (only the language code, such as “en”), so we know which languages are used and can help you in your language. Not if you are under 13: then nothing you enter is stored on our servers (see “Children”).
Days of use. We record the days (the date only, no time) on which your account was used, at most once a day, to count how many people come back. We also use them to ask you once what we should improve, when your account has been used on 4 or more days; for this we store only whether and when that question was shown or answered (if you close it without answering, we ask once more 15 days later, then never again). The record is tied to your account ID, is not shared with anyone and is deleted with your account. It is also included in “Download my data”.
If you sign up or sign in. This is optional; it lets you open your worlds on other devices.
- Email and password: your email address and your password as a salted PBKDF2 hash. We never store or see the password itself.
- Code by email: your email address and, for up to 10 minutes, a hash of the one-time code we send you, plus how many times a wrong code was entered.
- Google: the ID of your Google account and, if Google has verified it, your email address. We save that email on your account as its sign-in email (so you can also sign in with a code, and so we can write to you about your account), show it in “Download my data” and delete it with your account. We don't keep your Google name or photo, and we don't get your Google password, contacts or anything else from your Google account.
Notifications. If you turn on daily notifications: the push address of your browser or app (a Firebase Cloud Messaging token in the mobile app), whose chart to use (a person ID or the birth data you entered), the hour and time zone, the language and the kinds of notifications.
Invite links. If you create a link that invites someone into one of your worlds: a random code, the world and its name, your name as shown on the invite, how many people joined and when the link expires (it works for 90 days). If someone joins through a link, the name, gender (optional), birth date, time and city they enter are added to the inviter’s world, and the inviter is added to theirs; we also note that the two accounts are connected, so that each card can be removed from the other account when one of them is deleted.
“Your 2027” PDF by email. If you ask us to email you the “Your 2027” PDF: your email address, the name, birth date and zodiac sign of the person the report is for (not the birth time or city), the app language, your country as reported by our hosting provider, whether that person is under 18, your account ID or your browser’s visitor ID (if you have one), and whether the email was sent. We keep this to send you the file. Only if you tick “Send me NEBO offers and news” under the email field (it is never ticked for you) do we also write to you about NEBO news and offers now and then, at any age from 13; every such email has an unsubscribe link. If you are signed in, that tick also turns on “NEBO offers and news” in Settings. Without the tick we use your email only to send the file. Under 13 this option is off (you can save the PDF on your device instead). To make the PDF, our server opens your report once in Cloudflare’s browser service; the birth data for that report is passed only in that link and is not stored.
Offers and news by email - only if you say yes. If you tick “Send me NEBO offers and news” when you sign in or create an account, or turn on “NEBO offers and news” in Settings, we may email you about new worlds and sections and about NEBO offers, including paid ones, at most twice a month. The box is never ticked for you. We store your choice (yes or no), where you made it (Google sign-in, email sign-up, Settings or an unsubscribe link), when, and when the last email went out, until you delete your account. If you ask to be notified when a world is added, we store the name of that world with your push address, the language of the message, and when you asked, until the notification is sent or for 18 months at most.
Person search. If you search for a famous person who is not in our list, the text you type and the app language go to our server, which looks it up on Wikipedia (search in the app language and in English) and Wikidata. If you then add a person found this way, we only count how often that person was added (the person’s Wikidata ID, name and the count), without recording who added them.
Feedback. If you write to us through “Contact us”: your message, the tab, language and device type (phone or computer), a random message ID so that a resent message is not saved twice, and your country and city as reported by our hosting provider. The form has no contact field: if you want an answer, write your contact into the message yourself. Not available for users under 13. The same applies to answers to our one-time question “What should we fix first?”, together with the options you tapped; such answers are marked as coming from that question.
Usage analytics. Which tabs are opened, how long they stay on screen, how far they are scrolled, which buttons are pressed, errors on the page, language, device type (phone, tablet or computer), screen size, the site you came from and, on the first visit only, the campaign tag in the link (such as utm_source) and the app you opened it from (such as TikTok or Instagram), and your country as reported by our hosting provider from your connection. In the EU/EEA, the UK and Switzerland nothing is stored on your device for analytics: the visit gets a random ID that lives only in the open page and disappears when you close or reload it, and your city is not stored with your visit: we only count visits per city per day as a plain number (day, country, city and the count), not linked to you, your visit or your device; cities with fewer than 3 visits on a day are deleted. Elsewhere (and in Europe only if you agreed to it in an earlier version of NEBO) a random visitor ID is kept in your browser so we can see returning visits, and the city is recorded as well. Everywhere, when a visit starts, the page checks whether you have already saved a profile or people in NEBO in this browser and sends only how long ago the first one was saved, as a range (today, 1 day, 2-6, 7-29 or 30+ days), so we can count returning visits without any ID. We never record what you type, and we do not store IP addresses.
Speed metrics. On about 30% of page loads the page sends one anonymous measurement of how fast it loaded: the hour (without minutes), the site, the section (first part of the address), your country as reported by our hosting provider, the connection type (for example 3g or 4g), whether data saver is on, whether the page was opened inside another app (such as TikTok or Instagram), the language, loading times and which link brought you here (for example TikTok). It also includes rough device information, so we can see which phones NEBO is slow on and fix them: the device model where the browser reports it (on iPhone and iPad we only see the screen size and sharpness, which tells us the model family), the operating system and browser with their main version only (for example iOS 17, Chrome 129), the window size, and the approximate memory and number of processor cores the browser reports. No ID, no IP address, no full browser identifier (user agent), nothing is stored on your device. Not sent if you have turned analytics off.
Error reports. If the page hits a script error, it sends up to five error counters per page load: the hour, the site, the section, the kind of error, a cleaned error message (without addresses, numbers or quoted text), the code position, the app version, the browser family, whether it was opened inside another app, the language and a count. No ID, no IP address. Not sent if you have turned analytics off.
On your device. Your worlds, people, settings and language are kept in your browser’s storage so the app works offline and opens where you left off. Outside the EU/EEA, the UK and Switzerland we also keep a simple visit counter there, used only to decide when to suggest adding NEBO to your home screen; it never leaves your device. Under the same conditions we keep there the number of days you visited NEBO without an account, the date of the last one and whether our one-time question “What should we fix first?” was shown, so that we only ask people who keep coming back; this also never leaves your device.
Security. To stop abuse we count requests per connection for a short time window, storing only a salted hash of the IP address.
Server logs. Our hosting provider Cloudflare processes your IP address and technical request data to deliver the site and protect it from attacks.

Purposes and legal bases

Calculating and showing your charts, saving your worlds, accounts and sign-in, notifications you turn on, answering feedback: Art. 6(1)(b) GDPR (providing the service you asked for).
Sending the “Your 2027” PDF you asked for: Art. 6(1)(b) GDPR. NEBO news and offers to people who ticked the box: Art. 6(1)(a) GDPR (your consent), which you can withdraw at any time, free of charge, with the unsubscribe link in every email.
Offers and news emails: Art. 6(1)(a) GDPR (your consent). You can withdraw it at any time, free of charge, in Settings or with the unsubscribe link in every email; this doesn't affect emails already sent. Notifications about a world you asked for: Art. 6(1)(a) GDPR (you turned them on).
Usage analytics (visits and in-app events), Cloudflare Web Analytics, speed metrics and error reports: Art. 6(1)(f) GDPR (legitimate interest in understanding which parts of NEBO are used, how fast it loads and fixing errors). In Europe no information is stored on your device for this purpose and no visitor ID is used; at the start of a visit the page only checks whether a profile is already saved in NEBO in your browser and how many days ago (as a range, see above), and nothing else is read or sent; where a visitor ID was stored earlier with your consent, Art. 6(1)(a) GDPR applies. You can object at any time - see “Your rights” below.
Security, rate limiting, bot protection (Turnstile) and server logs: Art. 6(1)(f) GDPR (our legitimate interest in a secure and working service). Data you store only for the app to work (your worlds, language, settings) stays in your browser as strictly necessary storage (§ 25(2) TDDDG).

Who else processes data

Cloudflare, Inc. (Pages, Workers, D1 database): hosts the site, the functions and the database. Cloudflare Turnstile: an invisible check that helps us stop bots when an account is created or a sign-in or sign-up code is requested by email. Its script is loaded from Cloudflare only at that moment. Cloudflare Web Analytics: cookieless statistics on page views and loading speed, run by Cloudflare as our hosting provider. Its script is loaded from Cloudflare and sends Cloudflare the page address, the site you came from, browser data and loading times; it stores nothing on your device.
Open-Meteo (geocoding): receives the text you type when searching for a birth city, to find its coordinates and time zone. Your browser contacts it directly.
Open-Meteo (weather forecast and weather archive): to show today's weather and the weather on a birth day, your browser sends it the coordinates of the city and, for the archive, the birth date. It sees your IP address, but no name.
Wikimedia Commons (Wikimedia Foundation, Inc.): the source of celebrity photos. Your browser loads them from our own domain; our server (Cloudflare) fetches and caches them, so Wikimedia does not see your IP address.
Wikipedia and Wikidata (Wikimedia Foundation, Inc.): when you search for a famous person who is not in our list, our server sends the search text and the app language to the Wikipedia search (in the app language and in English) and to Wikidata. Wikipedia and Wikidata do not see your IP address.
Wikipedia API (Wikimedia Foundation, Inc.): for “what happened on this day” your browser asks Wikipedia for a day, month and year (today's date or a birth date). It sees your IP address, but no name.
Google: confirms who you are if you choose to sign in with Google. If Google sign-in is available, the Google sign-in button is loaded from Google when you open the sign-in window (not before), so Google receives your IP address and browser data at that moment, under Google’s own privacy policy; Firebase Cloud Messaging delivers notifications in the mobile app. In the browser, notifications go through your browser vendor's push service.
Resend, Inc. (email processor, EU region): delivers the emails with sign-in and sign-up codes and the “Your 2027” PDF emails. It receives your email address and the content of the email (including the PDF).
Cloudflare Browser Rendering (Cloudflare, Inc.): turns your “Your 2027” report into a PDF when you ask for it by email. It opens the report page once and keeps nothing.
Fonts are served from our own server; no font service is contacted.

Some of these providers are located in the USA. Transfers are based on the EU-U.S. Data Privacy Framework where the provider is certified, or on the EU standard contractual clauses (Art. 45, 46 GDPR). We don't sell data, we don't show ads, and we don't share your worlds with anyone.

How long we keep it

Worlds, people, diary and account (including email address, password hash and Google link): until you delete them.
Sign-in codes: 10 minutes, deleted once used.
Notification subscriptions: until you turn notifications off or the push address stops working.
Analytics (visits, events and daily visit counts per city): up to 18 months, then deleted automatically.
Speed metrics: 90 days. Error reports: 30 days. Then deleted automatically.
Invite links: they work for 90 days; the invite record and the connection between accounts that joined are kept until one of the accounts is deleted.
Backups: our database provider keeps a point-in-time history of the database (Cloudflare D1 Time Travel) for up to 30 days, so deleted data disappears from it within 30 days.
Feedback: up to 12 months, then deleted automatically.
“Your 2027” PDF requests: until you delete your data (see below) or ask us to. If you unsubscribe, we stop the update emails and keep only a scrambled (hashed) copy of your email address, so we know not to write to it again.
Rate-limit counters: a few minutes to one hour.

Your choices and rights

Delete everything: under your world, press “Delete account and data”. This deletes your account, worlds, people, email address, password hash, Google link and devices from our servers (and your card from the worlds of people you are connected with through invite links), together with the in-app events recorded under your browser’s visitor ID and your “Your 2027” PDF email requests, and clears all of it from your browser as well. In the EU/EEA, the UK and Switzerland the statistics are not linked to your browser or account at all, so there is nothing we could single out; they are deleted automatically after 18 months.
Stop offers and news emails: press “Unsubscribe” at the bottom of any NEBO email (no sign-in needed; the “Unsubscribe” button of your mail app works too), or turn off “NEBO offers and news” in Settings. Without an account, “Delete my data” also erases the “Your 2027” PDF requests made from this browser.
Download your data: in the account window, press “Download my data” to get a file with your worlds, people and diary (Art. 15 and 20 GDPR).
Sign out: in the account window, press “Sign out”. This forgets only the current device; your worlds stay in your account.
Object to analytics at any time, with effect for the future: You can also switch analytics off by opening this link.
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21). Write to us through “Contact us” in the app or by email at hello@neboastrology.com.
You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the EU member state where you live or work.
United Kingdom: if you live in the UK, the UK GDPR and the Data Protection Act 2018 give you the same rights, and you can complain to the Information Commissioner’s Office (ICO), ico.org.uk.

California residents (CCPA/CPRA)

We don’t sell or share your personal information - not for money, not for cross-context behavioral advertising. We show no ads.
The categories we collect are listed under “What we collect” above: identifiers (account ID, email if you sign up), the birth data you enter, and internet activity inside NEBO (usage analytics). We use them only for the purposes listed above.
You have the right to know what we hold about you, to delete it and to correct it, and we won’t treat you differently for using these rights. You can download your data and delete everything yourself in the account window (“Download my data”, “Delete account and data”), or write to us through “Contact us” in the app. We may need to confirm the request comes from you.

Children

NEBO is open to all ages. We don’t ask your age separately: we use the birth date you enter only to calculate the chart and to apply age rules. A kids mode turns on automatically for people under 13: it hides romance, dating and other mature content.

Under 13: nothing you enter is stored on our servers. If the birth date in your own profile (or the one you type on the start screen) shows that you are under 13, you, your people, worlds, settings and diary are kept only in this browser’s storage. For you the app does not create an account and does not sync; sign-up and sign-in are switched off; invite links can’t be created or accepted; notifications and the feedback form are not available; and no in-app usage events with a visitor ID are sent. What still reaches our server carries no ID and is the same for everyone: the visit counter (for under-13s without the city), speed metrics and error reports, a search for a famous person who is not in our list (the text is passed on to Wikidata; the answer is cached without anything that links it to you) with the anonymous count when such a person is added, and the short-lived hashed rate-limit counters. Services your browser contacts directly (city search, weather, “on this day”, Cloudflare Web Analytics) work as described in “Who else processes data”. Before a birth date is entered the app can’t know your age, so the first screens of a visit may already be counted in the usage analytics. If an account already exists when your profile is or becomes under 13, the app stops syncing at once and copies the account’s worlds, people and diary into this browser. An account without a sign-in is then deleted from our servers with everything linked to it (the same as “Delete account and data”), and the app tells you so. An account with a sign-in (email and password, email code or Google) is never deleted without asking: the app offers to fix the birth date or to delete the data from the server, and until you choose it uploads nothing and asks again on your next visit. If you clear this browser’s data, everything is gone: there is no copy on our side.

“Your 2027” PDF by email: not available under 13. From 13 we use the email address only to send the file you asked for, unless you tick the box for NEBO offers and news; you can unsubscribe any time.

Offers and news by email: anyone with an account (13 or older) can tick “Send me NEBO offers and news” or turn it on in Settings, including people under 18. It is never on by default, and you can unsubscribe any time with one tap in any email or in Settings.

If you are under 16 in the European Union, a parent or guardian should agree before you create an account (under 13 no account is created at all, see above). Parents can ask us to export or delete a child’s data at any time - write to us and we will do it.

Changes

If this policy changes in an important way, we will show a notice in the app. See also the Terms of Use.