Your inner universe should remain yours.
SunMoonSync is designed around minimal data, local-first calculations, and optional identity.
Last updated: 2026-10-27
About this notice and privacy contact
This notice applies to https://sunmoonsync.com. SunMoonSync is independently operated by an individual. Its operator determines the purposes and means of personal-data processing for this website and is the controller for those activities. The payment provider separately explains the payment, tax and fraud-prevention processing it determines. For a privacy request or complaint, email support@sunmoonsync.com with “Privacy request” or “Data protection complaint” in the subject. You do not need to buy anything to make a complaint.
The sections below distinguish essential services, features you choose, optional usage analytics and operational monitoring. Accepting the service terms does not consent to optional analytics. Birth information and text you submit can be private; provide only what a feature needs. Do not submit identity documents, payment credentials, health diagnoses, information about sex life or religious beliefs, or another person’s sensitive information.
Purposes and lawful bases (UK users)
Services you request — account authentication, attaching purchases to your account, restoring access, and cloud saves, report emails, online readings, recommendations and AI answers you request: we process the account information, inputs and results necessary for those operations under UK GDPR Article 6(1)(b) (performing our contract with you or taking steps you request before entering one). Merely viewing a page does not submit an optional feature. Without a feature’s required information we may be unable to provide it; available guest static content remains accessible.
Security, fault diagnosis and support — necessary authentication records, request status, error categories, duration, abuse-prevention information and messages you send support are processed under Article 6(1)(f) (legitimate interests). Those interests are protecting accounts and private content, preventing abuse and duplicate allowance charges, diagnosing and fixing failures, and answering user concerns. We limit the data and do not use these records for advertising targeting. Support necessary to deliver a service you request may also be part of performing that service.
Accounting and legal responsibilities — order, billing, tax or dispute records that applicable law requires us to retain are processed under Article 6(1)(c) (legal obligation). Other records necessary to deliver a purchase, resolve a dispute or establish or defend legal claims rely on Article 6(1)(b) or 6(1)(f), according to the purpose. We do not retain all personal content as tax records.
Optional product analytics — Google Analytics 4 (GA4) is used only after your opt-in under Article 6(1)(a) (consent). Refusing or withdrawing does not reduce purchased access or prevent core services. “Optional usage analytics” below explains the scope and how to withdraw.
Optional usage analytics and local preferences
Optional analytics is off by default. Google Analytics 4 is loaded and product events are sent only after you allow analytics, account resolution finishes, and the session is not identified as an operator or test account. Actions before consent are not queued for later sending. Analytics helps us understand page and feature use, entry-point clicks, funnel drop-off and usability problems; it is not used for personalized advertising, cross-site advertising profiles or session recording.
Allowed events contain preset page or feature names, interface language, broad device category, action stage, success or failure category and duration. We do not send names, email addresses, account IDs, birth dates, times or places, Sun–Moon combinations, conversation or journal text, private notes, friends’ details, order IDs or invitation tokens to GA4. Page names are sanitized rather than full URLs containing query strings, fragments or private identifiers. Google still receives technical information needed to establish the network connection; these statistics should not be treated as completely anonymous.
After consent, GA4 can use pseudonymous identifiers in cookies such as _ga to distinguish browsers and measure visits, rather than receiving our account IDs. GA4 user- and event-level data retention is set to 2 months, with reset on new activity disabled; aggregated reports are not subject to the same event-level retention limit. Browser cookies and event storage have different retention mechanisms.
Open “Privacy & analytics settings” on the website at any time to allow, reject or withdraw optional analytics. Withdrawal stops subsequent optional events and clears analytics cookies accessible to this website. It does not instantly erase records already sent to Google; contact support for an applicable deletion request. Your browser stores your privacy choice locally. Essential features use their own storage for sign-in sessions, language and local chart information and are not disabled when analytics is refused.
Necessary API operational monitoring
To determine whether services deliver successfully and diagnose timeouts, the browser can record preset API feature categories, status or error categories and processing duration. These new browser metrics follow the optional analytics consent and test-account exclusion settings above. Existing native server technical aggregates are separate and may include operator or test requests; they are not presented as business success rates with test traffic excluded. Refusing optional analytics does not disable necessary security or native fault diagnosis. Request bodies, model inputs and outputs, authentication tokens, emails, birth data and journal text are not included in these metrics. This does not imply that persistent server request logging is enabled.
Technical information for access, sign-in and films
To establish website, authentication or media connections, the relevant hosting and service providers receive necessary technical information such as IP address, browser or device information, request time, requested resource and response status for delivery, security and fault handling. This differs from optional GA4 product analytics: refusing GA4 does not prevent the connection itself or essential authentication. We do not infer your entered birthplace from your IP address or request device GPS permission merely because you open a page.
When you open the video studio, the playback request uses the current Sun–Moon combination and the server verifies the account and film entitlement. Authorized media links last 1 hour. The storage service receives network requests needed to play that resource, not your full birth date, birth time, conversations or notes. Temporary links and downloaded reports may be usable by people who obtain them, so do not publish or forward them. Link expiry does not itself delete the underlying film or report file.
AI conversations
When you send a question, its text, recent conversation and calculated Sun–Moon, BaZi and Human Design context are sent through our server to an AI service for a response. Missing chart facts remain unknown; companions and private notes are not included automatically. Your visible conversation history is saved on this device and can be cleared in the conversation settings. Do not enter identity documents, payment details or other sensitive information.
Our server also holds bounded temporary conversation tasks and results in memory, with a 30-minute reuse window after completion; persistent retry receipts contain hashes, request status and technical metadata rather than conversation text. AI providers still process the submitted text under their own applicable service terms. Clearing device history does not recall information already sent to them. Omitting your name does not make personal text or inferred characteristics anonymous; contact support about an applicable access or deletion request. This is not end-to-end encrypted messaging between you and another person.
Experiments and observations
Experiments and observations stay on this browser, separated by reading. Up to 24 experiments and 60 observations per experiment are retained. Nothing is sent to AI or synced automatically. Clearing chart data removes this notebook too. Action cards use selected goal, action and condition only after opt-in. Private observations enter a final report only when you select them; that same selected content appears in downloaded and emailed report files.
Report emails
Sending a final report is optional and requires signing in with a verified account email. Reports are sent only to that email address. Before sending, choose PDF, HTML or both and check the report content you selected, including birth details or personal additions. The selected report files are sent through our server and email service; a success notice means the email service accepted the request, not a guarantee that it reached your inbox. Downloading files does not send an email.
Birth data
The reading uses birth date, exact time, birthplace, coordinates, and UTC offset. The main calculation runs in your browser and is stored locally on this device. Automatic birthplace lookup sends only the entered place text through our server to Google Cloud Vertex AI and Google Search grounding to find geographic evidence and extract a location. Your name, birth date and birth time are not included in that lookup; location results are cached in bounded server memory without writing the raw query to our logs or durable storage. Prefer a city or locality rather than a private home address when it is sufficient.
AI synthesis in the Ultimate Guide
Reading the BaZi overview or entering final synthesis sends the birth details for that reading to our server for recalculation. The BaZi overview uses calculated BaZi facts and matching interpretations; final synthesis uses Sun–Moon, BaZi and Human Design facts. The relevant facts and interpretations are sent to an AI service, without your name, account, private notes or experiment notebook. Validated results are cached privately on the server; clearing the local chart does not remove that cache. Other classifications and reference passages use the local knowledge database and calculations.
Themed recommendations and custom requests
Opening a preset discovery theme retrieves existing recommendations and explanations from the Supabase content catalogue using the selected theme and your or the selected members’ Sun–Moon combinations. These catalogue requests do not include names or full birth dates and times, and reading a theme does not itself regenerate the catalogue with AI. A theme and combination may still be associated with other account or network information and should not be treated as completely anonymous.
Submitting a custom theme sends the topic, full requirements, conditions such as budget and time, and the selected participants’ nicknames, Sun–Moon combinations and source or uncertainty through our server to AI to generate options. It does not automatically include raw birth dates, birth times, private notes or your full conversation history. Use nicknames and include only what the request needs. Our server stores the task’s input and result so it can be reopened or recovered. Clearing your local chart does not delete these task records; contact support to request deletion.
Optional accounts
Guest visitors can calculate a chart and explore available static readings on this device. Purchases and account allowances require a verified account to attach access to the correct person. Report emails also require a verified email. Google sign-in uses your basic profile and email through our authentication service. Cloud reading storage is optional: choose Save to upload the selected reading; guest readings are never uploaded automatically.
Payments and account access
Payment availability is shown inside your signed-in account and secure checkout. Dodo Payments acts as merchant of record only for transactions actually completed through it, including checkout, payment, applicable taxes and billing. Checkout sends your account email and account/order identifiers needed to link the purchase. Your birth details, chart, conversations and private notes are not sent to Dodo Payments. Card details are entered on the payment provider’s hosted page and not stored by SunMoonSync. Purchases, order status and allowances are stored on our server and restored through your account after payment confirmation; browser data and return links cannot create a purchase.
Circles and information supplied by others
When you join a circle, the nickname, Sun–Moon signs, context and optional cultural information you submit are visible to joined members and used for the circle reading you request. If you use birth details to calculate the signs, the server processes the raw date, time and coordinates but does not retain them in the circle member record or show them to other members. Circle records and readings expire 14 days after creation and are removed through scheduled cleanup. Leaving removes your member record and invalidates the previous analysis; an owner’s circle deletion removes that circle.
An organizer can also enter a member profile with permission. That information comes from the organizer, not an automatic import from contacts, social websites or public databases. Use only authorized nicknames and signs, not someone else’s private background. We process limited information needed for the circle service requested by organizers and members: our service contract applies when a member joins themselves; necessary handling of organizer-supplied information relies on the legitimate interest in providing the limited circle service reasonably expected by those involved. A person can claim and correct their profile, leave, or contact support to request access or deletion or to object. An organizer’s checkbox does not replace consent legally required from another person.
Entertainment use
Astrology readings are for entertainment, reflection, and self-expression. They are not medical, legal, financial, psychological, or professional advice. Software calculates classifications from birth information and may generate interpretations, recommendations or circle scores from that context. We do not use these outputs to make solely automated decisions with legal or similarly significant effects, such as employment, credit or healthcare decisions. Do not use them to make such decisions about yourself or others.
Sharing
Friend cards do not use your private notes. Two-sided and confidant cards require your confirmation before image creation or export. Birth details and names are not automatically included; please check anything you type yourself. Images are prepared on your device, not published to a public gallery.
Control and retention
Your situation feedback, support preference and personal note stay in device-local storage, not in an AI prompt or automatic cloud backup. Clearing local chart data removes these additions but does not delete a reading you deliberately saved to your account. Emailed report files use private storage with download links valid for 24 hours; expired files are removed by scheduled cleanup. For account or cloud-data deletion requests, contact support@sunmoonsync.com from your account email so ownership can be verified. Clearing local data does not delete your account or cloud data, or cancel renewal.
Birth dates, age and children’s information
Birth dates are used to calculate a chart, not to verify identity or age. This website currently does not verify actual age through identity documents, facial recognition or parental identity checks. An entered chart date or account status is not verified adulthood. Review the service terms on legal capacity to use and purchase, or guardian consent where required, before providing your own or another person’s information.
Do not submit a child’s private experiences, contact details or sensitive information in a circle or question. Contact support@sunmoonsync.com if someone supplied your information or that of a person in your care, or if you have a concern about children’s information. After checking appropriate authority, we will assess access, correction, objection or deletion requests. Do not send identity documents to prove age or guardianship without first discussing a proportionate verification method with us.
Service providers and international processing
We use Supabase for authentication, optional cloud saves, content catalogue retrieval and private report and film storage; Cloudflare for hosting, backend services and email delivery; and Google Cloud for online generation and place lookup. These services receive the data needed for the selected feature and may process it outside your country. Google sign-in requests a basic profile and email, not access to your inbox or contacts.
If you allow analytics, Google also receives the limited events and connection-related technical information described above as the GA4 service provider. Providers’ data centres, support or subprocessors may involve processing outside the UK; using a well-known cloud provider does not itself authorize an international transfer. Contact support for processing-location details, applicable contractual safeguards and copies of available safeguard documents for the features you use. We do not represent an unverified location, UK adequacy decision, IDTA or UK Addendum as an established safeguard.
Current Google Cloud online generation uses the global endpoint; it does not guarantee processing only in the UK, EU or one specified country. Hosting, authentication, storage, email and analytics may also involve providers and subprocessors in multiple locations. The links below provide providers’ public data-processing and transfer resources for their general terms. A link is not proof that this account has executed a particular addendum, completed a transfer assessment or configured a regional restriction. Applicable safeguards depend on the actual service agreement, configuration and processing activity; contact support for details.
When you use checkout, the payment service independently handles payment, fraud-prevention, tax and billing data under its privacy policy. SunMoonSync does not submit birth data, notes or chat text as checkout data. Visiting the pricing page alone does not submit a purchase request to Dodo Payments.
Supabase data-processing and transfer resources
Data rights and necessary retention
Subject to applicable law, you can request access, correction, export or deletion of your account and cloud data, or restriction of processing, by emailing support@sunmoonsync.com from your account email. After verifying ownership, we will handle the request within applicable legal deadlines or explain any limitation. Records needed for billing, tax, fraud prevention or disputes may be retained where legally required; account deletion does not erase records we must lawfully retain.
Local records remain in your browser until you clear them or your browser removes them, subject to each feature’s item limits. Cloud readings you choose to save remain until you delete them or request deletion. Report links last 24 hours and files are removed by scheduled cleanup; circle records expire 14 days after creation. Private generation caches are retained as needed to reopen and provide completed results. Retention of security, fault and support records depends on whether an issue is resolved, continued needs to protect accounts or handle disputes, and applicable legal periods; there is no blanket rule to keep everything forever. Contact us to identify and request deletion of records that can be associated with you.
Custom-theme tasks can be reopened for 14 days after creation; an expired task is rejected and removed when next accessed. This expiry is not a guarantee that all related storage is erased at that instant: retry receipts, diagnostic records or backups may have different retention arrangements. To request earlier deletion or check related records, identify the feature and approximate time without repeating private content in the request. We will check identifiable records and any applicable reason for retention.
Right to object: you can object, on grounds relating to your particular situation, to processing based on legitimate interests. Describe the processing to support@sunmoonsync.com. We will assess and stop it unless compelling legitimate grounds override your interests, rights and freedoms, or it is necessary to establish, exercise or defend legal claims. You can instead withdraw consent to optional analytics directly in “Privacy & analytics settings” at any time without giving a reason. Withdrawal does not affect lawful processing before withdrawal.
UK users can make a data protection complaint to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/. You may also complain to us first; we will investigate, respond and explain the outcome. This does not limit your right to complain to the ICO or seek another remedy. Data-rights requests normally receive a response within one month; a lawful extension for complexity will be explained. Complaints and data-rights requests are different processes. Complaints will be acknowledged within applicable deadlines and investigated without undue delay; contacting support does not prevent a regulatory complaint.
Notice updates and new purposes
The last-updated date appears on this page. If purposes, recipients or your choices change materially, we will update this notice and, where applicable, provide further notice through the website or account contact details. Updating this notice, your continued browsing or earlier acceptance of service terms does not itself provide consent for a new purpose that requires it.