Privacy Policy — Skylight
These documents are final and take effect when Skylight is publicly released on the App Store. The app is currently in final testing, and a small number of features described here are still being completed.
1. In short
Skylight generates astrology readings from the birth details you enter. To do that, it sends those details and your question to Anthropic, the company that operates the Claude AI model, which is based in the United States.
We do not run a database. Your birth details, your questions, your chart, the people you add, and the readings you receive are stored only on your device. Our server passes your request to Anthropic and returns the answer. It keeps nothing.
We do not use analytics tools, advertising tools, or tracking software. We do not sell your data. We do not build a profile of you.
This summary is for orientation. The sections below are the operative terms.
2. Who we are
The controller of your personal data is:
EEA MEDIA (eenmanszaak)
De Skatting 14
8621 BW Heeg
The Netherlands
Chamber of Commerce (KvK) number: 93005520
Contact for all privacy matters: support@skylight-app.org
We are established in the Netherlands, so our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens. We have not appointed a Data Protection Officer; we are not required to.
Throughout this policy, "Skylight", "we", "us" and "our" refer to EEA MEDIA. "You" refers to the person using the app.
3. What we collect, and what happens to it
3.1 Birth details
What: Date of birth, time of birth, place of birth, and the geographic coordinates derived from that place.
Where it goes: Stored on your device. Transmitted to Anthropic when you request a reading, so that Claude can interpret your chart.
Where it does not go: Our server does not store it. There is no database, no backup, and no log containing it.
3.2 Your name and the names of people you add
What: The name you enter for yourself, and the names, relationship labels and birth details of anyone you add in the People section.
Where it goes: All of it is stored on your device. The name you enter for yourself is never transmitted anywhere — it stays on your device. The name, relationship label and birth details of a saved person are transmitted to Anthropic when, and only when, you request a reading that involves that person.
Where it does not go: Our server does not store any of it. We never see a list of the people you have added.
3.3 Your questions
What: The free text you type when asking for a reading.
Where it goes: Transmitted to Anthropic to generate the answer. A chat question and its answer exist only while you are in that conversation and are discarded when you leave it. The written readings in your year-ahead timeline are cached on your device so the timeline still works offline.
Where it does not go: Our server does not store the question or the reading. Neither is written to any log.
3.4 Your IP address
What: The IP address your request arrives from.
Why: We apply rate limiting to prevent abuse of the app and of our Anthropic account. The rate limiter holds your IP address in memory, on the individual server instance handling your request, for a short period.
How long: It is held in volatile memory only and is discarded when the instance recycles. It is never written to a database.
An IP address may separately appear in our hosting provider's operational request logs. See section 8.
3.5 Purchase status
What: Whether you have an active purchase or subscription.
How: Purchases are made through Apple's In-App Purchase system. Apple processes your payment. We never see your payment card, billing address, or Apple ID. Apple provides us only aggregated, non-identifying sales reporting.
We use RevenueCat, Inc. to manage subscription entitlements. RevenueCat receives an anonymous app user identifier that it generates itself, and your purchase and subscription history. We do not collect or send device advertising identifiers, and we do not link that identifier to your name, your email, or any account. It does not receive your birth details, your questions, or your readings.
3.6 Device and technical information
Standard technical information necessarily generated by any internet request — the app version, the operating system version, and the time of the request — reaches our hosting provider as part of delivering the service. We do not collect device advertising identifiers. We do not fingerprint your device. We do not use the App Tracking Transparency framework because we do not track you across other companies' apps or websites.
4. Where your data is processed
This section exists because many astrology apps claim on-device processing when they do not do it. We would rather be plain.
Readings are not generated on your device. When you ask for a reading, the app sends your birth details, your question text, and — where the reading concerns a saved person — that person's name, relationship label and birth details to our server. Our server forwards them to Anthropic's Claude API. Anthropic's model generates the reading. The text comes back through our server to your device, where it is cached.
Our server holds nothing. It has no database attached. It writes no request bodies to disk. It is a pass-through.
On your device, everything persists. Your profile, your saved people, your questions, and the full text of every reading in your timeline remain in local app storage until you delete them or delete the app.
5. Why we process your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Generating your reading | Birth details, names, question text | Art. 6(1)(b) — performance of the contract you enter into when you use the app |
| Processing question text that may reveal sensitive information | Free-text questions | Art. 6(1)(b) and Art. 9(2)(a) — your explicit consent (see section 6) |
| Verifying purchases and entitlements | Purchase status, app user identifier | Art. 6(1)(b) — performance of contract |
| Rate limiting and abuse prevention | IP address | Art. 6(1)(f) — our legitimate interest in keeping the service available and preventing cost abuse. We have assessed that this is minimal, expected, and cannot reasonably be achieved by less intrusive means |
| Responding to your support messages | Whatever you include in your email | Art. 6(1)(f) — our legitimate interest in answering you |
| Keeping fiscal records of sales | Aggregated transaction records from Apple | Art. 6(1)(c) — legal obligation under art. 52 Algemene wet inzake rijksbelastingen |
We do not process your data for marketing. We do not send promotional email. We do not profile you for advertising.
6. Sensitive information in your questions
Birth date, birth time, and birth place are not special category data under Article 9 GDPR. But the questions people ask an astrology app often are. A question about a health outcome reveals health data. A question about a partner may reveal your sexual orientation. A question framed in religious terms reveals religious or philosophical belief.
We handle this in three ways.
First, we ask for your explicit consent before you send your first question, separately from any other agreement. You can decline. If you do, the app's calculated features continue to work in full — your natal chart, your transits, your monthly forecast, the charts of people you have saved, and the dates and windows in your year-ahead timeline are all computed on your device and need no question text. What you lose is the written, AI-generated material that depends on sending a question: chat answers and compatibility readings. You can withdraw your consent at any time in the app's settings, which stops any further question text being sent. Withdrawal does not affect the lawfulness of what was processed beforehand.
Second, we ask you not to include sensitive details. You do not need to name a diagnosis, a person's gender, or a belief to receive a useful reading. The question field carries a reminder of this.
Third, we do not retain it. Question text is not stored on our server at any point. It exists on your device and in transit to Anthropic. This is the most meaningful protection we can offer, and it is architectural rather than promissory.
7. Data about other people
The People section lets you save the birth details of other people. Those people have not agreed to anything with us.
Entries you create are stored on your device only. We do not receive them, hold them, or maintain any record of them. When a reading concerns one of those people, their details pass through our server to Anthropic in the same stateless way as your own, and are equally not stored.
You are responsible for what you enter. By adding another person's details you confirm you have a proper basis for doing so. Please use a first name or a nickname rather than a full name. Please do not add details of anyone who has asked you not to.
Because we hold no record of these entries and have no means of contacting the people concerned, providing them with information individually would require effort disproportionate to any benefit, within the meaning of Article 14(5)(b) GDPR. This policy serves as the public information measure contemplated by that provision. Anyone who believes their details have been entered into Skylight by another user may contact us at support@skylight-app.org, though we should be candid that we hold nothing on our side to search, correct, or delete.
8. Who else processes your data
We use four external parties. We use no others.
Anthropic PBC (United States) — operates the Claude model that generates your readings. Anthropic receives your birth details, your question text, and the name, relationship label and birth details of anyone a reading concerns. It does not receive the name you enter for yourself. Anthropic acts as our processor under a Data Processing Addendum incorporating the European Commission's Standard Contractual Clauses. Anthropic does not use this data to train its models. For the model we use, Anthropic does not retain prompts or outputs by default. Anthropic may retain content for up to two years where its automated trust and safety systems flag it, or where law requires. Anthropic's own privacy terms are at anthropic.com/legal/privacy.
Vercel Inc. (United States) — hosts our server. Vercel does not receive your data as a distinct dataset; it operates the infrastructure through which requests pass. Vercel's operational logs may briefly contain request metadata including IP addresses; these logs are retained for one day and are not forwarded anywhere. Vercel is our processor under its Data Processing Addendum and is certified under the EU–U.S. Data Privacy Framework.
Apple Inc. (United States and Ireland) — distributes the app and processes your purchases. For payments and App Store activity, Apple is an independent controller, not our processor. Apple's handling of your data is governed by Apple's own privacy policy, which we do not control. We receive no payment details from Apple.
RevenueCat, Inc. (United States) — manages subscription entitlements. RevenueCat is our processor under its Data Processing Addendum incorporating Standard Contractual Clauses.
We do not use Google Analytics, Firebase, Meta SDKs, Amplitude, Mixpanel, Sentry, or any comparable tool. If that changes, this policy changes first.
We may disclose data if compelled by a court or competent authority, or if necessary to establish or defend a legal claim. Given that we hold almost nothing, there would be little to disclose. If we ever sell or transfer the business, this policy binds any acquirer until they publish their own and give you notice.
9. International transfers
Anthropic, Vercel, Apple and RevenueCat are established in the United States, which the European Commission has not found to provide an adequate level of data protection generally.
For Anthropic, transfers rely on the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), incorporated into Anthropic's Data Processing Addendum. Anthropic does not currently offer processing within the European Economic Area, so this transfer is inherent to the service. Depending on Anthropic's routing configuration, model inference may run in the United States or in other territories where Anthropic operates infrastructure.
For Vercel, transfers rely on Vercel's certification under the EU–U.S. Data Privacy Framework, with the Standard Contractual Clauses applying as a fallback.
For RevenueCat, transfers rely on the Standard Contractual Clauses in its Data Processing Addendum.
For Apple, the transfer is between you and Apple as an independent controller, on Apple's own terms.
You may request a copy of the relevant transfer safeguards by writing to support@skylight-app.org.
10. How long we keep things
| Data | Where | Retained for |
|---|---|---|
| Birth details, names, people entries | Your device | Until you delete them or delete the app |
| Chat questions and answers | Your device, in memory only | Discarded when you leave the conversation |
| Timeline reading text | Your device (timeline cache) | Until you reset the app or delete it |
| Anything at all | Our server | Not stored. No database exists |
| IP address (rate limiter) | Server memory | Minutes; discarded when the instance recycles |
| Request metadata including IP | Vercel operational logs | 1 day (Vercel Pro plan runtime log retention) |
| Prompts and readings | Anthropic | Not retained by default for the model we use; up to 2 years if flagged by trust and safety systems |
| Purchase and subscription records | Apple / RevenueCat | Per their own retention policies |
| Fiscal records of sales (aggregated) | Our accounting records | 7 years, as required by art. 52 AWR |
| Support emails | Our mailbox | 24 months from the last message |
The app's Start over option clears all local data, including your birth details, saved people and cached timeline readings. Deleting the app removes all local data.
11. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Object to processing based on our legitimate interests
- Portability — receive your data in a structured, commonly used, machine-readable format
- Withdraw consent at any time, where processing is based on consent
- Not be subject to decisions based solely on automated processing producing legal or similarly significant effects (see section 12)
How our architecture affects these rights. Because we operate no database, we hold no record identifiable to you. In practice this means:
- Access and portability are exercised on your device. Your data is in the app, in front of you. On request we will explain exactly what fields the app holds and where.
- Erasure and rectification are exercised by editing or deleting entries in the app, using Start over to clear all local data, or deleting the app. We cannot delete on your behalf what we never received.
- For data held by Anthropic, Vercel, Apple or RevenueCat, contact us and we will pass your request on and support it as far as we are able.
How to exercise them: email support@skylight-app.org. We will respond within one month of receiving your request. Where a request is complex or where you have made several, we may extend by a further two months and will tell you within the first month if we do. Exercising these rights is free; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive.
We may need to ask a question or two to establish that a request genuinely comes from you. We will not collect identity documents to do this.
12. Automated decision-making
Your readings are generated by an AI model without a human reviewing them. This is automated processing.
It is not automated decision-making of the kind restricted by Article 22 GDPR. No decision is made about you. Nothing produces a legal effect or similarly significantly affects you. We do not use the model's output to grant, deny, price, or restrict anything.
Readings are for entertainment and personal reflection. They are not medical, psychological, legal, financial, or professional advice, and should not be relied on as a basis for any decision of consequence. AI models produce fluent text that can be confidently wrong. If something in a reading concerns you, speak to a qualified professional.
13. Children
You must be at least 13 to use Skylight. If you are under 18, or under the age of majority where you live, you may use Skylight only with a parent or guardian's agreement and supervision.
In the EEA and the UK, the feature that sends free-text questions to our AI provider is intended for users aged 16 and over. This reflects the age of digital consent used across the EEA and the fact that a typed question may reveal special category data, as described in section 6.
We do not knowingly collect data from anyone below these ages. If you believe a child has been using the app contrary to this section, contact support@skylight-app.org and we will help ensure local data is removed — noting that, since we store nothing, the data will be on their device.
14. Security
Data in transit is encrypted using TLS. Our API credentials are held as environment variables and are never present in the app. Our server stores no personal data, which materially limits what any compromise could expose. Data on your device is protected by your device's own security — a passcode or biometric lock is your main protection here.
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay, and will notify the Autoriteit Persoonsgegevens within 72 hours where Article 33 requires it.
15. Complaints
If you are unhappy with how we handle your data, please tell us first at support@skylight-app.org. We would rather fix it.
You also have the right to lodge a complaint with a supervisory authority. Ours is:
Autoriteit Persoonsgegevens
Postbus 93374
2509 AJ Den Haag
The Netherlands
autoriteitpersoonsgegevens.nl
Telephone: 088 - 1805 250
If you live elsewhere in the EEA, you may complain to your own national supervisory authority instead. In the United Kingdom, the Information Commissioner's Office at ico.org.uk.
16. If you are outside the EEA
United Kingdom. The UK GDPR gives you rights equivalent to those in section 11. Exercise them the same way.
California. We do not sell or share personal information as those terms are defined in the CCPA, and we have never done so. We do not use or disclose sensitive personal information beyond what is necessary to provide the app. California residents may exercise rights of access, deletion, correction, and non-discrimination by writing to support@skylight-app.org. We will not treat you differently for exercising them.
Everywhere else. We apply the standards in this policy to all users regardless of location. If your local law grants you rights beyond these, contact us and we will honour them.
17. Changes to this policy
If we change this policy, we will update the date at the top and increment the version.
For minor changes — wording, contact details, clarifications — we will post the updated policy at skylight-app.org and note it in the app.
For material changes — a new processor, a new category of data, a new purpose, a change to how long anything is kept — we will notify you in the app before the change takes effect, and give you at least 14 days' notice. Where the change requires your consent, we will ask for it, and the change will not apply to you until you give it.
Previous versions are available on request.
18. Contact
EEA MEDIA, De Skatting 14, 8621 BW Heeg, The Netherlands. KvK 93005520.