Who we are
The Dispositor is published by Emine Sungur, an individual developer based in Türkiye, referred to here as "we" or "us". We are the data controller for the information described in this policy.
This policy covers The Dispositor app for iPhone, the server it talks to, and this website, thedispositor.com. It does not cover the App Store or any other website we link to, each of which has its own policy.
For any privacy question or request, write to support@thedispositor.com.
What The Dispositor stores
The tables below are the complete inventory of personal data held on our server. The left column gives the field names as they exist in the database, so this list can be checked against the software rather than taken on trust.
Your account
| Field | What it is | Where it comes from |
|---|---|---|
| user_id | A random identifier for your account. Not derived from anything about you. | Generated when the app first opens |
| Your email address. Empty unless you sign in with Apple or Google, and empty even then if the provider does not share one. Apple's private relay addresses are supported and we never see the address behind them. | Apple or Google, at sign-in | |
| providerplus provider_subject and last_sign_in_at | Which service you signed in with, the account identifier that service gave us, and when you last signed in with it. This is what links you to your data on return visits. | Apple or Google, at sign-in |
| provider_refresh_token | Sign in with Apple only. Held for one purpose: revoking Apple's grant when you delete your account, which Apple requires of us. It is never used to read anything from Apple. | Apple, at sign-in |
| guest_key | A SHA-256 digest of a random key your phone makes the first time the app opens. If that first request reaches us twice, the digest lets us answer both with the same account. The key itself stays on the phone. | Your phone, on first launch |
| planplus usage counters | Your plan (Free, Premium or Circle), how many AI answers you have used this week, and how many charts you have saved. | Your use of the app |
| unreachable_since | Empty for almost every account. Set on the day we find that an account with no sign-in attached can no longer be opened from any phone, which starts the 90 days in §4. | Generated |
| ai_suspended_atplus ai_suspended_reason | Empty for almost every account. Set when we turn off AI questions on an account that was used to abuse them, with our reason. The rest of the account stays as it is, and the app says where to write if you think it is a mistake. | Set by us |
| password_hash | Always empty. The app has no passwords; the column is left over from a test version. | Not used |
| created_at | When the account was created. | Generated |
Birth charts
One row per chart you save, whether it is yours or someone else's. This is the most sensitive information in the app.
| Field | What it is | Where it comes from |
|---|---|---|
| nickname | The name you give the chart. It can be a full name, a first name, or anything else you choose. | You type it |
| date_of_birth | The birth date. | You enter it |
| time_of_birthplus birth_time_known | The birth time, and whether one was given at all. Charts without a time are calculated differently and the app records which case applies. | You enter it, optional |
| birthplace_raw | The birthplace name you entered, such as "Bornova, İzmir, Türkiye". | You choose it in the place search |
| latitudeplus longitude | Coordinates for that birthplace. These describe a place of birth, not where you are now. The app never reads your device location. | Looked up on our own server from the birthplace, see §5 |
| timezone_idplus utc_offset_at_birth | The timezone at that place and the offset that applied on that date, which is what makes the chart accurate. | Looked up on our own server from the place and date, see §5 |
| gender | Optional. Used only where a reading's wording depends on it. You can leave it empty. | You choose it, optional |
| is_own_chartplus relationship_to_owner | Whether the chart is yours, and for other people the relationship label you picked, such as partner, family, friend, coworker or mentor. | You choose it |
Calculated positions
For every chart we store what the astronomical engine derived from those details: planetary positions, house cusps, aspects between them, and summary distributions. This is arithmetic performed on the birth details above and is stored so the app does not recalculate it on every screen.
Readings and questions
| Field | What it is | Where it comes from |
|---|---|---|
| prompt | The question or reflection you typed. This can be as personal as you make it. | You write it |
| responseplus preview | The answer that came back, and the short excerpt the app lists it under. | Generated |
| context_snapshot | The state of the sky at the moment you asked, which lens you were reading through, and which second chart was involved if any. Kept so a reading can be reopened later and still make sense. | Generated at the time |
| parent_idplus context_label | How follow-up questions thread onto the reading they came from. | Generated |
| saved_readings | Readings you chose to keep, with the chart data behind them. | You save them |
| connections | Which charts you have linked together, the lens you linked them under, and when you last opened the pairing. | You create them |
| ai_asks | A copy of an AI answer, filed under a random id your phone sends with the question. If the phone sends the same question again after a dropped connection, it gets the same answer and the question counts once. Deleted after two hours. | Generated |
| ai_crisis_days | How many free answers you were given on a day to messages saying you might be in danger, so that the free AI answers can stop at three a day. A number and a date, nothing you wrote. Deleted two days after the day it counts. | Generated |
| ai_spend_days | What the AI answers to your account cost us on a day, in dollars, and how many there were, so that no account can run up the bill past a daily limit. A number and a date, nothing you wrote. Deleted 90 days after the day it counts. | Generated |
Sessions
To keep you signed in we store a SHA-256 digest of each session token together with its expiry date. The token itself is never written to the database, so nobody reading that table can sign in as you. When the app swaps a token for a new one, we keep the digests of both for a short time, which is how a stolen copy of a spent token gets caught. Expired rows are deleted automatically.
Server logs
Our server writes short-lived operational logs to diagnose faults, and counts requests by IP address to enforce rate limits. The log lines carry your account's id but not your IP address. Railway, which runs the server, keeps those lines and its own records of each request, which include the IP address, for up to 90 days (§5). We use IP addresses only to enforce the limits, stop attacks and diagnose faults.
Security records
We keep a short record of the events that decide who can get into an account: each sign-in, a sign-in method removed, a session token used a second time (which ends every session on the account), a change of plan, AI questions turned off or back on for the account (with our reason), and the deletion of the account. Each record holds the time, the account's id and the kind of event, and for events that come from the app, the IP address and device description (user agent) the request came from. We use these records only to answer questions about an account's security, such as whether someone else signed in. They are kept for 180 days and then deleted automatically, including the records of an account that has since been deleted.
Crash reports
If the app runs into an error, it sends our server a short report: the error message, the technical trace of where in the app's code it happened, the screen that was open, the app version and the phone's operating system. The report carries no account id, name, email, chart or reading. It goes to our own server, not to a crash-reporting company, and is kept only in the server logs above.
This website
thedispositor.com sets no cookies of its own, runs no scripts and has no forms, and we keep no visitor logs. Cloudflare serves it, so each visit's IP address and browser details reach Cloudflare, which uses them to deliver the page and to stop attacks (§5).
Charts you create for other people
The Dispositor is built around comparing charts, so most people save charts for partners, family and friends. When you do that, you are giving us another person's birth details, and often their name and their relationship to you.
Only add someone else's birth details if they are comfortable with you doing so. You are responsible for having their agreement, and in some countries the law requires it.
We treat those charts as belonging to you. Only your account can see them. We do not contact the person, look them up anywhere, or connect their chart to any account of their own. If that person asks us to remove their details, write to us at support@thedispositor.com and we will act on it, and you can delete the chart yourself at any time from the chart library.
Using The Dispositor without an account
The app opens straight into use. On first launch it creates an account with no email address and no password attached, and gives your phone a session for it. From then on your charts and readings belong to that account.
This means you can use The Dispositor without telling us who you are. The trade-off is that only that phone can reach the account. If the phone is lost or reset, nobody can open that account again, and deleting the app can lose it too. Signing in with Apple or Google attaches a sign-in to the same account and keeps everything you have already created.
Once no phone holds a session for an account like this, nobody can open it again, you included, and we delete it from our servers with everything in it 90 days after we first find it that way (§9). An account on a paid plan is never deleted this way.
Companies we send data to
These are every outside service that receives personal data from The Dispositor. Each one processes it on our instructions and for the stated purpose only. There are no others, and no advertising or analytics companies on this list.
| Service | What it receives | Why |
|---|---|---|
| AnthropicClaude, for AI answers | The names on the charts involved, their calculated positions and aspects, the current sky, and the question you typed. The raw birth date, time and birthplace are not included. Nothing is sent until you allow it: the app asks before your first question, and you can change your answer in your account, under AI questions. | Writing the answer. Anthropic's commercial terms say it does not train its models on data sent through its API. |
| Apple and GoogleSign-in | Nothing from us. They send us an identity token that we verify. | Letting you sign in without a password. Only used if you choose to sign in. |
| RevenueCatSubscriptions | Your account identifier and the purchase record from the App Store. | Confirming a subscription is active. Card details go to Apple and never reach us or RevenueCat. |
| SupabaseDatabase, Frankfurt, Germany | Everything in §2, stored at rest. | Running the database. |
| RailwayOur server, Amsterdam, Netherlands | Everything the app sends our server and everything the server answers, while each request is handled, with your IP address as Cloudflare passes it on; and the server's logs (§2), which Railway keeps with its own records of requests for up to 90 days. | Running our server, the program between the app and the database. |
| CloudflareThe app's connection, images, this website, email | Your IP address and browser or app details, and what the app sends our server on its way there, whenever the app talks to api.thedispositor.com or downloads its images from art.thedispositor.com, and when you visit this website; and the email you send to support@thedispositor.com. | Carrying the app's requests, delivering images and pages, stopping attacks, and passing your email on to our inbox. |
| GoogleEmail inbox | The email you send us, with your email address. | Holding our support inbox, where we read and answer your email. |
Birthplace lookups are not on this list because they happen on our own server. Place names and coordinates come from GeoNames, a public geographical database we keep a copy of, and historical timezone rules come from the timezone database built into our server software. No geocoding or timezone company receives what you type in the place search.
Each of these companies publishes its own privacy policy describing what it does with data it processes.
What The Dispositor never does
Stated plainly, because several of these are common in this category of app.
- We do not sell personal data, and we do not share it for cross-context behavioural advertising. We never have.
- There is no analytics SDK in the app. No Firebase, no Amplitude, no Mixpanel, no Segment, no attribution SDK.
- There are no advertisements and no advertising identifiers. We do not use the device advertising ID, and we do not build profiles for ad targeting.
- The app never requests location permission and never reads your device location. Birthplaces come from the place you pick in the app's place search.
- We do not read your contacts, photos, calendar, microphone or camera.
- We do not send you marketing email. The only email we would ever send concerns your account or a request you made.
- We make no automated decision that has a legal or similarly significant effect on you. Readings are reflective writing, not advice, and nothing in the app decides anything about you.
On your phone
Your session tokens are kept in the iPhone's Keychain rather than in ordinary app storage. The app also remembers which sign-in provider you last used, so it can show the right button.
Some of what you make stays on the phone and never reaches our server: the notes you write, the passages you keep, a log of what the app showed you each day, and your answer on AI questions. Each is filed under your account's id. Deleting your account removes them from the phone, and signing in from a guest account carries them over to the signed-in one.
Charts and readings are fetched from the server as you use the app. Deleting the app removes everything it keeps on the phone, including those notes and passages, and they cannot be recovered. It does not delete the account on our server; an account with no sign-in attached is deleted as §9 describes once no phone can open it.
Why we are allowed to hold this
For people in the European Economic Area, the United Kingdom, and Türkiye, the law asks us to name a basis for each use.
- Performing our contract with you. Storing your charts, calculating them, writing readings, and keeping you signed in. Without this data the app cannot do the one thing it exists to do.
- Your consent. Sending your questions to Anthropic, which the app asks you about first; optional details you choose to give, such as gender on a chart; and any birth details you enter for another person. You can withdraw consent by setting AI questions to Not allowed, or by deleting the chart or the field.
- Our legitimate interests. Keeping the service secure and available: rate limiting, fault diagnosis, preventing abuse, and a record of the events that decide who can get into an account (§2). We use the least data that achieves this.
- Legal obligation. Keeping records of purchases where tax or consumer law requires it.
Birth details are not a special category of data under the GDPR by themselves. We are conscious that they are precise and permanent, and we treat them with that in mind.
How long things are kept
- Charts, readings and connections are kept until you delete them or delete your account. Apart from the one case below, we do not expire them on a timer, because a saved reading is meant to be there when you come back to it.
- Session records expire on their own, after 30 days for a signed-in account and 365 days for a session with no sign-in attached. Expired records are deleted automatically, on a sweep that runs every six hours.
- Copies of AI answers kept against a repeated request are deleted after two hours.
- The count of free answers to messages saying you may be in danger is deleted two days after the day it counts, on a sweep that runs every six hours.
- What your AI answers cost each day is deleted 90 days after the day it counts, on a sweep that runs once a day.
- An account nobody can open any more is deleted, with everything in it, 90 days after we first find it that way. That is an account with no sign-in attached (no Apple or Google sign-in) whose session no phone holds any more: the phone was reset or lost, or a year went by without the app being opened and the session expired. We check once a day. An account with Apple or Google sign-in attached, or on a paid plan, is never deleted this way.
- Server logs, and Railway's records of requests to our server, are kept for up to 90 days and then deleted automatically.
- Security records are kept for 180 days and then deleted automatically, on a sweep that runs every six hours, including those of an account that has since been deleted (§2).
- An Apple sign-in grant we could not revoke at once is retried for about three days. Only Apple's token is kept for that, tied to no account, and it is deleted when Apple confirms or the retries run out.
- Email you send us is kept while we need it to answer you and any later question about the same request.
- Purchase records are kept as long as tax and accounting law requires.
- A deleted account is gone at once. See §10.
- The AI use a deleted account had that week is kept until the week ends, on Monday at 00:00 UTC, or until you sign in again with the same Apple or Google account, whichever comes first. See §10.
Your rights, and how to use them
Under the GDPR, the UK GDPR, Türkiye's KVKK, and the California privacy laws, you have the rights below. We do not charge for any of them and we will not treat you differently for exercising one.
Delete everything
In the app, open your account and tap Delete account. It removes the account row and everything that hangs off it: every chart, every calculation, every reading, every saved reading, every connection, and every session. It runs as a single database operation, so it cannot stop halfway and leave part of the account behind. It also removes what the app keeps under your account on that phone. If you signed in with Apple, we also tell Apple to revoke the grant.
One record stays: that the account was deleted, when, and from which address and device, together with the account's other security records, for up to 180 days (§2). It holds none of your charts, readings or birth details.
If you asked the AI anything that week, one more short record stays until the week ends: a one-way, keyed scramble of your Apple or Google sign-in id, with how many AI answers you had used that week, and that day's free answers to messages saying you might be in danger and what that day's answers cost. It names no account, holds nothing you wrote, and cannot be turned back into your id. It is there so that deleting an account and signing up again does not start the week's AI allowance over: if you sign in with the same Apple or Google account that week, the new account takes those counts and the record is deleted. Otherwise it is deleted when the week ends, on Monday at 00:00 UTC.
Deletion is immediate and permanent. There is no recycle bin, no grace period and no way for us to restore any of it afterwards. If you want a copy, ask for it first.
Get a copy of your data
For a full copy of everything we hold, in a machine-readable format, write to support@thedispositor.com from the email address on your account. This is free and does not require a subscription. We answer within 30 days. An account with no sign-in attached has no email address, so we cannot tell a request for it from anyone else's: sign in with Apple or Google first, which keeps everything, and then write to us.
Correct something
Charts are editable in the app. Changing a birth time recalculates the chart. For anything you cannot reach yourself, write to us.
Object, restrict, or withdraw consent
Delete the chart or the reading in question, set AI questions to Not allowed, or write to us to ask that we stop a particular use. Where a use rests on consent, withdrawing it does not undo what was lawful beforehand.
Complain
If we handle a request poorly you can complain to your data protection authority. In the EEA that is the authority where you live; in the UK it is the ICO; in Türkiye it is the KVKK Authority. We would rather hear from you first at support@thedispositor.com.
Security
Traffic between the app and our API runs over HTTPS, and the connection from the API to the database is encrypted and certificate-verified. Session tokens are stored as hashes rather than as tokens, and are rotated every time they are used, so a stolen token that has already been spent is detected and the session is ended. The API rate limits requests, and every route that returns your data checks that the data belongs to you before returning it.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data we will notify you and the relevant authority as the law requires.
Children
The Dispositor is not intended for children under 13, and we do not knowingly collect their data. In the EEA the minimum age is 16 unless a parent or guardian consents, where local law sets it lower. If you believe a child has given us data, write to support@thedispositor.com and we will remove it.
Saving a chart for your own child is a normal use of the app. Those details are covered by §3 like any other chart of another person, and are yours to delete.
International transfers
Our database is in Frankfurt, Germany, and our server in Amsterdam, the Netherlands. Anthropic, Cloudflare, Railway and the other companies in §5 may process data outside your country, including in the United States. Where data leaves the EEA, the UK or Türkiye, the transfer relies on the European Commission's Standard Contractual Clauses, the UK Addendum, an adequacy decision, or the safeguards Türkiye's KVKK requires, whichever applies to that recipient.
Changes to this policy
When this policy changes, the effective date at the top changes with it. For a change that materially affects how we handle your data, we will tell you in the app before it takes effect, and where the law requires consent we will ask for it rather than assume it.
Contact
Privacy questions, data requests and complaints: support@thedispositor.com.
We answer data requests within 30 days. If a request is complex we will tell you before that deadline and explain why more time is needed.