ASKRAPrivacy Policy
Summary
Askra helps you reflect on decisions using astrology-inspired guidance. We process the minimum data needed to run the app, store your profile and reading history in Google Firebase, and send your questions to an AI provider (Google Gemini) to generate answers. We do not sell your personal information, and we never share your birth data or questions with advertisers.
1. Who we are (controller)
Askra is operated by CROCODATA Sp. z o.o., Warsaw, Poland (KRS 0001241145, NIP 7582407044, REGON 544746646). We are the data controller under the GDPR (Regulation EU 2016/679).
Data-protection requests: privacy@crocodata.net (general enquiries: contact@crocodata.net). We respond within one month under the GDPR, and within the shorter or longer period required by your own local law. You may also complain to your supervisory authority (in Poland: UODO).
Askra is available worldwide. Rights and duties differ by country — see Regional privacy rights for the United States (including the California "Do Not Sell or Share" right), United Kingdom, Switzerland, Brazil, Canada, Australia, South Korea, India and others.
2. What we collect and why
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Account (Firebase anonymous ID, or Google sign-in identifiers) | Authenticate you; store your profile and history | Art. 6(1)(b) contract · Art. 6(1)(f) security | Until you delete your account |
| Birth date; optional birth time and birth city/coordinates; derived chart data | Compute and show your natal chart and personalise readings | Art. 6(1)(b) contract | Until you delete your account |
| Questions you submit and AI responses (reading history) | Provide Ask answers and show history | Art. 6(1)(b) contract | Until you delete your account |
| Usage counters (question limits, bonus questions) | Enforce fair-use / free-tier limits | Art. 6(1)(b) / Art. 6(1)(f) | Until you delete your account |
| Technical security data (e.g. Firebase App Check tokens) | Abuse prevention and API protection | Art. 6(1)(f) legitimate interest | Per Firebase / Google defaults |
| Advertising identifiers (rewarded ads only) | Show optional rewarded ads via Google AdMob | Art. 6(1)(a) consent where required | Per Google AdMob policy |
| Subscription / entitlement status | Unlock Cosmic features; restore purchases via RevenueCat and the app stores | Art. 6(1)(b) contract | While subscribed / per store & RevenueCat retention |
Sensitive content: Do not submit health diagnoses, legal secrets, financial account details, or other information you would not want a cloud AI provider to process. Birth data is used only for chart computation and readings — never for advertising.
3. AI processing
When you ask a question, the text (and relevant chart context needed for the answer) is sent to our backend (Google Firebase Cloud Functions) and then to Google Gemini to generate a response. Google acts as a sub-processor. Askra applies server-side instructions that forbid medical, legal, and financial advice; crisis-related phrases are intercepted in the app and do not call the AI. Still, AI outputs may be inaccurate — see our Disclaimers and Terms of Use.
You are interacting with an AI system. Every answer in Askra is generated automatically by a large language model, not written by a person, and is labelled as such in the app. This disclosure is made in line with Article 50 of Regulation (EU) 2024/1689 (the EU AI Act). Askra is not a high-risk AI system under Annex III of that Regulation: it provides entertainment and self-reflection content and is not used for employment, credit, education, law enforcement, migration, essential services or biometric purposes.
Your prompts are not used to train AI models. Askra calls the Gemini API through a paid Google Cloud project. Under Google's terms for paid API usage, your questions and the generated answers are not used to train Google's models. We do not train any model on your data ourselves and we do not license your data to anyone for that purpose.
Chart calculations (planetary positions, houses, aspects) are computed by our own astronomy code on our backend from published astronomical algorithms. No third-party astrology or ephemeris service receives your birth data.
3a. Automated decision-making
Askra returns a "verdict" (yes / no / wait) for the question you ask. This is entertainment content, not a decision about you. It produces no legal effects and nothing similarly significant, so it does not constitute automated individual decision-making within the meaning of Art. 22 GDPR. We never use it to decide anything about your access to services, pricing, or eligibility. You remain solely responsible for your own choices.
3b. Advertising, consent and tracking
The free tier offers optional rewarded ads served by Google AdMob — you choose to watch one in exchange for extra questions. Paid subscribers see no ads.
- EEA, UK and Switzerland: before any ad request we show a Google-certified consent message (Google UMP / IAB TCF v2.2) so you can choose between personalised and non-personalised ads. You can change or withdraw that choice at any time in Settings → Privacy options inside the app.
- Apple devices: where personalised advertising would require access to your device's advertising identifier (IDFA), iOS shows Apple's App Tracking Transparency prompt. If you decline, ads still work but are not personalised.
- United States: sharing advertising identifiers with AdMob for personalised advertising may qualify as a "sale" or "share" under California and other state privacy laws. See Regional privacy rights for how to opt out, including via Global Privacy Control signals.
We never share your birth data, your questions or your readings with advertisers or ad networks.
4. Third-party processors
| Service | Role | Safeguards |
|---|---|---|
| Google Firebase / Google Cloud | Auth, Firestore, Cloud Functions, App Check | EU SCCs and/or EU–US Data Privacy Framework; Firebase Privacy |
| Google Gemini | AI response generation | Processed under Google Cloud / Gemini API terms; Google Privacy Policy |
| Google AdMob | Optional rewarded ads (free tier) | Consent (UMP) where required; Google Privacy Policy |
| RevenueCat | Subscription entitlement sync | RevenueCat Privacy Policy |
| Google Play / Apple App Store | Billing for Askra Cosmic | Per respective store privacy terms |
We do not sell personal data. We do not share birth data or Ask questions with advertisers.
5. Where your data is stored, and international transfers
Firestore, Cloud Functions and Authentication run in Google Cloud. Data may be processed outside your country — including in the United States — by Google and RevenueCat.
For users in the EEA, UK and Switzerland these transfers rely on the EU Standard Contractual Clauses (Art. 46 GDPR) and, where the provider is certified, on the EU–US Data Privacy Framework and its UK Extension and Swiss-US bridge. We have carried out a transfer impact assessment and keep it on file. We have signed Art. 28 data-processing agreements with each processor listed above.
5a. Birth data — how we treat it
Your date, time and place of birth are ordinary personal data under the GDPR, not special-category data under Art. 9. We nevertheless treat them as sensitive in practice: they are used only to compute your chart and personalise readings, they are never shared with advertisers, never sold, and never used for profiling outside the app's own function. Birth time and birth city are optional — the app works with the birth date alone, in reduced form.
6. Retention & deletion
We keep profile and reading history while your account exists. You can delete your data in the app (Settings → Delete my data) or follow Delete my data. After deletion, associated profile content is removed subject to backup and legal retention limits. Residual copies in encrypted backups may persist for up to 90 days before automatic purge. Store billing records may remain with Google Play, Apple, or RevenueCat under their policies.
7. Your rights
Under the GDPR you may request access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and portability (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time (Art. 7(3)) — for example your ad-consent choice, in Settings → Privacy options. Contact privacy@crocodata.net. You may lodge a complaint with your local supervisory authority (Poland: UODO).
If you live outside the EEA, you may have different or additional rights — see Regional privacy rights. We honour verified requests from anywhere, whether or not local law requires it.
8. Children and young people
Askra is not directed at, and must not be used by, people below the age threshold that applies where they live:
- European Economic Area: 16, or the lower age set by national law where a Member State has set one (13–16 under Art. 8(1) GDPR).
- United States: 13 — we do not knowingly collect personal information from children under 13 (COPPA).
- United Kingdom: 13, and we apply the ICO's Age Appropriate Design Code standards. Ads shown to users we believe may be under 18 are not personalised.
- Elsewhere: the local digital-consent age, and in any case not below 13.
The app asks for your date of birth as part of setup, which also serves as an age check. If you believe a child has provided personal data, contact privacy@crocodata.net and we will delete it promptly.
9. Security
Transfers use HTTPS. Access to backend AI functions is protected with Firebase Authentication and App Check. You are responsible for securing your device and any Google account used to sign in.
10. Changes
We may update this notice. Material changes will be reflected on this page and, where appropriate, in the app. The version number and effective date above change when we do.
11. Change log
- v2.0 — 26 July 2026: added EU AI Act Art. 50 disclosure and non-training statement; Art. 22 automated-decision clarification; advertising consent, ATT and US "sale/share" section; birth-data treatment; storage locations, SCC/DPF detail and transfer impact assessment; per-country age thresholds; regional privacy rights link; privacy@ contact.
- v1.x — June–July 2026: legal-basis table, processor list, RevenueCat, retention and deletion.