Legal

Privacy Policy

Draft — published 2026-11-12 · professional legal review pending

This page is still a working placeholder for the final, lawyer-approved Privacy Policy. What follows is a full draft written from the actual implementation — every statement below describes how the product really behaves today. A professional legal review is still required before this becomes the binding policy; until then, treat it as our honest description, not a legal instrument.

Who we are

AcuAstro ("AURA", this website, acuastro.com) builds personalized wellbeing reports: your Vedic birth chart and a Traditional Chinese Medicine five-element reading, synthesized into acupressure guidance for reflection — never a diagnosis. Questions about this policy go through the Contact page.

The short version

  • Generating a report requires no account, and nothing you type leaves your browser until you choose to save.
  • Accounts use just an email address with a one-time code — no passwords.
  • The public pages run zero analytics, advertising or tracking scripts.
  • Saved reports are private to your account, enforced in the database itself.
  • No payments are collected today — the payment experience is not yet active.

What we collect

  • Account identity: your email address at sign-in (one-time code via email). A display name and an optional phone number may be attached to your profile.
  • Report inputs — only if you save: an optional first name, date of birth (with optional time and nearest-city place of birth), your concern or story in your own words, duration and intensity of the concern, a pregnancy answer, safety-screening answers (including red-flag symptoms and a pacemaker/implant flag), and your reading-system choice — plus the chart and report computed from them.
  • Payments: nothing today. When payments go live, card/UPI details stay with the payment processor; we would store only amount, currency, status and receipt references.
  • Technical logs: our hosting and email providers keep routine security and delivery logs.

What we never do

  • No analytics, ad networks, or third-party trackers anywhere on this site.
  • No selling, renting or advertising use of your data — ever.
  • Your questionnaire answers stay in your browser unless you save the report.

Where your data lives

  • Supabase — database, sign-in and saved reports; hosted in the Mumbai region; per-row access rules (RLS) enforced by the database itself.
  • Vercel — serves this website.
  • Resend — sends transactional email only (sign-in codes, admin invites, credit-expiry reminders) from noreply@acuastro.com.
  • Payment processors (Razorpay by default; Stripe supported) — only once live payments are switched on.

Share links

A report you share gets a secret token; the link /share?r=…&t=… reveals only that one report to whoever holds the full link — nothing else in the account, and database rules block any bulk or direct access. Treat a share link like a PDF: anyone you forward it to can read it, so share only with the intended person.

Your choices and rights

You can ask to access, correct or delete your saved reports and account. We drafted this policy with India's Digital Personal Data Protection Act, 2023 in mind (access, correction, erasure, grievance and nomination rights); the final wording follows legal review. A monitored contact channel is being published on the Contact page before public launch — until it is live, your practitioner or the person who shared a report with you can reach us on your behalf.

Children

AcuAstro is not directed at children. Users under 18 should use it only with a parent or guardian's consent and supervision (draft wording; final age-gate wording follows legal review).

Security

Everything runs over HTTPS. Sign-in is one-time codes — no passwords to leak. Report privacy is enforced by database rules, not just the interface. Payment-gateway keys live only server-side, and when payments go live your card details never touch our servers — the processor handles them directly.

Changes to this policy

Material changes will be published on this page with a new date. This draft took effect 12 November 2026; the reviewed, binding version will replace it and lose the draft notice.