HeartCosmos Privacy Policy

Effective date: September 1, 2026
Last updated: September 1, 2026

This Privacy Policy explains how HeartCosmos Inc. (“HeartCosmos,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you use heartcosmos.com and our related services (the “Services”).

HeartCosmos provides AI-assisted guided reflection, interactive questions, Life K-Line, Guardian experiences, and a personal Cosmos where you can keep insights from your explorations. Some experiences use symbolic perspectives inspired by wisdom and astrological traditions from cultures around the world.

Some parts of the Services invite you to write about personal matters. Please share only information you are comfortable providing. Do not submit another person’s sensitive information unless you have the right to do so.

1. Who We Are

The Services are operated by HeartCosmos Inc.

For privacy questions or requests, contact us at [email protected].

2. Information We Collect

We may collect the following categories of information.

Information you provide

Account information: your email address, login method, authentication status, and information needed to secure your account.
Profile and birth information: information such as your name or display name, date of birth, time of birth, and place of birth when you choose to use a feature that requires it.
Exploration content: questions, messages, answers to interactive prompts, choices, reflections, and other information you submit.
Saved experience data: Guardian results, Stars, Life K-Line results, Cosmos content, and other items you choose to save.
Support and feedback: messages you send to us, bug reports, survey responses, and other communications.
Transaction information: order details, price, currency, payment status, and related billing records. Payment card details are handled by our payment providers and are not stored by HeartCosmos in full.

Information collected automatically

Device and usage information: IP address, browser type, device type, operating system, language, referring page, pages viewed, feature interactions, timestamps, and error or diagnostic information.
Cookie and similar technology data: information collected through cookies, local storage, pixels, and similar technologies, as described in Section 9.
Security information: login attempts, session records, abuse signals, and other information needed to protect users and the Services.

Information from third parties

If you sign in with Google or another supported identity provider, we receive the information needed to verify your identity, such as a provider account identifier, verified email address, and basic profile information you have permitted the provider to share.

3. How We Use Information

We use personal information to:

provide guided explorations and generate the content you request;
create and maintain your account and personal Cosmos;
remember relevant context and restore your saved exploration history;
operate Life K-Line, Guardian, Stars, and related experiences;
authenticate users, maintain sessions, and protect accounts;
process payments, provide receipts, and handle support or refund requests;
detect abuse, investigate security incidents, and maintain service reliability;
understand how the Services are used and improve their design and performance;
communicate important service, account, policy, and security updates;
comply with legal obligations and enforce our Terms of Service; and
use information for another purpose that we clearly explain when we ask for your consent.

We do not sell your personal information. We do not use your private exploration content for targeted advertising.

4. Legal Bases for Processing

If the laws of the European Economic Area, United Kingdom, or another jurisdiction require a legal basis, we rely on one or more of the following:

Contract: processing needed to provide the Services you request.
Legitimate interests: securing, maintaining, and improving the Services, preventing abuse, and communicating with users, where those interests are not overridden by your rights.
Consent: processing you have actively agreed to, such as optional cookies or an optional research programme. You may withdraw consent at any time.
Legal obligation: processing required for tax, accounting, fraud prevention, law enforcement requests, or other legal duties.

The rights available to you may depend on the legal basis and the law that applies where you live.

5. AI, Guided Exploration, and Memory

When you use Explore or another AI-assisted experience, we process your prompts, answers, relevant conversation history, and generated results to provide the experience and keep it coherent.

We may use AI model, workflow, and memory service providers to process the information needed to generate a response, maintain relevant context, prevent abuse, and operate the Services. These providers process information for us under contractual and security requirements. We limit the information sent to what is reasonably needed for the requested feature.

We do not use your private exploration content to train our own or a third party’s general-purpose AI models unless you separately choose to join a clearly described, optional programme. Refusing or withdrawing that optional consent will not prevent you from using the core Services.

Authorised personnel may access limited content when reasonably necessary to respond to a support request, investigate abuse or a security incident, comply with law, or diagnose a technical failure. Access is limited according to role and operational need.

AI-generated content may be inaccurate, incomplete, or unsuitable for your circumstances. Please use your own judgment and do not include information you do not want processed as part of the Services.

6. How We Share Information

We may share personal information with:

Cloud and hosting providers that run our website, databases, storage, security, and infrastructure.
AI, workflow, and memory providers that help generate and maintain the experiences you request.
Authentication and email providers that verify identity and deliver sign-in codes or service messages.
Analytics and error-monitoring providers that help us understand performance and diagnose problems, subject to applicable consent requirements.
Payment providers that process purchases, refunds, and fraud checks.
Professional advisers such as lawyers, accountants, auditors, and insurers where reasonably necessary.
Authorities or other parties when disclosure is required by law or reasonably necessary to protect rights, safety, and the integrity of the Services.
A successor organisation in connection with a merger, financing, reorganisation, sale of assets, or similar business transaction, subject to appropriate confidentiality and notice requirements.

We may also share information when you ask us to or give us specific consent.

We do not sell personal information. If our practices change, we will update this Policy and provide any notice or choice required by law before the change takes effect.

7. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy.

An anonymous temporary Cosmos is generally kept for up to 24 hours unless you sign in and choose to save it.
Email verification codes expire after a short period and are deleted or made unusable after verification or expiry.
Login sessions remain active for a limited period and end when they expire, you sign out, you delete your account, or we invalidate them for security reasons.
Account information, saved explorations, Stars, Guardian results, and Cosmos content are generally retained while your account remains active and until you delete the account or the relevant content.
Transaction records may be kept for the period required by tax, accounting, fraud-prevention, and consumer-protection laws.
Security and diagnostic records are kept for a limited period based on operational need, sensitivity, and legal requirements.
Backups are deleted or overwritten according to our backup cycle, unless we must retain information longer to comply with law, resolve a dispute, or protect the Services.

When retention is no longer necessary, we delete or de-identify the information.

8. International Data Transfers

HeartCosmos and its service providers may process information in countries other than the country where you live. Privacy laws in those countries may differ from your local laws.

Where required, we use recognised safeguards for international transfers, such as adequacy decisions, approved contractual clauses, or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your information.

9. Cookies and Similar Technologies

We use cookies and similar technologies for the following purposes:

Strictly necessary: account login, security, language, session continuity, and core site functions.
Preferences: remembering settings you choose.
Analytics and performance: understanding visits, feature use, errors, and performance.
Marketing: only if we introduce such technologies and obtain any consent required by law.

Where required, we ask for your consent before using non-essential cookies. You can change your choices through the cookie settings made available on the site and through your browser. Blocking necessary cookies may prevent parts of the Services from working.

10. Your Privacy Rights

Depending on where you live, you may have the right to:

access personal information we hold about you;
correct inaccurate or incomplete information;
delete your information or account;
receive a portable copy of certain information;
restrict or object to certain processing;
withdraw consent without affecting earlier lawful processing;
opt out of marketing communications;
opt out of the sale or sharing of personal information where applicable; and
complain to a data-protection authority.

You may exercise available account controls or email [email protected]. We may need to verify your identity before completing a request. We will respond within the period required by applicable law and will not discriminate against you for exercising a privacy right.

Deleting your HeartCosmos account removes access immediately and starts deletion of the HeartCosmos identity, Cosmos, conversations, exploration records, Guardian results, Stars, Constellations, and corresponding AI workflow and memory data, subject to limited legal, security, and backup exceptions.

If an underlying account is shared with another service, deleting HeartCosmos data may not automatically delete that separate service account. We will explain the scope before you confirm deletion.

11. Security

We use administrative, technical, and organisational measures designed to protect personal information. These include access controls, secure transmission, authentication safeguards, restricted operational access, and monitoring appropriate to the nature of the information.

No system is completely secure. You are responsible for protecting access to your email account and device and for notifying us if you suspect unauthorised use.

12. Children’s Privacy

HeartCosmos is intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided information to us, contact [email protected] so that we can investigate and delete it where appropriate.

13. Third-Party Links

The Services may link to websites or services that we do not control. Their privacy practices are governed by their own policies. We encourage you to review those policies before providing information.

14. Changes to This Policy

We may update this Policy as our Services, technology, or legal obligations change. We will post the revised Policy with a new “Last updated” date. If a change materially affects how we use personal information, we will provide reasonable advance notice and obtain consent where required by law.

15. YouTube Data API

Our website uses YouTube Data API services. Users can search for public YouTube videos and view them via the official YouTube embedded player.

Registered users may authorize via OAuth2 to connect their own YouTube channel. With your consent, we use the youtube.readonly scope to read your own channel and video metadata, and the youtube.upload scope to upload videos and modify metadata on your YouTube channel.

We do not store your original video media files. We only access YouTube data you explicitly grant permission to.

You may revoke OAuth permissions or request deletion of your YouTube-related data at any time.

We adhere to the Google Privacy Policy.

All operations comply with the YouTube API Terms of Service.

16. Contact Us

HeartCosmos Inc.
Email: [email protected]