Privacy
The short version: a birth chart needs your birth, so Sorsye keeps what you give it and nothing more. It runs on our own server, uses no advertising trackers, sells nothing, and you can see, download or delete everything about you from Settings at any time.
1. Who is responsible
The data controller is Salifa Ally Bell, trading as Sorsye, Mahé, Republic of Seychelles, hello@sorsye.com. When Astorva Holdings is registered it will take this role and this page will say so.
2. What we keep, and why
If you only visit
Nothing that names you. The doors you open, the screens you see and how long you stay are counted against a random device id that your browser creates and keeps; on our server we store only a hashed form of it, so it cannot be turned back into your device. We do not store your IP address; it is used in memory only to stop abuse, and to note the country the connection came from, and then forgotten. The birth details you type to draw a chart are used to draw it and are not saved on the server unless you make a place. On your own device, your browser may keep your chart, your partner and your journal so you find them again; Settings lets you forget them.
If you make a place
Your email address, a hash of your passphrase (never the passphrase itself), your name if you give one, your birth details (date, time and place), the birth details of a partner if you add one, your chart preferences, your journal, and the readings you have unlocked. These are kept so that your place follows you and so that what you have paid for stays yours. The lawful basis is the agreement between us when you make the place, and your consent when you add a partner's details, which you may only do with their permission.
If you ask the machine
When you ask a question about your chart or ask for a whole dream to be read, the text of your question and the reading it is grounded in are sent to our language model provider, MiniMax (api.minimax.io), to compose the answer. We send the minimum needed and no name or email. The question, the number of words used and the cost are kept in our own ledger for review and to keep the service affordable; you may ask us to delete your questions, and we can switch the keeping of question texts off entirely.
If you buy
Payments are taken by Paddle as merchant of record. Paddle holds your card and billing details under its own privacy policy. We receive the transaction id, what was bought, the amount and your email, so we can open what you paid for and keep a record for tax and accounts.
To keep the house running
Errors, slow answers and faults are logged so we can fix them. Sign-in attempts are counted to stop guessing. These records are about the service, not about you, and are cleared on a schedule.
3. Cookies and storage
Sorsye sets one cookie, and only when you sign in: a session cookie so the server knows it is you, marked httpOnly and secure. There are no advertising or tracking cookies, and no third-party analytics today. If we ever add a third-party measurement tool, this page will say so first and you will be asked. Your browser's local storage keeps your device id, your theme, the gate word if you ask it to, and a copy of your journal for offline use.
4. Where the data lives, and who else sees it
Our server is rented from Contabo GmbH (a German company) and stands in Europe; it is administered only by the operator. Personal data leaves that server in four cases: the text of a question goes to MiniMax to be answered; payment details go to Paddle to be charged; a Telegram message about the house's own health goes to the operator (counts and faults only, never a name, an email or a reading); and an encrypted copy of the whole database is kept for three days on a second server rented from Hostinger and on the operator's own computer, readable only with a key held by the operator. Transfers outside Seychelles are made only to providers bound by their own data protection terms, as the Act requires.
5. How long
| What | Kept for |
|---|---|
| Your place and everything in it | Until you delete it, or after two years of no sign-in following a notice to your email |
| Payment records | Seven years, as accounting law requires |
| Questions to the machine | Up to four hundred days while the review setting is on, at once when it is switched off, when you delete your place, or when you ask |
| Visit statistics (hashed device id) | Four hundred days |
| Error and fault logs | Ninety days |
| Backups | Three days, encrypted, then deleted |
6. Your rights
Under the Data Protection Act, 2023 you may ask to see the personal data we hold about you, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable form. Most of this you can do yourself in Settings: "show everything Sorsye holds about me" gives you the whole record, "edit my details" corrects it, and "delete my place and everything in it" erases it at once. For anything else write to hello@sorsye.com and we will answer within thirty days. You may also complain to the Information Commission of Seychelles, the authority under the Act.
7. Children
Sorsye is for people of eighteen and over. We do not knowingly keep a place for a child; if you believe one exists, tell us and it will be removed.
8. Security
Everything travels over HTTPS. Passphrases are hashed with argon2id and are never stored or seen in the clear. Readings and the books stay on the server and are never sent to the browser as a whole. Access to the server is by key only, and the back room that shows statistics is open only to the operator. If a breach ever touched your personal data, we would tell the Information Commission and you promptly, as the Act requires, and say what happened and what to do.
9. Changes
When this page changes, the date at the top changes with it. If a change is important, we tell you inside Sorsye or by email.