Privacy Notice

Last updated: 15 August 2026

Courtesy translation. The Italian source text remains the authoritative version pending legal review.

This notice describes how personal data is processed through Synchronicity under Articles 12, 13 and 14 of Regulation (EU) 2016/679 (GDPR) and applicable data-protection and electronic-communications law.

1. Controller and contact details

The controller is Gabriele Maria Barba, operator of Synchronicity. Privacy, rights or account-deletion requests may be sent to privacy@synchronicity-sdg.com. No data protection officer has been appointed.

2. Who this notice applies to

This notice applies to site visitors, registered users, subscribers and people contacting support. The Service is for people aged 18 or over. Data found to belong to a child will be deleted without undue delay.

3. Data processed

Synchronicity may process:

• account and identity data: verified email, internal and authentication-provider identifiers, verification and session status, and creation or update timestamps;
• astrological profile data: display name, birth date and time, birth city, coordinates, time zone, current place and preferences needed to personalise the Service;
• purchase and subscription data: email, internal user ID, Stripe customer, checkout, subscription, price and invoice IDs, plan, status, a 3-day trial when offered, validity period, renewal or cancellation, and webhook technical data. Synchronicity does not receive or store full card numbers, security codes or bank credentials;
• technical and security data: IP address, user agent, request IDs, date and time, requested page or endpoint, outcome, error logs and information needed to prevent abuse, fraud or unauthorised access;
• communications: support messages and information needed to handle them.

After a trial is actually used, a trial-eligibility marker is also retained: a non-reversible HMAC-SHA256 of the normalised verified email, key version, environment, reason, consumption date and retention date. This table stores neither plaintext email nor a card fingerprint.

Data comes from the User, chosen authentication providers, Stripe for payment events, and the systems used to provide and protect the Service.

4. Data stored only on the device

Before registration, profile data and preferences may be stored in the browser through localStorage or equivalent technologies. After sign-in, the astrological profile may be synchronised with the account and made available on the user's other devices.

5. Purposes and lawful bases

Data is processed to:

• create and manage the account, authenticate the User, calculate personalised content, synchronise the astrological profile, manage subscriptions and supply requested features: contract or pre-contractual steps, Article 6(1)(b) GDPR;
• manage payments, invoicing and applicable tax, accounting, anti-money-laundering or authority obligations: legal obligation, Article 6(1)(c) GDPR;
• secure the Service, prevent fraud and abuse, diagnose faults, maintain continuity, defend legal claims and improve the engine through aggregate analysis: the controller's legitimate interests, Article 6(1)(f) GDPR, balanced against User rights;
• answer optional requests and manage non-contractual communications: performance of the User's request and, where applicable, legitimate interests in providing support.

Synchronicity currently does not use data for behavioural advertising, sale of personal data or promotional messaging. Any future consent-based purpose will require separate, revocable consent.

6. Required and optional data

A verified email, birth details and place are needed to create the account and generate personalised content. Without them, related features cannot work. Current place and support messages are optional. The Service does not require continuous GPS access; the current place is chosen by the User.

7. Recipients and providers

Data may be processed as necessary by Cloudflare for network, security, hosting, Workers and D1; Clerk for registration, authentication, sessions and identity; Google when the User chooses Google sign-in; Stripe for checkout, payments, invoicing, subscriptions and fraud prevention; and professional advisers, public authorities or other authorised recipients where required by law, security or legal claims.

Cloudflare and Clerk normally act as processors for services supplied to Synchronicity. Depending on the activity, Stripe may act as processor or independent controller for regulatory obligations, fraud prevention and its payment infrastructure. Google processes account data under its own terms when selected.

8. International transfers

Some providers operate infrastructure outside the European Economic Area, particularly in the United States. Transfers rely on GDPR mechanisms such as adequacy decisions, the EU–US Data Privacy Framework where applicable, European Commission standard contractual clauses and supplementary measures. Information about safeguards may be requested from the controller, subject to contract and law.

9. Retention

• browser-local data: until the User clears site data or uninstalls the application;
• synced astrological profile: for the account's duration; reset deletes it from the operational database, while a verified deletion request is normally completed within 30 days;
• recoverable technical database copies: up to 30 days, or a shorter period under the Cloudflare D1 plan, and not used for ordinary purposes;
• account and identity data: for the account's duration and up to 30 days after verified closure, except minimum security, abuse-prevention or claims data, which may be retained up to 24 months or longer if law requires;
• consumed-trial HMAC marker: up to 10 years after consumption to apply the offer only once, prevent abuse and defend rights; it remains isolated between sandbox and production and survives account closure or recreation;
• checkout and subscription operational data: for the relationship and up to 24 months afterwards; tax, accounting or legally required records may be kept for 10 years;
• technical events, logs and security data: normally no more than 30 days, but up to 24 months where needed to investigate incidents, prevent abuse or protect a right;
• support requests: up to 24 months after closure unless legal obligations or disputes require longer;
• aggregate or irreversibly anonymised data: indefinitely because it is no longer personal data.

Deleting local or synced profile data does not cancel a Stripe subscription. The subscription must be managed through the billing portal or support. Stripe may retain data for its own legal and regulatory duties.

10. Cookies, localStorage and similar technologies

Synchronicity uses cookies and identifiers strictly needed for authentication, security, sessions, load balancing and operation. It also uses localStorage, IndexedDB, caches and a service worker for requested preferences, local data and offline functions.

The current configuration does not use advertising or profiling cookies or unnecessary analytics. Technical tools do not require prior consent where law permits. Any future non-technical tool will be disabled by default and enabled only after a valid choice where required.

11. Security

Synchronicity uses risk-appropriate technical and organisational measures including HTTPS, server-side session verification, request limits, input validation, identifier separation, protected webhooks and restricted administrative access. No IT system can guarantee absolute security.

12. Automated personalisation and no significant decisions

Birth, place, time and preference data is processed through astronomical calculations and interpretive rules to produce charts, scores and astrological content. Contextual qualitative layers do not change scores; the content is for entertainment and personal reflection.

This processing has no legal or similarly significant effect under Article 22 GDPR. Synchronicity does not make automated decisions about credit, employment, health, insurance, education or essential services. Content is for entertainment and personal reflection and must not be the sole basis for important decisions.

13. Data-subject rights

Where GDPR applies, Users may request access and a copy, correction, deletion, restriction, objection to legitimate-interest processing, applicable portability, and withdrawal of consent without affecting earlier lawful processing.

Requests may be sent to privacy@synchronicity-sdg.com. Reasonable identity verification may be required. The controller answers without undue delay, normally within one month, subject to lawful extensions. Users may complain to their competent supervisory authority; in Italy this is the Garante per la protezione dei dati personali.

14. Deletion and portability

Reset removes the synced astrological profile associated with the account, but does not automatically delete the identity held by Clerk, data needed by Stripe or an active subscription. Complete account closure requires a request from the email associated with the account. Browser-only data must be deleted on the device through browser controls.

15. Partner programme

When the partner programme is enabled, a link or code may create a signed first-party identifier and a server-side record containing the code/campaign, landing page, language, permitted UTM values, minimised referrer origin, date and expiry. After sign-in, attribution may be bound to the account and retained until the first annual-payment decision. Partners receive aggregates only and never see a referred user's name, email, card, astrological profile or other personal data.

The data is used for attribution, fraud prevention, accounting and disputes. Unbound clicks normally expire after 30 days; conversion, commission, audit and payout records may be retained longer where required for accounting or legal claims. An explicit code remains available as an alternative to link tracking. Legal review is required before expanding the pilot.

16. Changes to this notice

This notice may be updated for legal, technical or functional changes. The latest update date appears above. Material changes will be communicated through the Service or, where appropriate, to the account email before taking effect.