Privacy Policy

Alexandre Gilbert, trading as SHIMTU, Hardturmstrasse 122A, 8005 Zürich, Switzerland. Contact: support@shimtuai.com. Full operator details are on the legal notice. Swiss data-protection law (FADP) applies; where you live in the EU/EEA or the UK, the GDPR or UK GDPR may also apply to you.

Everything below is stored in SHIMTU's database and tied to your account.

• Account: email address, password (stored only as a secure hash by our authentication provider), first name, language preference, the versions of the Terms and Privacy Policy you accepted, the time you accepted them and your confirmation that you are 18 or older.
• Birth details: birth date, birth time (if you know it), birthplace with its coordinates and historical time zone. This is the data your chart is calculated from.
• Focus areas: the life themes you chose so readings can be relevant to you.
• Generated content: your natal chart, its interpretation, daily guidance, monthly forecasts, and the questions you ask together with the AI answers, their supporting astrological evidence and automatic conversation summaries.
• Memories: short notes about you that the AI suggested and that you explicitly chose to keep by tapping “Remember”. Nothing is remembered without that tap.
• Feedback: ratings, reasons and optional comments you leave on readings or answers.
• Subscription records: your Stripe customer and subscription identifiers, plan, status and billing-period dates, plus a record of the plan facts and acknowledgements you confirmed before paying. We never store card numbers.
• Premium gifts: if you redeem a complimentary SHIMTU Premium gift, we link the gift to your account and keep the gift dates and an internal note. The gift code itself is stored only as a one-way hash. When your account is deleted, the link to your account is removed and the code stays used.
• Security logs: sign-in, sign-up and password-reset attempts, stored only as one-way hashes of the email address and IP address, so that abuse can be limited. The hashes cannot be turned back into the original values.
• Provider usage logs: a record of when the astrology calculation provider was called and whether it succeeded, kept to manage our usage quota. These rows are unlinked from your account when it is deleted.

• To provide the service you signed up for: calculating your chart, writing readings, answering questions, remembering what you asked us to remember (performance of our contract with you).
• To take payment and manage your subscription (performance of the contract and legal obligations).
• To keep accounts secure and limit automated abuse (our legitimate interest in running a safe service).
• To answer your support requests (contract and legitimate interest).
• To confirm you are old enough to use the service (legal obligation and our own policy).

We do not use your data for advertising, we do not sell it, and we do not run analytics or tracking scripts on this site.

SHIMTU cannot work without a small number of service providers. Each one receives only what it needs, on our instructions:

• Lovable Cloud (built on Supabase): hosts the database, authentication and server code that run SHIMTU. All data listed in section 2 is stored here.
• Astrology calculation provider (astrology-api.io): receives your exact birth date, time, coordinates and time zone to calculate planetary positions. It does not receive your name or email.
• AI model provider (via the Lovable AI Gateway, OpenAI models): receives your first name, focus areas, the astrological facts of your chart (signs, houses, aspects — not your raw birth date or coordinates), current transits, the memories you approved, your conversation history and the questions you type, in order to write readings and answers.
• Geoapify: receives only the place name you type when searching for your birthplace.
• Stripe: receives your email address, an internal account identifier and the plan you chose. You enter card details directly into Stripe's form; they never reach SHIMTU. Stripe is an independent controller for the payment itself and may keep invoices under its own legal obligations.
• Email delivery: account confirmation and password-reset emails are sent from notify.shimtuai.io through our authentication provider's email service.

These providers may process data outside Switzerland, including in the United States. Where that happens, we rely on the provider's contractual data-protection commitments (such as standard contractual clauses). We do not share your data with anyone else unless the law requires it.

Birth details and the questions you ask can reveal sensitive things about you. We treat them accordingly: they are visible only to your account, they are sent to providers only for the purposes above, and they are never used to build advertising profiles. Readings and answers are generated by an AI model and are meant for reflection, not for decisions about your health, money, legal matters or safety.

• Before you create an account: the name, birth details and calculated chart you enter to preview your chart are held on our servers under a random session identifier stored in a cookie, not in your browser. They are used only to calculate your chart and one short summary. If you create an account, they move onto it; otherwise they are automatically deleted within 48 hours. If a birth date shows you are under 18, the details are removed immediately.
• Account, birth details, readings, conversations, memories, feedback, consent records, checkout confirmations and our copy of your subscription status: for as long as your account exists. When you delete your account, these are deleted from our database in the same step; copies in short-lived backups of the hosting provider expire on their own schedule.
• Security-attempt records: automatically deleted after 24 hours. Security-event records: automatically deleted after 30 days. These hold only one-way hashed identifiers and are not removed early when you delete your account.
• Payment provider records: Stripe keeps its own customer, subscription and invoice records under its legal retention duties. Account deletion cancels the subscription but does not erase those records; contact Stripe or us for their handling.
• AI and astrology providers: requests are processed to produce the answer and are subject to those providers' own retention terms; we do not control their deletion.
• Provider usage logs: an anonymised counter per request (which service, which feature, success or failure). Once your account is deleted the entry is kept without any link to you.
• A draft of your onboarding answers may sit in your own browser's storage until onboarding completes; it is removed when your profile is saved.

• Access: what we hold about you is visible inside the app (profile, chart, readings, conversations, memories). There is no self-service download; if you want a copy, email support@shimtuai.com and we will prepare it manually within the time the law allows.
• Correction: edit your name, birth details and focus areas from your profile at any time.
• Deletion: delete individual conversations, memories or your whole account from your profile. Account deletion also cancels any active subscription.
• Objection and complaint: write to support@shimtuai.com. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, if you live in the EU/EEA or UK, to your local authority.

SHIMTU sets no advertising or analytics cookies. Your browser stores your sign-in session, an onboarding draft until it is saved, and your consent ticks during sign-up. Stripe's payment form may set its own cookies while it is open.

SHIMTU is for adults. You must be at least 18 to create an account, and we check this against the birth date you enter, judged by your local calendar date. If the birth date on an account shows that its holder is younger, the account is blocked from readings, conversations and purchases; it is not deleted automatically, and the holder can still delete it, sign out, read these policies and contact support. If we otherwise learn that an account belongs to a minor, we close it.

Every record is locked to its owner at the database level, secrets live only on the server, sign-in attempts are rate-limited, and passwords are never stored in readable form. No system is perfectly secure; if we ever discover a breach affecting you, we will tell you.

When this policy changes in a way that matters, the version number at the top changes and you will be asked to accept the new version the next time you open the app.