Privacy Policy

1. What Cygnus is

In this policy, "Cygnus" means Cygnus Project LLC, the operator of this site, and "we", "us", and "our" refer to Cygnus Project LLC.

Cygnus is a web application offering astrological tools — including but not limited to chart wheels, synastry, electional search, planetary timing references, and saved-work management — built on a custom astrological ephemeris. You supply inputs, you use the tools, and you do your own interpretation; the service does not generate predictions or advice. This scope is what bounds the data described below.

Cygnus Project LLC is the data controller for the information described in this policy and is responsible for how it is handled.

Cygnus is not directed at children under 13.

2. The short version

• We store your email address, the work you save (charts, searches, custom themes, and the like), and your settings. You can read, edit, export, or delete all of it.
• Sign-in and analytics use Logto and Umami — both are open-source tools that Cygnus runs on its own servers. The analytics are non-identifying (no personal identifiers, no cross-site tracking). Your data stays on infrastructure we control and is not transmitted to the companies that publish those tools. You can opt out of analytics in settings.
• The sole developer operating Cygnus has access to the production database. We do not routinely look at individual account data — §8 lists the only purposes for which we ever do.

3. What we do not do

• No tracking cookies. (Cygnus does use first-party functional cookies and local browser storage — for sign-in, for remembering your interface and appearance preferences such as your theme and layout, and for honoring your analytics opt-out. These are described in §5. None of them track you across sites or feed an advertising system.)
• No advertising. No ad networks.
• No data sales. No data broker relationships.
• No behavioral profiling. We do not score, rank, or characterize individual users.
• No session replay.
• No social-media pixels or SDKs.
• No third-party access to your astrological data.
• No contact-list imports.

4. How computation works

When you cast a chart or run an electional search, your inputs (date, time, location, condition tree, house system) go to the server, are computed, and the result is returned to your browser. Inputs you do not save are discarded after computation.

If you do not create an account, nothing about you persists on the server beyond standard request logging.

5. Your account

You can sign in with your email and password, or use Google sign-in if you prefer. Sign-in is handled by Logto, an open-source identity system that Cygnus self-hosts on its own infrastructure — your credentials and authentication state do not leave servers we operate. If you sign in, the following is stored:

• Your email address. If you sign in with Google, your display name from your Google profile is also stored.
• A session cookie, httpOnly, secure in production, with a 14-day max age.
• Birth data and chart inputs you explicitly save (date, time, location, subject name, plus any associated metadata).
• Other work you create and save in the app — for example, electional searches (condition trees and parameters) and custom themes.
• Settings (default location, tradition, theme, timezone, timestamp format, analytics preferences).

This is stored so you can sign in and retrieve your saved work.

Storage location: a Postgres database that Cygnus runs on its own servers, hosted on Google Cloud Platform in the United States.

Functional cookies and local storage: beyond the Logto session cookie above, Cygnus keeps a small amount of first-party interface state — in cookies and in your browser's local storage — so the app works and looks the way you left it: things like your selected theme and other appearance and display preferences, layout choices (such as whether the sidebar is collapsed), and your analytics opt-out. This state is used only to render the app for you; none of it tracks you across sites, contains personal data, or feeds any advertising system.

6. Location lookups

When you use the city picker to set a chart location, your typed query goes to a server-side index of city names and coordinates. The query itself is ephemeral (used to find a match, then discarded). The coordinates and place name you select are stored only if you save a chart with that location, or if you choose to save a default location in Settings.

7. Analytics

We use Umami, an open-source, self-hosted, non-identifying analytics tool. Its database runs on the same infrastructure we operate. Analytics data does not leave servers we control and is not transmitted to Umami's company.

The data Cygnus sends to Umami contains no personally identifiable information. What we do send is enumerated below — the lists are sourced from Umami's open-source code and database schema rather than its marketing copy. (Umami's architecture would let an operator send PII in custom events if they coded it that way; we don't.)

What is collected:

• The URL path and title of each page viewed, and the referring URL if any.
• Your browser, operating system, device type (desktop / mobile / tablet), screen resolution, and language preference — parsed from the request and stored as labels (e.g., "Firefox", "macOS", "desktop").
• Approximate geographic location (country, region, city) derived from your IP address. The lookup uses either a downloaded MaxMind GeoLite2 database that lives on our servers, or geographic headers provided by our hosting infrastructure — your IP is not sent to MaxMind or any other third-party service for this lookup.
• A pseudonymous session identifier computed as a one-way hash of the website ID, your IP address, your User-Agent, a per-installation secret, and a salt that rotates monthly. This lets us count distinct visits within a month without storing any direct identifier; it cannot be reversed to recover the underlying IP or User-Agent.
• Standard URL marketing-attribution parameters when present (UTM tags, click IDs).
• The names of any custom events we choose to record (e.g., "search submitted"). We do not include personal information in event payloads.

What is not collected:

• No cookies are set by analytics.
• Your raw IP address is not stored in the database — it is held only briefly in memory to compute the geographic lookup and the session hash, and discarded when the request returns.
• Your raw User-Agent string is not stored — only the parsed labels above are persisted.
• No cross-site tracking. The session hash is bound to our website ID and cannot be joined to other sites running Umami.
• No browser fingerprinting (canvas, WebGL, font, audio, or plugin enumeration).

You can opt out of analytics in Settings.

8. Who can see your data, and when

The sole developer operating Cygnus has production database access. No employees, no contractors, no third parties. Individual account data — your email, your settings, and counts of what you've saved — is looked at only for these purposes:

• Support you've requested.
• Safety and abuse — investigating suspected abuse, fraud, spam, or Terms violations, and taking appropriate action.
• Debugging — investigating bugs or data-integrity problems, including ones affecting a specific account.
• Legal and compliance — honoring your data-rights requests (see §10) and responding to valid legal process.

We do not read the contents of your saved charts, birth data, or searches as a matter of routine; when an issue you've reported genuinely requires it, that access is narrow and limited to that issue. Product decisions are made from aggregate statistics, never from per-person activity (see §3 and §7). Analytics data is never tied to your account identity.

9. Third parties

The complete list of third parties that receive any data in the production stack:

• Google OAuth — used only if you choose Google sign-in. Mediates the sign-in interaction and returns your email and profile from Google.
• Google Cloud Platform — hosting (Compute Engine VMs, Cloud SQL Postgres, Cloud Logging, Cloud Error Reporting). All server traffic flows through GCP infrastructure in us-central1.
• Google Fonts — serves the web fonts used in the Cygnus interface. Your browser fetches font files directly from Google when you load a page, which sends your IP address and user-agent string to Google.
• SMTP2Go — transactional email (account notifications, policy-change notices). Receives only the email address and message body needed to deliver the notification.

Logto (identity) and Umami (analytics) are not in this list. Both are open-source software that Cygnus self-hosts on its own infrastructure; data they handle stays on servers we control and is not transmitted to the companies that publish them. Caddy (TLS termination) runs on the same VMs and is not a distinct data flow.

This is the complete list.

10. Your rights

These rights apply to everyone with an account, regardless of jurisdiction:

• Delete your account and all associated data within 30 days of request. "All your data" means: your identity record, all Cygnus database rows tied to your account (charts, searches, settings, preferences), and the relevant server-log lines for the named account, subject to the log retention period below. Self-serve deletion lives in Settings.
• Export your data in a machine-readable format.
• Correct inaccurate information in fields under Cygnus's control. (If you use Google sign-in, your email comes from your Google account, so corrections to that field happen on Google's side.)
• Opt out of analytics at any time.

If you are in the EU, you have additional rights under GDPR, including the right to lodge a complaint with a supervisory authority. Contact Cygnus to exercise them (see §12).

Cygnus will comply with valid legal process. Given the minimal data stored, there is very little to disclose.

If Cygnus becomes aware that your data has been compromised, affected users will be notified promptly.

11. Security and storage

• TLS in transit, with automatic Let's Encrypt issuance via Caddy.
• Session cookie: httpOnly, secure, sameSite lax, 14-day max age.
• Database access restricted to the sole developer; Postgres runs in a container on a single Google Cloud VM, reachable only over the VM's internal network.
• Database files live on a separate Google Cloud persistent disk that is snapshotted automatically once per day with seven-day rolling retention. Snapshots expire within seven days, well within the 30-day deletion window in §10.

12. Changes to this policy

Cygnus may update this policy from time to time. Material changes will be communicated by email to users with active accounts at least 14 days before they take effect. Non-material changes (typo fixes, link updates) take effect when made. The effective date at the top of this page reflects the current version.

13. Contact

For privacy questions, data requests, or to exercise your rights, email support@cygnus.so.