Privacy and data protection
The short version: a birth chart needs your birth, so Sorsye keeps what you give it and nothing more. It runs on our own server, counts visits with Google Analytics, uses no advertising trackers, sells nothing, and you can see, download or delete everything about you from Settings at any time.
1. Who is responsible
The data controller is Astorva Holdings Ltd, an International Business Company incorporated in the Republic of Seychelles, company number 252040, registered office c/o AAA International Services Limited, House of Francis, Room 303, Ile du Port, Mahé, Seychelles. For anything about your personal data, write to support@sorsye.com.
2. What we keep, and why
If you only visit
Nothing that names you. The doors you open, the screens you see and how long you stay are counted against a random device id that your browser creates and keeps; on our server we store only a hashed form of it, so it cannot be turned back into your device. Sorsye itself does not store your IP address with your visits or your place: the app uses it in memory only, to stop abuse and to note the country the connection came from, keeps just that country, and then forgets the address. Our web server keeps it in its logs for a short time, as described under "To keep the house running" below. The birth details you type to draw a chart are used to draw it and are not saved on the server unless you make a place. On your own device, your browser may keep your chart, your partner and your journal so you find them again; Settings lets you forget them.
If you make a place
Your email address, a hash of your passphrase (never the passphrase itself), your name if you give one, your birth details (date, time and place), the birth details of a partner if you add one, your chart preferences, your journal, and the readings you have unlocked. We also note when you confirmed your email address, because a place opens only once its address is confirmed. These are kept so that your place follows you and so that what you have paid for stays yours. The lawful basis is the agreement between us when you make the place, and your consent when you add a partner's details, which you may only do with their permission.
If you ask the machine
When you ask a question about your chart or ask for a whole dream to be read, the text of your question or your dream, and the reading or the lines of the book it is grounded in, are sent to our language model provider, MiniMax (api.minimax.io), to compose the answer. If you read Sorsye in Sinhala, the answer to a question about your chart is written in English first and then sent to a second provider, Anthropic (the maker of Claude, at api.anthropic.com), to be translated into Sinhala; Anthropic receives only the text of that English answer, not your question, your chart or your birth details. We send the minimum needed and never your name or email. The question, the number of words used and the cost are kept in our own ledger for review and to keep the service affordable; you may ask us to delete your questions, and we can switch the keeping of question texts off entirely.
If you buy
PayPal processes the payment, and holds your card, account and billing details under its own privacy statement. We never see your card. We keep the PayPal order number and capture number, what was bought, the amount, the currency and the time, linked to your place, so we can open what you paid for, send your receipt and keep the accounts the law requires.
The letters we send
We write to you only because of something done in your place: the letter to confirm your email, a passphrase reset, a receipt, a note that your passphrase was changed, a note when the house opens something for you, an invitation if we invite you to try Sorsye, and a last letter when a place is deleted. We keep the address, the kind of letter and the date, so we can tell whether a letter went out. There is no marketing and nothing to unsubscribe from.
To keep the house running
Errors, slow answers and faults are logged so we can fix them. Sign-in attempts are counted to stop guessing. These records are about the service, not about you, and are cleared on a schedule.
Like most websites, our web server writes a line for each request it receives: the time, the IP address it came from, the web address asked for (for a birthplace or dream search, that includes the letters typed) and the kind of browser. These logs stay on our own server, help us keep Sorsye safe and running, and are deleted after 14 days. We do not link them to your place.
If you use the two extra birth-profile slots included with an annual Everything pass, we also keep those names and birth details under your account. They do not create accounts for other people or give anyone else access to your journal. Add someone only with their permission, or as their parent or guardian. These profiles are included in your export and are deleted when you remove them or delete your place.
3. Cookies and storage
Sorsye sets one cookie of its own, and only when you sign in: a session cookie so the server knows it is you, marked httpOnly and secure. There are no advertising cookies.
To see how many people visit and which screens they use, the website uses Google Analytics, a service of Google. It sets its own cookies in your browser (their names begin with _ga) and tells Google the page and screen you are on, the kind of browser and device, and the rough area you are in, worked out from your connection. The web address it receives has any code from our letters taken out, and it never receives your name, your email, your birth details, your readings, your questions or your journal. We have switched off Google's advertising features, so these counts are not used to show you adverts. You can block Google Analytics with your browser's privacy settings or with Google's opt out add-on, and Sorsye works just the same without it. Google handles this data under its own privacy policy.
Your browser's local storage keeps your device id, your theme, the gate word if you ask it to, and a copy of your journal for offline use. When you choose to pay, PayPal's own window loads PayPal's scripts and cookies, under PayPal's privacy statement.
4. Where the data lives, and who else sees it
Our server is rented from Contabo GmbH, a German company, and stands in Europe; it is administered only by Astorva Holdings Ltd. Personal data leaves that server in these cases only:
- a letter to you goes out through our email provider, Hostinger, from support@sorsye.com;
- the text of a question or a dream goes to MiniMax to be answered, and, if you read Sorsye in Sinhala, the English answer to a question about your chart goes to Anthropic to be translated;
- a payment goes to PayPal to be processed;
- visits to the website are counted by Google Analytics, as described under "Cookies and storage" above;
- a Telegram message about the house's own health goes to the company (counts and faults only, never a name, an email or a reading), and when you write to the house through "Tell us what you think", your words go to the company the same way, without your name or email;
- each night an encrypted copy of the whole database is made and kept on a second server rented from Hostinger and on the company's own computer, readable only with a key held by the company; each copy is deleted once it is three days old, except that the newest one is always kept, so there is always one to restore from.
Transfers outside Seychelles are made only to providers bound by their own data protection terms, as the Act requires.
5. How long
| What | Kept for |
|---|---|
| Your place and everything in it | Until you delete it (we do not remove places for inactivity; if that changes, you will be told by email first) |
| A place that never confirmed its email | Until it is confirmed or deleted; you may ask us to remove it at any time |
| Payment records (PayPal order and capture numbers, what was bought, amount, date) | Seven years, as accounting law requires |
| The letters we sent you (address, kind and date) | 400 days; a copy of a letter that could not be sent, 30 days |
| Questions to the machine | Up to four hundred days while the review setting is on; at once when it is switched off, when you delete your place, or when you ask |
| Visit statistics (hashed device id) | Four hundred days |
| Error and fault logs | Ninety days |
| Web server logs (time, IP address, the web address asked for) | 14 days |
| Backups | The nightly encrypted copies: three days, then deleted (the newest is always kept, so there is one to restore from). A safety copy of the database taken on our own server just before Sorsye is updated: deleted within three days |
6. Your rights
Under the Data Protection Act, 2023 you may ask to see the personal data we hold about you, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable form. Most of this you can do yourself in Settings: "show everything Sorsye holds about me" gives you the whole record, "edit my details" corrects it, and "delete my place and everything in it" erases it at once (the payment records the accounts require are kept, but no longer linked to you: the order number, what was bought, the amount and the date). For anything else write to support@sorsye.com from the email of your place and we will answer within thirty days. You may also complain to the Information Commission of Seychelles, the authority under the Act.
The steps to delete your place, on the website or in the Sorsye app for Android, are also on a page of their own: Delete your place.
7. Children
Sorsye is for people of eighteen and over. We do not knowingly keep a place for a child; if you believe one exists, tell us and it will be removed. A parent may save a child's birth details as a family profile in their own place; those details belong to the parent's place and are removed with it.
8. Security
Everything travels over HTTPS. Passphrases are hashed with argon2id and are never stored or seen in the clear. Readings and the books stay on the server and are never sent to the browser as a whole. Access to the server is by key only, and the back room that shows statistics is open only to the company's administrators. If a breach ever touched your personal data, we would tell the Information Commission and you promptly, as the Act requires, and say what happened and what to do.
9. Changes
When this page changes, the date at the top changes with it. If a change is important, we tell you inside Sorsye or by email.