Privacy policy.

Starlit Mirror is a trading name of Hermes Horizon, ABN 12 273 187 245. Our postal address is Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia. We are the data controller for the information described here. You can reach us about anything on this page at support@starlitmirror.com.

Your birth details: date, time and place of birth. This is the only thing a chart can be computed from, and it is the most personal thing we hold.

Your email address, and your name if you give it. Your messages to Mira, and her replies. Your purchases and which readings you own. Technical information every website receives: your IP address, your browser, and which pages you opened.

We do not ask for your gender, your address, your phone number, or anything about your health, beliefs, politics or sexuality, and you should not send them to us.

Birth details, to compute your chart and write your reading. Your email, to deliver what you bought and to answer you. Your messages, so the conversation makes sense and so Mira can refer back to what you asked. Payment records, because we are required to keep them.

Where the GDPR applies, our lawful bases are: performing the contract you entered when you bought or signed up; your consent, for the weekly letter and for advertising cookies, both of which you can withdraw at any time; our legitimate interest in keeping the site running, safe and measurable; and legal obligation for tax and accounting records.

We do not trade or rent your personal data to anyone. We do pass it to the service providers who run Starlit Mirror, each receiving only what it needs to do its job.

If you accept cookies, a hashed form of your email address also goes to Meta, Google and TikTok so we can tell whether an advertisement led to a reading. Under California law that counts as sharing. Declining cookies stops it, and you can change your mind at any time from the cookie choice on any page.

Starlit Mirror also answers inside AI assistants, such as Meta Muse, ChatGPT and Claude, through the Starlit Mirror connector. When you ask one of them about your chart, the assistant sends the connector your birth date, time and place along with the question, and the connector sends back the computed chart.

Asking costs nothing and stores nothing. The free tools keep no account, no history and no copy of your birth details. So that the assistant can ask a follow-up in the same conversation, the connector hands back a chart reference: your birth details, encrypted with a key only we hold, which stops working after 24 hours. The assistant holds it; we keep no copy and cannot look it up.

If you ask it to, the assistant can also remember you between conversations, so it does not have to ask for your birth details again. It does this by keeping a Starlit Mirror token in its own memory: your birth details, encrypted with a key only we hold. We store nothing on our side for it. The token stops working after 12 months, and you can delete it from your assistant’s memory at any time.

If you buy a reading through an assistant, we keep what is needed to deliver it, exactly as for a purchase on starlitmirror.com: the birth details and name the reading is for, your email address, and the order. A gift bought this way keeps, instead of birth details, the first name of the person it is for and your short message to them, until they redeem it and give their own. The text of every paid reading is written by Google’s language model (listed in the table above), which receives the computed chart and the birth details and name the reading is for; the free tools use no such model. The rest of this policy then applies to all of it, including how long we keep it and how to have it deleted. You approve each purchase yourself, and Stripe takes the payment, through its Link checkout. Stripe receives your email, the amount and an order reference, never your birth details. A purchase made in an assistant does not add you to marketing email: you receive the receipt and the reading.

Two providers handle these requests. Google Cloud hosts the connector, in the United States; its request logs keep the IP address and the path of each request, but never what was sent. Stripe takes payment, as above. A place name you give is looked up in our own copy of GeoNames place data, on our servers, so it is not sent to anyone. The connector’s own log records only which tool was called, whether it worked and how long it took.

Nothing the connector receives is sold, used for advertising or used to build a profile of you.

The company behind the assistant is responsible for its side on its own account. For Meta Muse, Meta is an independent controller: it receives everything you tell Muse, your birth details included, and everything the connector sends back, and its own privacy policy, not ours, governs what it does with them. The same holds for any other assistant and its provider.

We keep each kind of information for as long as it is doing a job, and no longer.

To be straight with you about how this works today: these periods are our policy, and we apply them when you ask us to. Automatic deletion on a schedule is not running yet. We are building it, and until it is live, asking us to delete your data is what ends these periods, and we do it within 30 days. The only exception is where the law requires us to keep a record of a sale.

You can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for advertising measurement, and ask us not to email you. Where the GDPR applies you can also ask us to restrict or port your data, and you can complain to your local supervisory authority. In Australia you can complain to the Office of the Australian Information Commissioner. In California you have the right to know, delete, correct, and opt out of sharing, and we will not treat you differently for using any of them.

A copy you can take away is self-service, and you do not need an account for it. If you are signed in it downloads straight away. If you are not, or if you bought a reading without ever creating an account, the same page emails a code to the address you bought with and then hands you the file.

Download everything we hold about you as a single file, up to three times a day.

You can delete your account yourself, from the same page you download your data. Your access stops straight away and everything we hold under your email is erased thirty days later. Those thirty days are yours to change your mind in: the email we send carries a link that brings it all back with one tap.

If you bought a reading without ever making an account there is nothing to sign into, so email support@starlitmirror.com and a person will do it for you. Write from the address you bought with. Use the same address to have anything corrected, or if something in your data looks wrong. We answer within 30 days.

Deleting your data ends the retention periods above early, except where we are required by law to keep a record of a sale. That record keeps the order number, the amount and the date; your birth details and your contact details come out of it with everything else.

Unsubscribing is faster than either: every marketing email has an unsubscribe link at the bottom, and it takes effect immediately.

Delete your account from the same page as your data download.

Starlit Mirror is for people aged 18 and over. We check the birth date you give us and refuse to compute a chart for anyone under 18. We do not knowingly collect anything from a child. If you believe a child has given us information, write to support@starlitmirror.com and we will delete it.

Data is encrypted in transit and at rest by our hosting and database providers. Access to production data is limited to the people who need it. Sign-in is by emailed code, so there is no password of yours for us to lose. We screen for bots and we rate limit the free surfaces to slow down abuse, though we will not pretend that rate limiting is a hard guarantee rather than a brake.

No service can promise perfect security, and we will not. If something happens that puts your data at risk, we will tell you and the relevant regulator as the law requires.

We are an Australian business and most of our providers are in the United States, so your information is stored and processed there. If you are in the EEA or the UK, that is a transfer outside your region, made under the standard contractual clauses our providers offer. Ask us and we will tell you which apply.

If you need a signed data processing agreement, we offer one on request. Our data processing page sets out what it covers and how to start it.

Data processing agreement on request, at no cost.

If we change this policy we will change the version at the top of this page. Material changes will be told to you by email if we have your address.

Write to us at support@starlitmirror.com, or Hermes Horizon, Suite 329/98-100 Elizabeth Street, Melbourne VIC 3000, Australia.