Privacy
Last updated August 13, 2026
Orrery is run by Kristen Martino. It is a small tool, and this is a short policy, because it does a small number of things with a small amount of data. Everything below is what the software actually does today — not a description of what it might do later.
What Orrery stores
Only what you type into the setup form, plus what it computes for you:
- Your email address. It identifies you and it receives the email described below.
- Your city or region, and your timezone. Orrery scores windows in your local time; without a timezone the answer is meaningless. The city is stored as the text you typed.
- The approximate coordinates of that city, looked up once. Orrery asks OpenStreetMap where your city is and keeps the answer — roughly a point at the middle of it. This is how it works out which part of the sky was overhead where you are, which is what lets it tell you a good hourrather than just a good day. It is the city’s location, not yours: Orrery never asks your browser for your position, never requests a street address, and would gain nothing from either. If the lookup fails, nothing is stored and your windows are scored without it.
- Your birth date, and your birth time if you gave one. The birth date does two jobs. If you come back on a device that has forgotten you, matching it is how Orrery hands your week to you and not to whoever else knows your email address. And with a birth city it feeds the personal layer below. A birth time is optional and only ever sharpens that layer.
- The city you were born in, if you gave one — and the timezone and approximate coordinates worked out from it. This is what the personal layer runs on, and giving it is entirely optional. Orrery asks OpenStreetMap where that city is and keeps the answer, then works out which timezone was in force there on the day you were born. It resolves the zone rather than asking you, because the rules changed repeatedly over the decades and a wrong answer would be invisible to both of us. A birth date alone names a day, not a moment, which is the whole reason the city matters. As with your current city, it is the city’s location and not yours: Orrery never asks for a street address, a hospital, or exact coordinates and would gain nothing from any of them — what it needs from the place is which sign was rising, and the middle of a city answers that.
- What the personal layer does with all that. It re-orders the same windows Orrery already computed for the sky, moving one down when it runs into something in your chart and up when it echoes it, and it names the reason every time. It never changes the score. The 0–100 number, and the window a shared link shows, are computed without you and mean the same thing for everybody. Give no birth city and you simply get that sky reading, which is the same reading either way.
- Every outlook Orrery computes for you — the decision you picked, the scores, and the astronomical conditions behind them, with the time it was computed.
- If you take the weekly brief: the address and timezone you signed up with, and the token that stops it. The brief’s list never holds birth data.
Looking without signing up stores nothing. You can score a week, or open a window someone sent you, without giving Orrery anything: those pages compute in the moment, in the timezone your browser reports, and keep no record of you or of what they worked out. A link someone shares carries a decision, a date, and a timezone — never who they are, never what they were deciding about.
There are no accounts and no passwords. There is no third-party analytics, no advertising, and no tracking of you across other sites. Orrery does keep a private tally of its own events — that a week was computed, that a brief went out, that a brief link led back here, that someone subscribed or stopped. Each row is a name, a moment, and at most the kind of decision involved: no address, no timezone, no IP address, no cookies, no pixels, and nothing linking one event to another or to you. Counting how often something happened is all any of it can do. Orrery does not sell or share your data, and there is nobody to sell it to.
The email
Signing up triggers exactly one email: about a week after you last used Orrery, it writes once with your next window, and nothing more follows unless you ask for it. The weekly brief is that ask — a separate, optional signup. Taking it sends one email straight away, with what is left of the current week, and then one each Sunday with the week ahead. Every email of any kind carries a link that stops it for good, and you can use that link before the next one arrives. If you unsubscribe, Orrery keeps a record that you did — that record is the thing that stops the email, so deleting it would undo your request.
Who else sees it
Orrery runs on other people’s computers, so a few services handle data:
- Railway hosts the application and the database where the above is stored.
- Vercel serves this website.
- Resend delivers Orrery’s email — the one return nudge, and the brief’s welcome and weekly issues if you asked for them — and therefore handles your email address.
- OpenStreetMap (its Nominatim service) is asked, once when you sign up, where your city is — and, if you gave one, where your birth city is. It receives those place names and nothing else — no email address, no birth date, no account, and nothing that names you. Orrery keeps the coordinates it returns and never asks again.
- Anthropic turns the computed conditions into readable sentences. It is sent the astronomical data and your timezone — not your email address, your birth date, or your city.
How long it’s kept
Until you ask for it to be gone, or until Orrery shuts down, at which point the database is deleted. Orrery is an experiment; if it doesn’t work, it stops, and the data goes with it.
Getting your data, or getting rid of it
Email orrery@kristenmartino.ai and ask. You can ask for a copy of what Orrery holds about you, ask for it to be corrected, or ask for it to be deleted. Deletion means deletion: your row and every outlook computed for you. Orrery will do it by hand — there is no automated button, because there are not many of you and a wrong click would be permanent.
Depending on where you live you may have stronger rights than these under local law. Orrery will honour them; ask.