Privacy
Last updated October 27, 2026
Orrery is run by Kristen Martino. This policy describes the data stored by the app and the services that process it.
What Orrery stores
Your email when you request a link; your setup details after email verification and confirmation; your decision titles, notes and recorded choices; and what Orrery computes for you:
- Your email address. It identifies you and it receives the email described below.
- Your city or region, and your timezone. Orrery scores windows in your local time; without a timezone the answer is meaningless. The city is stored as the text you typed.
- The approximate coordinates of that city. Orrery asks OpenStreetMap for approximate city coordinates and stores the result. These support the location-based house factor in the hourly scores. Orrery does not request browser geolocation or a street address. If the lookup fails, no coordinates are stored and that scoring factor is omitted.
- Your birth details, if you choose to provide them. Birth date, city, and time are optional. A date and city support the birth-chart comparison below; an exact time adds house calculations. Birth details are not used to recover a setup.
- Saved-outlook titles and archive status. An optional title of up to 80 characters and whether you archived an outlook are stored privately with your library. Renaming, archiving or restoring it does not change its original dates, scores or calculation context.
- Your decision workspace. An activity, title (up to 80 characters), private plain-text notes (up to 2,000 characters), status, archive state, creation and update times, links to your saved outlooks, and any window you choose are stored privately. Notes and titles are never scoring inputs or sent to the explanation model, usage events, public links, or email. Keep notes about your own plans; avoid sensitive details about yourself or others. Choosing a window does not book anything or establish an outcome.
- Verification and recovery records. When you request an email link, Orrery stores a hash of its token, your email address, a setup ID if one exists, and its creation and expiration times. The raw token is sent in the email and is not stored in the database. Each link expires in 15 minutes and can be used once.
- Session records. A hash of the access credential, the setup ID, and creation and expiration times are stored on the server. The credential itself is kept in your browser and expires after 30 days. Using a new email link revokes older sessions.
- The city you were born in, if you gave one — and the timezone and approximate coordinates worked out from it. Birth city is optional. Orrery asks OpenStreetMap for its approximate coordinates, stores them, and determines the timezone for your birth date. With an exact birth time, those coordinates also support Whole Sign house calculations. Orrery never asks for a street address, a hospital, or exact coordinates.
- What the personal layer does with all that. It re-orders the computed windows using astrological comparisons with your birth chart and lists the conditions behind that order. It never changes the score. Scores are calculated without birth-chart data. Saved outlooks can use your current city; shared links show the timezone-only ranking. Without a birth city, no birth-chart comparison is added.
- Every outlook Orrery computes for you — the decision you picked, the scores, and the astronomical conditions behind them, with the time it was computed. New saved outlooks also keep the city label and selection time used then. Editing your setup does not rewrite earlier outlooks.
- If you take the weekly brief: the address and timezone you signed up with, and the token that stops it. The brief’s list never holds birth data.
Previews do not save a personal setup or outlook. They use your browser’s timezone; shared links use the timezone in the link. Anonymous usage events are counted as described below. A shared link contains a decision type, date, and timezone, plus the selection time for a current-week ranking, with no email or birth details. Calendar return links contain the decision type, timezone, and event start and end times. They preserve those times without recomputing a ranking or including your city, profile ID, or birth details.
A verified session is kept in this browser for up to 30 days. Orrery stores only a hash of the session credential on its server. Your setup ID alone cannot grant access. A one-time email link verifies ownership and replaces older sessions. Restoring on another device requires a new link. Setups created before email verification require a one-time review. There is no third-party analytics, no advertising, and no tracking of you across other sites. Orrery does keep a private tally of its own events — that a week was computed, that a brief went out, that a brief link led back here, that someone subscribed or stopped. Each row is a name, a moment, and at most the kind of decision involved: no address, no timezone, no IP address, no cookies, no pixels, and nothing linking one event to another or to you. Counting how often something happened is all any of it can do. Orrery does not sell your data. The service providers listed below process data to host the app, send email, locate cities, and select explanations.
The email
Verification and recovery emails are sent when requested. Each proof link expires in 15 minutes and is consumed after explicit confirmation. If you allow it and sending is configured, a single return reminder may follow a requested outlook after about a week without another request. Allowing it again does not reset an already-used reminder.
The optional weekly brief keeps its own timezone, independent of your setup. Subscribing or resubscribing may send a welcome immediately; weekly issues are scheduled for Sundays when the service is enabled. Manage both preferences in Account or use the unsubscribe link in each email. Stopping retains the record needed to honor your choice. An email already on its way may still arrive.
Who else sees it
These service providers process data to run Orrery:
- Railway hosts the application and the database where the above is stored.
- Vercel serves this website.
- Resend delivers verification and recovery links, the return email, and the brief’s welcome and weekly issues if you asked for them, and handles your email address.
- OpenStreetMap (its Nominatim service) is asked where your city is after you confirm your setup — and, if you gave one, where your birth city is. It receives those place names and nothing else — no email address, no birth date, no account, and nothing that names you. Orrery keeps the coordinates it returns. Confirming a new setup can trigger another lookup.
- Anthropic can select from server-written statements for eligible short, ungrouped outlook explanations. It receives the calculated data, available statements and timezone — not your email address, birth date, city, decision title or notes. Grouped decision searches and feasible-date comparisons use deterministic computed results without a model call. Older saved outlooks retain the explanation and model provenance recorded when they were created.
How long it’s kept
Until you ask for it to be gone, or until Orrery shuts down, at which point the database is deleted. Orrery is an experiment; if it doesn’t work, it stops, and the data goes with it. Email proof links stop working after 15 minutes; sessions stop working after 30 days or when replaced. Expiration does not itself delete every hashed record. Draft setup details stay in the current tab and can be restored for 15 minutes after the last edit; they are cleared after confirmation or an explicit discard. Search drafts stay in the current tab, contain only search settings and are recoverable for up to 30 minutes after the last edit. They are bound to the account that made them, or to anonymous preview use. An owned draft stays hidden during lost access and can be recovered only after the same owner verifies again; explicit sign-out clears it. Older drafts without account context are discarded. An explicit preview-save action may carry those public search settings through verification. Decision edits, including title, notes, status and window choice, are recoverable in this tab for 30 minutes after the last edit. Expired decision drafts are purged on the next owner-matching expiry check, when browser storage allows it. They are bound to the verified owner and decision, are restored only when you choose, and are cleared after a successful save, explicit discard or sign-out. The draft itself stays in the browser; saving the decision or explicitly recording a planned window updates your account. If browser storage is unavailable, the editor warns you before leaving through its links.
Getting your data, or getting rid of it
Email orrery@kristenmartino.ai and ask. You can ask for a copy of what Orrery holds about you, ask for it to be corrected, or ask for it to be deleted. Deletion means deletion: your setup, sessions, decision workspaces and their links, and every outlook computed for you. A data copy includes your decision titles, notes, statuses, choices, and linked outlooks. Orrery will handle the request manually. There is no automated export or deletion button.
Depending on where you live you may have stronger rights than these under local law. Orrery will honour them; ask.