Privacy Policy

Last updated 2026-07-02

Who we are

Pythia is operated by Gooya UG (haftungsbeschränkt), Gerhard-von-Rad-Str. 9, 90425 Nürnberg, Germany. We are the controller of your personal data under the GDPR. Questions or data requests: email pythia@heypythia.com, or write to the address above. See also our Impressum.

Cookies & how we identify you (no account needed)

Pythia works without a sign-up, using only strictly-necessary, functional cookies and similar browser storage (no advertising or cross-site tracking), so under §25(2) TTDSG they need no consent banner:

  • pythia_uid — a random anonymous identifier (httpOnly, ~1 year). It lets your chart, threads and memory persist between visits on this device; the service can’t work without it. Almost everything below is keyed to it, and clearing it detaches this device from your profile.
  • pythia_taste — set only at the doorway when you try a free sample: it briefly holds the birth date you enter (about 30 minutes) so the sample and the following steps line up. It expires on its own and carries no identifier.
  • A little functional browser storage (e.g. remembering that you dismissed a prompt during a session) — no identifiers, cleared when you close the tab.

What we collect, why, and the lawful basis

  • Birth details & chart (date, optional time/place) — to compute your chart and readings. Your birth date/time/place is personal data. Basis: performance of the service you requested (Art 6(1)(b)).
  • Your conversation & the things you ask Pythia to remember (threads, notes) — to provide a continuous, personalised companion. Basis: Art 6(1)(b).
  • Email address & consent record (the consent text shown, timestamp, IP and browser at the moment you opted in/confirmed) — only if you ask us to email you. Basis: your consent (Art 6(1)(a)); the consent metadata is kept to evidence that consent (Art 5(2)).
  • Payment — handled by our payment provider; we store a purchase record (what, when, amount), never your card details. Basis: Art 6(1)(b), and Art 6(1)(c) for the invoice/tax records we must keep.
  • Product analytics — pageviews, referrer/UTM, device type, and first-party funnel events — to understand and improve the product. Events are recorded against a pseudonymous analytics identifier — a one-way hash derived from your session, never the session id itself. Browser pageviews stay anonymous unless you have confirmed your email, in which case your sessions link to that same pseudonymous hash (never your email or name). Basis: legitimate interests (Art 6(1)(f)). Our analytics is configured cookieless (see below), so it adds no tracking cookies.

Analytics

When enabled, we use an EU-region product-analytics provider. It is configured privacy-first: no cookies or persistent browser storage (in-memory only), profiles only for identified users, session replay off, and no blanket auto-capture. Our server-side events have the raw IP removed before sending; and, as with any web request, your device’s IP reaches the provider’s EU servers, where it is used only transiently to derive an approximate (city-level) location and never to build an advertising profile. Because it sets no cookies and builds no cross-site profile, it operates under legitimate interests without a consent banner, and you can object at any time (see Your rights).

Marketing emails & how to stop them

We email you about your chart (e.g. when a real transit you asked us to watch arrives) only after you opt in and confirm via a link we send you (double opt-in). Every email has a one-click unsubscribe, and you can withdraw consent at any time — it takes effect immediately and does not affect your saved chart or threads. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Who processes your data

We use trusted processors under data-processing agreements. We describe them by role rather than by name; you have the right to ask us for the specific providers we use at any time (your right of access — see Your rights):

  • Cloud hosting & compute — EU region.
  • Database — stores your chart, threads and memory.
  • AI model provider — generating your readings; the prompt context needed to answer is sent to the model.
  • Geocoding provider (EU) — turning the birth place you type into coordinates + timezone.
  • Payment services provider — processing payments.
  • Email delivery provider — sending email, only if you opt in.
  • Product-analytics provider — EU region, when enabled.

Our hosting, analytics and geocoding providers are in the EU/EEA. Others — the AI-model, payment and email providers — are in the United States. Some processing, including of your saved chart, threads and memory, may also take place outside the EU/EEA. Wherever your data is processed outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses (and, where the provider is certified, the EU–US Data Privacy Framework). You can ask us for a copy of these safeguards and for where each provider is located.

Retention

We keep your chart, conversation, and memory for as long as your (anonymous) profile exists so the relationship stays continuous — you can export or erase everything at any time (see below), and clearing the pythia_uid cookie also detaches this device from that profile. Consent and suppression records are kept as long as needed to evidence compliance; payment/invoice records are kept for the statutory period (German tax law, up to 10 years). Analytics events are retained on a rolling basis.

Your rights

You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests (including analytics). You can export or eraseeverything Pythia holds under your pythia_uid from within the app at any time — erase is immediate and permanent. To exercise any right by email, contact us at the address above. You may also lodge a complaint with a supervisory authority (in Bavaria, the BayLDA).

Age

Pythia is intended for users aged 16 and over.

Changes

We’ll update this page if our practices change and note the date above.