Legal

Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data Cosma collects, why, who we share it with, and the choices you have. It covers the Cosma mobile apps and the website at cosma.letsmeyt.com.

Who we are

Cosma is operated by MEYT LTD, a company registered in England and Wales (company number 17366861), Suite 11060, 5 Brayford Square, London E1 0SG, United Kingdom. MEYT LTD is the controller of your personal data. Contact us about privacy at [email protected].

What we collect

Data you give us

• Account: email address, password (stored only as a one-way hash), username, and phone number if you add one.
• Birth data: birth date, and if you provide them, birth time and birth place with its coordinates and time zone. We use these to calculate your chart.
• Content: questions you ask Cosma and the answers, journal entries, and messages you send to support.
• Connections: the email address of anyone you send a friend request to, and the friendships you accept.
• Preferences: notification settings.

Data created when you use Cosma

• Chart and readings: your calculated chart, daily insights, compatibility (“bond”) readings, and reports.
• Usage records: which features you use, request logs (path, status, timing, and your account ID), and records of AI requests, including the prompt and reply.
• Device: a push notification token, if you turn notifications on.
• Billing: your subscription status and credit balance. We do not see or store your card details.

How we use it

• To provide Cosma (performance of our contract with you): create your account, calculate your chart, generate readings and answers, keep your journal, and connect you with friends you choose.
• To take payments (contract): manage subscriptions and credits.
• To keep Cosma safe and working (our legitimate interests): prevent abuse, debug problems, and understand which features are used.
• To contact you (contract, or consent for notifications): sign-in links, account emails, support replies, and daily briefs if you enable them.
• To meet legal obligations, such as tax and accounting records.

Birth data can reveal sensitive things about you when combined with other information. We use it only to provide astrology features you ask for, and you can remove your precise birth details at any time in the app (Settings → Privacy & Birth Data).

AI-generated content

To write readings and answers, we send the relevant parts of your chart and your question to an AI model through OpenRouter, which routes the request to a model provider such as Anthropic. We do not send your email address or password. Providers process this data to return a response. Cosma does not make decisions about you that have legal or similarly significant effects.

Who we share data with

We do not sell your personal data or use it for third-party advertising. We share it only with:

• Service providers that run Cosma for us: hosting and infrastructure (including Cloudflare), AI model access (OpenRouter and the model providers it routes to), email delivery, and push notifications (Google Firebase Cloud Messaging, which also delivers to Apple devices).
• Payment providers: Stripe for purchases on the web, and Apple or Google for purchases in their stores. They handle payment details under their own privacy policies.
• Friends you connect with: once you both accept a friendship, each of you can see the other’s email and username and get a compatibility reading based on both charts.
• Authorities, when the law requires it.

International transfers

Some providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to protect your data.

How long we keep it

We keep your account data for as long as your account exists. When you delete your account, we delete your profile, birth data, chart, readings, journal, questions, friendships, device tokens, and stored AI requests. Request logs are kept without your account ID. Payment providers may keep records they are legally required to keep.

Your rights

Under UK and EU data protection law you can:

• access the personal data we hold about you, and get a copy of it;
• correct data that is wrong;
• delete your data: in the app (Settings → Delete account) or at cosma.letsmeyt.com/request-delete-data;
• object to or restrict some processing, and withdraw consent (for example, turn off notifications);
• move your data to another service.

Email [email protected] to use these rights. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.

Security

Data travels over encrypted connections. Passwords are hashed and sign-in tokens are stored hashed. No system is perfectly secure, so please use a strong, unique password.

Children

Cosma is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We will post any changes on this page and update the date above. If a change is significant, we will tell you in the app or by email.