Privacy in the app

This covers the Spisce app. The waitlist has its own notice. The app asks for more than the waitlist did, your birth date, time and place, so this says what happens to each piece and who else touches it. Spisce is run by its founder, Lanre Adebayo, in Toronto, Canada, and Canada’s privacy law (PIPEDA) applies to it.

What we keep

Your account: the email address you signed in with, or the one Apple gave us if you used Sign in with Apple, which can be a private address that forwards to yours. If Apple shares your first name, we keep that too.

Your birth details: the date, the time if you know it, and the place, which we store as a town, its coordinates and its time zone, along with the chart worked out from them. When you change them, the old ones are overwritten.

The people you add: their name, how they relate to you, and their birth details, kept the same way as yours. Please only add someone whose birthday you’re comfortable sharing with us.

What happens on your cards: which cards you were shown, which you opened and kept, the readings written for you, the questions you asked next and when you read them. And your settings: your time zone, how much the readings explain, and how many cards you get each day.

If you listen to a reading: the recording of it, which voice read it, and how far through it you listened.

Around your birthday: where you said you’d be when the Sun comes back (a town, its coordinates and its time zone, to work out the year’s rising sign), the word you kept for the year, and any line you sealed for your next birthday. The sealed line is kept as you wrote it, shown to nobody else, and opened for you a year later.

Anything you send through Feedback, with your phone model, app version and display settings unless you switch that off on the form.

What we don’t keep

Your internet address is used for a few minutes to stop anyone flooding the app with requests, and is never written down. When you search for your birthplace, the search runs on our own server against a list of towns and goes nowhere else. We don’t sell anything about you, show you adverts, or follow you into other apps.

How readings are written

Readings are written by an AI model made by Anthropic, running on Amazon Bedrock, Amazon’s AI service, in the United States. To write yours it is sent your birth details and the chart worked out from them, and for a reading about someone you’ve added, their name and birth details too. It is never sent your email. Anthropic doesn’t receive what we send, and none of it is used to train models. We keep what was sent and what came back, so we can check readings for mistakes.

How readings are read aloud

When you choose to listen to a reading, its words are sent to Google, whose Gemini voices speak it, and the recording goes to Google’s Speech-to-Text, which says when each word was spoken so the app can follow along. Google is sent the words of the reading and nothing else: not your email, and not your birth details, beyond whatever the reading itself says. A reading about someone you’ve added says their name, as you see it on the page, so Google is sent that name along with it. Under Google Cloud’s terms none of it is used to train Google’s models. The recording is kept on Amazon Web Services in the United States, under your account alone, for as long as the reading is, and the app fetches it by a link that stops working after an hour. Nothing is sent to Google unless you press listen, or you have set your readings to open in Listen: then the readings written for your morning are read aloud before you wake, so they play the moment you open them. Switching back to Read stops that. While a reading plays, the next part of it is saved on your phone for a moment, so there is no gap between paragraphs, and it is deleted when the next reading starts.

What you share

Sharing a card, or your sky, as an image hands that image to your phone’s own share sheet, and nothing reaches us. Sharing it as a link sends us the square picture you chose, and we keep it with a short line of our own (the card’s headline, or the signs of your Sun, Moon and Rising) at an address on spisce.com that anyone you send it to can open. The page doesn’t name you and isn’t listed in search engines. Neither the picture nor the line says when or where you were born. Sharing your birthday’s lap as a link also sends the three questions you answered about your year and how many you got, so the page can ask whoever opens it the same three; they’re about your sky, never your birth details. The links you’ve made are in your export, and they stop working when you delete your account.

How we learn what works

We use PostHog to see which screens get used, how long a reading stays open and how far down it is read, which questions get tapped, and when the app crashes. It also records sessions as pictures of the screen with every word and image blanked out, so we can see where someone got stuck without seeing what they were reading. PostHog knows you by an account number, never by your name or email, and its servers are in the United States.

Notifications

If you turn them on, your notifications are scheduled on your phone itself: the morning one, whose line comes from your own cards, and a few a year for your Wrapped (your month on the 1st, a week before your solar return, and the return itself). None of them is sent through our server. For the return, your phone asks our server for its exact time in the week before.

Who else handles it

Amazon Web Services runs our server and the reading model, and Neon stores the database, both in the eastern United States. Resend sends sign-in emails, Apple handles Sign in with Apple, Google reads readings aloud when you ask it to (or ahead of time, if your readings open in Listen), and PostHog measures how the app is used. Each sees only what its work needs, and is bound to use it only for that and to protect it at least as well as this notice does. Using the app means your information is stored and processed in the United States, where the law on getting at it can differ from Canada’s.

Delete your account and everything goes with it.

YOU → DELETE ACCOUNT removes your account, your birth details, everyone you’ve added, your cards, your readings and their recordings, and the pictures behind any links you’ve shared, straight away, and disconnects Sign in with Apple. To change your birth details, use CHANGE beside them on the same screen. On the People tab you can remove anyone you’ve added: their readings stop at once, and their details and their readings’ recordings are deleted within a day.

EXPORT EVERYTHING tells you what we hold. For a full copy, or to have anything corrected or deleted, or to object to how we use it, write to hello@spisce.com and we’ll answer within thirty days. You can withdraw your consent at any time by deleting your account. If you’re not happy with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

How long we keep it

For as long as you have an account. Sign-in codes stop working after fifteen minutes. Copies of the database taken before we change it are kept for up to thirty days, so something you delete can take that long to leave them.

Children

Spisce is not for anyone under 16. If you think a child has signed up, tell us and we’ll delete the account.

Changes

When this changes, the date at the top changes with it, and anything that changes what we collect will be said in the app before it happens. Questions go to hello@spisce.com, and anything formal or legal to work@spisce.com.