Last updated: 17 October 2026
My Cosmic Code is an astrology, numerology, and dream-journal app that runs almost entirely on your device. This notice explains, in plain language, exactly what the app does and does not do with your information. Every statement below is checked against the code that ships with this version. If a future version changes how data is handled, this notice changes in the same release — a privacy promise that outlives its truth is worthless.
The short version: the app has no account server, no cloud sync, and no analytics. Everything you enter is stored on your phone, and that includes anything you dictate — voice recognition is required to run on your device.
Controller: Krist Code Taylor, a sole proprietorship (obrt) established in Croatia, which publishes My Cosmic Code. Because the app stores data only on your own device, there is no central database of users; the "controller" designation applies to the published software and the decisions about how it processes data, not to a server holding your information.
Questions about privacy: kristcodetaylor@gmail.com
Supervisory authority: Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, Croatia — azop.hr. This is the Croatian data protection authority, and it is where a complaint would be lodged. It applies because the controller is established in Croatia; if that ever changes, this section changes with it.
You may choose to enter the following. All of it is optional; the core chart and numerology features are usable without providing any of it beyond your own birth date.
The app also derives values from the above (for example, your life-path number or a planet's sign). These derived values are computed on your device and stored on your device alongside the inputs.
All of it is stored only on your device, in the app's private storage (AsyncStorage, protected by your operating system's app sandbox). For transparency, here is the complete list of on-device storage keys and what each holds:
| Storage key | What it holds |
|---|---|
mcc.profile.v1 | Your own birth data |
mcc.journal.v1 | Your journal entries |
mcc.account.v1 | Optional local account: email + a locally-computed password check value (see The optional local account) |
mcc.session.v1 | Whether you're currently signed in to the local account (no personal data itself) |
mcc.compatibility.partner.v1 | A partner's birth data, if you've added one |
mcc.futureview.saves.v1 | Any Future View readings you've chosen to save |
mcc.deck.readings.v1 | Any Deck readings you've chosen to save |
mcc.reminder.v1 | Your local reminder time and whether it's on |
mcc.transitAlerts.v1 | Whether transit notes are on — nothing else |
mcc.locale.v1 | Your language choice |
mcc.recentSearches.v1 | Text you've typed into in-app search, kept so you can see your own recent searches |
mcc.lastExport.v1 | The timestamp of your last export, nothing else |
mcc.entitlement.v1 | Which plan you have and whether you were an early user who keeps Max free — no payment details |
mcc.cosmicReport.saves.v1 | Any Cosmic Reports you've chosen to save |
mcc.onlineVoiceConsent.v1 | Whether you allowed online dictation for a language with no offline model — only your yes or no |
mcc.identSeen.v1, mcc.tutorialSeen.v1, mcc.timelineGuideSeen.v1, mcc.ambientMuted.v1 | Interface flags — not personal data |
Nothing, for everything above, with a few narrow, explained exceptions. This app has no account server, no cloud sync, no backup service, no crash reporting, no analytics, no advertising, and no third-party SDK that phones home on your birth data, journal text, account, partner data, or saved readings. There is no code in the app that sends any of that anywhere.
Android backup. Version 1.2.21 and later do not let Android copy the app's data into your Google backup or move it to a new phone. Versions up to and including 1.2.20 left Android's standard automatic backup switched on: if backup was on for your phone, Android could include the app's storage in your Google account backup (on current Android versions encrypted with your screen lock) and restore it after a reinstall. We never had access to that backup. You can delete it in your Google account's backup settings.
The exceptions:
If you tap the microphone in the journal capture sheet, the app uses your operating system's built-in speech-recognition service to turn your speech into text — the same service any keyboard's dictation button would use. The app is configured to prefer Android's Google-provided recognition service.
Since 5 August 2026 the app requires this to run strictly on your device. Every time it starts listening it demands on-device recognition, so your voice is not sent to Google or to anyone else for transcription. The transcript is then handled exactly like typed text: stored only in your journal, on your device, nowhere else.
The honest cost of that choice: if your phone has no offline language pack for your language, dictation will not work, and the app tells you so. It does not quietly fall back to sending your voice to a server. Since 5 August 2026 the app also offers to download that pack for you — Android fetches it, and dictation then runs entirely on your phone. You can still install it yourself in Android's speech settings, or type instead.
One exception, only with your yes (since 28 September 2026). Some languages have no offline model on some phones at all — Croatian on current Android phones is the known case — so there is nothing to download. For such a language only, the app asks you, in the capture sheet, whether your voice may go to Google's speech-recognition service so it can be written down. Only after you tap Allow and speak does it do so, and only while Speak is listening. The audio goes from your phone's speech service to Google, not to us: we never receive, see or store the recording, and the transcript stays in your journal on your device like typed text. Google processes the audio under its own privacy policy. You can withdraw that permission at any time with Stop allowing in the same sheet; languages your phone can transcribe offline never take this path.
The app asks your device which packs it actually has before it starts listening, and only ever falls back between regions of the same language (for example Croatian as spoken in Bosnia). It will not transcribe one language with another language's recogniser, because that does not fail — it silently produces nonsense.
Before 5 August 2026 this was not forced, and on some phones Android's speech service may have sent dictated audio to Google for transcription — the same way its keyboard dictation does. Nothing else in the app ever transmitted anything, and any resulting transcripts stayed in your journal on your device.
If you tap Here in the Night Sky, the app asks Android for your approximate location, good to within a few kilometres. The app never asks for precise or background location. It uses the location on your device to draw the sky above you, and keeps it only while that screen is open. It is not stored and not sent anywhere. If you say no, the Night Sky works the same with your birth place or a city you choose. You can withdraw the permission at any time in Android's settings. Android works the location out itself, with its own location service (on most phones, Google's) and under its own location settings; the app only receives the result.
Point at the sky asks for the same permission, so that the compass can use true north. While it is on, the app also reads your phone's compass and motion sensors to know where the phone points; those readings stay on the phone too and are not kept. Once you have allowed location, the Night Sky opens over where you are, without asking again.
If you use Compatibility, you provide a second person's birth data. That person is not a user of this app and has not agreed to this notice themselves. That data is stored on your device only, in the same way your own data is, and is never transmitted. If you enter another person's data, you are responsible for having a lawful basis to do so (for example, their consent, or a legitimate personal/household-activity basis) — the app has no way to verify this and stores whatever you enter.
Registering does not create a real, cross-device account. There is no server to verify a credential against. The email and password you enter are checked only against a copy stored on this device (mcc.account.v1), and the password is protected by a fast, non-cryptographic check value — good enough that it isn't stored as plain text, not the kind of protection a real backend account uses (which would use a proper cryptographic hash such as bcrypt or argon2). "Forgot password" does not send an email — there is no mail server — it simply lets you reset the locally-stored value after re-entering the same email. Treat this account the same way you'd treat any other data on an unlocked phone: it protects against casual access, not against someone who has your unlocked device or a copy of its storage.
If you buy a subscription, Google Play handles the whole payment: your card or other payment method, billing address and the charge itself. Google does this as an independent controller under the Google Privacy Policy. We never receive your payment details.
What the app keeps: only the purchase state — which plan is active — which it reads from Google Play on your device when you open the plans, buy or restore, and, once you have done any of those, each time the app starts. It keeps a short local copy (mcc.entitlement.v1) so the screen does not flicker. It is not sent anywhere by us. The app checks the purchase on your device; there is no server of ours that verifies it. If you never open the plans, the app never contacts Google Play's billing service at all.
What we see: Google Play shows the publisher an order record for each purchase — order number, product, price, currency, country and date. It does not include your name or card. We use these records only to handle refunds, answer your questions and keep the accounts that tax law requires, and we keep them for as long as that law requires.
Legal basis: performance of the contract you enter by buying (Article 6(1)(b)) and our legal obligation to keep accounting records (Article 6(1)(c)).
To cancel or manage a subscription, use Google Play → Payments & subscriptions. Deleting the app does not cancel it.
mycosmiccode.app (this site, including the dream dictionary) is hosted on GitHub Pages, a service of GitHub, Inc. (a Microsoft company). To deliver a page, GitHub necessarily processes technical request data — your IP address, the page requested, the time and your browser's user agent — as our hosting provider, under GitHub's privacy statement; GitHub may process it in the United States under the EU–US Data Privacy Framework. Our earlier address, my-cosmic-code.web.app, on Google Firebase Hosting, only forwards you to this site; for that, Google processes the same request data under its data processing terms. We use this data only to deliver and protect the site (legitimate interest, Article 6(1)(f)). Counting visits, only if you say yes. On your first visit the site asks whether we may count visits with Google Analytics 4. Google Ireland Limited provides it as our processor under Google's data processing terms; Google may process the data in the United States under the EU–US Data Privacy Framework. Until you choose Yes, nothing from Google is loaded. If you do, Google Analytics sets its own cookies (_ga…) and records which pages you open, your approximate location (country and city, worked out from your IP address, which Google Analytics 4 does not store), your device type, browser and language, and how you arrived (a search or a link). We use this only to see which pages help people. It is kept for 2 months; Google signals and every advertising feature are switched off; and it is never combined with anything else — the app sends us nothing, so there is nothing to combine it with. Legal basis: your consent (Article 6(1)(a) GDPR, and for the cookies the Croatian Electronic Communications Act, which implements Article 5(3) of the ePrivacy Directive). You can change your mind at any time with Cookie settings at the bottom of every page, which also deletes the Google Analytics cookies. Your answer itself (yes or no) is kept in your browser's local storage so we do not ask on every page; it is never sent. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as No and do not ask. The site shows no advertising, and fonts and images are served from the site itself. The calculators on the service pages work out their results in your browser: what you type there is not sent to us or anyone else, not stored, and gone when you close the page. Links to Google Play and Facebook take you to those services only when you tap them, under their own privacy policies.
For users in the European Economic Area, we note the following under the General Data Protection Regulation:
Because processing happens on your device, much of the GDPR's machinery around transfers, processors, and breach notification has limited subject matter here. See the internal Record of Processing Activities for how this is tracked.
Until you delete it. There is no server-side copy and no automatic expiry. Your data remains in the app's private storage until you remove it in-app or uninstall the app, which removes all of the app's on-device storage. (Up to version 1.2.20, a copy could remain in your Google backup — see Android backup above.)
Order records in Play Console, if you buy a subscription: as long as tax law requires (see Purchases).
All of these are available directly in the app, free, with no account required and no gate:
Because there is no account server, you do not need to contact anyone to exercise these rights, and there is no identity-verification step: the data is already, and only, in your hands.
My Cosmic Code is not directed to children. It is intended for users aged 16 and older — which is also the age of digital consent under GDPR Article 8 in Croatia, where the controller is established. We do not knowingly collect information from children — and, structurally, we do not collect information from anyone on any server.
Since 5 August 2026 setup asks and refuses: the birth date you enter for your chart is checked, and if it puts you under 16 the app does not continue. No separate age question is asked, because your birth date already answers it.
Be clear about what that gate is and is not. It is an honest check, not a verification: nothing stops someone from typing a different year, and we do not attempt to detect that. It means the app asks rather than looking away. Please also do not let a child enter another person's data via Compatibility without a parent or guardian's involvement.
Your information is protected by your device's operating-system app sandbox, which keeps one app's private storage from being read by other apps, and by any device-level protection you have enabled (passcode, biometrics, disk encryption). See the internal Security Policy for the technical detail behind this notice's claims.
The strongest security property of this app is architectural: for the data covered by the "nothing transmitted" section above, there is no server to breach. Data that never leaves your device cannot be intercepted in transit or exposed in a company data breach, because there is no transit and no company database for that data.
If the app changes in a way that affects privacy — most importantly, if any future version adds cloud sync, a real account server, or any new server-side processing — this notice will be updated in the same release that introduces the change, and the "Last updated" date above will change. Material changes will be reflected in the app's in-app privacy screen as well. Continuing to use a version whose notice has changed constitutes acknowledgement of the updated notice for that version.
kristcodetaylor@gmail.com. This is the only channel needed for most requests; there is no central account system, so there is no login help or password-reset queue to route beyond what's already available in-app.
Provider (trader): Krist Code Taylor, sole proprietorship (obrt), Braće Stipčić 34, 51000 Rijeka, Croatia · OIB (Croatian tax number) 79241136189 · MBO 119015504 (Obrtni registar) · kristcodetaylor@gmail.com