What we hold, and for how long

You gave us the minute you were born. That is not a small thing to hand anyone. This page says exactly what we do with it — no more than is true today, and no less than you'd want to know.

1. What we collect

Argo asks for four things and derives a few more. Nothing here is optional-in-disguise: if we don't list it, we don't have it.

You give us

• Your email address — it is how you sign in and how the reading reaches you. Argo has no passwords.
• Your birth date.
• Your birth time, if you know it. You can leave it blank; we record that it's unknown and compute what can honestly be computed without it.
• Your birth place, as you type it — a city and a region or country.
• Your delivery preference — whether the daily email is on or off.

We derive

• Coordinates and a time zone for your birth place (see §5 — this currently involves one outside service).
• Your natal chart — planetary positions computed with the Swiss Ephemeris, stored so it never has to be recomputed.
• Your readings — the text written for you each day, kept so your archive is there when you open it.
• Your feedback on a reading, if you give it: a signal attached to that reading.

We record about the account

• Where you first arrived from — campaign tags in the link you clicked, the hostname of the site that referred you (never the page or its query), and which page of ours you landed on. Written once, at your first contact, and never overwritten.
• Account events — a sign-in link was sent, a reading was delivered, a setting changed, a checkout was opened. Timestamps and short labels; no content.
• Billing identifiers, if you subscribe — the customer and subscription IDs Stripe gives us, your plan, its status, and when the period ends. We never see or store your card. It goes from your browser to Stripe.

What we deliberately do not collect

• No stored IP addresses. To stop one machine flooding the signup form we compute a one-way keyed hash of the connecting address and count the hashes. The address itself is never written down, and the hash cannot be turned back into it by anyone without our signing key.
• No third-party analytics, no advertising pixels, no trackers — not one, on any page.
• No device fingerprinting, no location, no contacts, no cross-site identifiers.
• No free-text notes about your life. Argo's database has room for "focus areas" and an intention in your own words — a planned feature. Nothing on the site asks for either today, and until something does, those fields stay empty. When they open, this page will say so first, because that text would be the most sensitive thing you could tell us.

2. Why we hold it

• To do the thing you asked for. Birth data exists to compute your chart; the chart exists to write your reading; your email exists to deliver it and to let you back in. This is the performance of our agreement with you.
• To keep the service standing. Rate-limit counters, suppression records and error handling exist so the system isn't drowned by abuse and so we don't keep mailing an address that has bounced. This is our legitimate interest, and it is a narrow one.
• To take money, if you subscribe. Handled by Stripe, kept because tax and accounting law requires it.

We do not profile you for advertising. We do not build a picture of you from anything other than what you typed into the form and what the sky was doing.

3. The visit counter

Argo counts page views. It does it with a small first-party request that is built, deliberately, to identify nobody:

• no cookie, no local storage, no session storage, no fingerprint;
• the visit identifier is a random value generated fresh on every page load, held in memory, and never saved anywhere on your device;
• the handler never reads your IP address — not to store it, not to hash it, not at all;
• it stores the path you're on (never the query string), the hostname of the site that referred you (never the page), campaign tags if the link carried them, and whether your screen is small, medium or large as a single word;
• it is never written to a log, and an automated check in our build fails if anyone adds one.

That is the entire analytics stack. It is why there is no cookie banner on this site: there is nothing to consent to.

4. Cookies

Argo sets exactly one cookie, argo_session, and only after you open a sign-in link from your own inbox. It holds your account identifier, an expiry, and a signature we check on every request so it cannot be forged or edited. It is marked HttpOnly (JavaScript cannot read it), Secure (it is only ever sent over HTTPS), and SameSite=Lax. It lasts 30 days. Signing out clears it immediately.

There are no advertising cookies, no analytics cookies, and no third-party cookies of any kind.

5. Who else touches it

Argo is small on purpose, and this list is the whole of it. Each of these companies processes data on our instruction, under a data-processing agreement.

We do not sell your data. We do not share it for anyone else's advertising. There is no fifth party we have quietly forgotten to mention.

6. How long we keep it

7. How it's protected

• No passwords exist to steal. You sign in with a one-time link that expires in two days and is consumed on use — once it has signed you in, it will never sign anyone in again.
• Everything travels over HTTPS, forced by a strict transport policy — a browser will not connect to Argo any other way.
• A strict content-security policy governs what may run on the page, and the site refuses to be framed by anyone.
• Session cookies are signed and verified on every request.
• Birth data, coordinates and reading text never appear in our logs — not as a discipline, but as an automated check that fails our build if anyone introduces one.
• There is no admin web console. None exists to be phished, guessed or left open. Operations are read-only dashboards and command-line access held by one person.
• Almost no dependencies. The code that touches your data pulls in essentially no third-party packages, which removes most of the supply-chain surface that breaks services like this one.

And the part most services leave out: your birth data is stored as ordinary values in our database today, protected by access controls on that database rather than by a per-record cryptographic lock. A stronger per-record protection is designed and being built; the moment it is live in production, this section will say so and the security page will change with it. We would rather under-claim here than have you trust a word we haven't earned.

8. Deleting your account

You can delete your account yourself, from your sky page, while signed in. You type the word DELETE to confirm — no email exchange, no retention offer, no waiting period. In the same request, in this order:

• If you have a live subscription, we cancel it at Stripe first. If that cancellation fails, the deletion stops and tells you — we will not leave you deleted and still paying.
• We then delete your customer record at Stripe — every one we ever created for you, not only the one attached to a live subscription. That is the record holding your email address and your card fingerprint on Stripe's side.
• We then delete, from our database: your feedback, every reading ever written for you, your computed chart, your birth date, birth time and birth place, your coordinates and time zone, your delivery preferences, any outstanding sign-in links, your subscription record, every event tied to your account, and finally the account row itself.
• We send one confirmation email — after the erasure, not before, so it reports what happened rather than promising it.
• Your session cookie is cleared, and you are signed out everywhere.

It is one code path, it runs the same day, and there is no soft-delete flag pretending to be a deletion. What survives, and why: the backup window in §6 (30 days, unselectable), Stripe's own payment records (legal obligation), Resend's sent-mail window, and the one-way suppression hash — a salted hash of your address, never the address itself — which is written whenever an account is deleted and whenever mail to it bounced or was reported, so that a deletion cannot accidentally start the email again.

The one honest edge, because deletion is where services usually overstate: cancelling your subscription must succeed before anything else happens, but the Stripe customer delete does not block the rest. If Stripe cannot be reached in that moment we record which customer id was left behind and finish erasing your data anyway, rather than refusing to delete you because someone else's service was down — and we clear the leftover by hand. Ask us and we will confirm it is gone.

If you cannot sign in, email us from the address on the account and we will do all of the above for you.

9. Getting a copy of your data

Email [email protected] from the address on your account and ask for your data. You will get a machine-readable file containing your account record, your birth data, your computed chart, your preferences, your full reading archive, your feedback and your subscription history. We will answer within 30 days — usually much sooner. There is no charge.

This is a person doing it, not a button, and we are saying so rather than implying an automation that does not exist. A self-serve export is designed and coming; when it ships, this section changes.

10. Turning the email off

Every daily email carries a one-click unsubscribe. Using it turns the email channel off. It does not cancel a subscription, and it does not delete anything: your readings keep being written and keep appearing on your sky page, where you can turn the email back on at any time. Ending the emails and ending the relationship are different acts, and we will never quietly confuse them.

11. Your rights

Wherever you live, you can ask us to show you what we hold, correct it, give you a copy, or delete it. Email [email protected]; we answer within 30 days.

• We do not sell or share personal information as those terms are defined under California law, and we have not in the preceding twelve months.
• Global Privacy Control is honoured — trivially, because there is nothing to opt out of.
• We will never treat you differently for exercising any of this. There is no worse tier for people who ask questions.
• If you are in a place with a supervisory authority for data protection, you may complain to it. We would rather you told us first.

12. Children

Argo is for people aged 13 or older, and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13, and the floor is enforced at the birth-date field: a birth date that makes the person under 13 is refused before anything is stored. If you believe a child under 13 has given us information, write to [email protected] and we will delete the account and everything attached to it.

13. Where it's processed

Argo is operated from the United States by CognitiveCore Technologies LLC, and your data is processed there. The site is served from Cloudflare's global network, so the request that fetches a page may be handled at a location near you. Our subprocessors operate internationally under their own standard transfer safeguards.

14. Changes to this page

When what we do changes, this page changes first or at the same time — never after. The date at the top is the date of the last change. Two changes are already scheduled and named above: the per-record protection in §7, and the removal of the Open-Meteo row in §5. If a change ever meaningfully reduces your privacy, we will email you before it takes effect.

15. Contact

Contact: [email protected]
CognitiveCore Technologies LLC, a Maryland limited liability company

Argo has one operator. Email reaches him.