What we hold

Anna Vlasenko (ABN 42 183 713 603), of 6/6 Marne Street, Vaucluse NSW 2030, Australia, decides what happens to the data described here and is responsible for it. Write to us at hello@mygoodluck.app.

Your account — your email address, and the name you gave, whether at the door, in the forge, or on the You page afterwards. You can change or remove that name there at any time.

Whether you asked for letters — the tick, the moment you gave or withdrew it, and which screen you were on. We keep the moment because consent has to be something we can show you gave, and the screen because you are entitled to know where you were when you gave it. Nothing is sent to anyone who has not ticked it.

Your chart — the date, time and place you were born, and the place you are living now. This is what tunes an emblem to you: without the hour and the place there is no planetary hour to forge in.

What you believe, if you told us — one answer chosen from a list, asked as the forge's last question and again on the You page, and the moment you gave it or took it back. It is the one thing here you are invited to ignore: nothing asks for it, nothing changes if it stays empty, and pressing your own answer again removes it from your record at once. It is used for exactly one thing — keeping a holy sign that belongs to another faith off the emblem we make for you — and for nothing else.

Your emblems — what you asked for, the intention you named, and everything the forge made from it: the image, its name, the engraved motto and its translation, the spell, and the reading of each mark.

What you agreed to — that you accepted these words and which version, and, against each purchase, that you asked for it to be made immediately. We keep those two because a consent nobody can show is not a consent.

Your purchases — that a strike was bought, what it cost, and the reference Stripe gave it. Never your card number: we do not receive it.

A line per forge — that an emblem was made for you and when, so that what you paid for is what you received and no more. It holds no content.

The ordinary technical record — the logs a web service keeps to stay up and to catch abuse, and a report each time something goes wrong in front of you: what failed, on which page, in which browser, and your account's id, so that if you write to us we can find it. Never what you wrote, your email address, your card or your IP address.

Most of it because we cannot give you what you bought otherwise — the chart makes the emblem, and the account is where the emblem lives. That is the contract between us.

The purchase record because a business has to keep account of what it sold, and because a refund has to be able to find its strike.

The technical record because a service that cannot see its own errors cannot be kept safe or kept working. That is our legitimate interest, and it is limited to that.

The occasional letter about new things, only because you ticked the box asking for it. That is consent and nothing else, so you can take it back at any moment and nothing else changes — refusing has never cost anybody anything here, and never will.

What you believe, only because you chose to say it. A law does name that one — it is the single thing here that counts as a special category — and the only ground we hold it on is your express choice, made in one tap and undone in the same one. It does one job: your emblem is never cut with a holy sign belonging to a faith that is not yours, and another mark takes the place of the one left out. The answer itself reaches nobody outside — not Stripe, not Loops, not Google, and not the model that draws your emblem, which is told which marks to cut and never what you believe.

Your birth date, time and place are personal to you, but they are not health data, not biometric data and not any other special category — we treat them carefully because they are intimate, not because a law names them.

Supabase — the database and the sign-in that hold your account and everything in it.

Stripe — the payment, and the seller of record for it. They take your card details directly; we never see them. They tell us only that a payment succeeded, for how much, and the address you paid with.

OpenAI — the model that authors your spell and cuts your emblem, and that screens free text for harm before it is used. What you type as your intention is sent there to make the thing you asked for.

Loops — the letters. Every email we send goes through them: the code that signs you in, the one that confirms your address, the reset. If you asked for the occasional letter about new things, they hold your address for that too, and for nothing else.

Google — Analytics, and only if you agreed to it. They receive which pages and which steps you reached, not what you wrote. See Cookies below.

Sentry — the error reports described above, and nothing else. They are held in the European Union, in Germany, and Sentry keeps nothing in your browser to send them.

Our host — the servers this runs on.

We are in Australia, and some of these providers are elsewhere again. Wherever you are, your data crosses a border to reach us; where that border is the EU's or the UK's, the transfer rests on the standard contractual clauses those providers publish and on the same clauses between you and us.

We do not sell your data, and we do not use it for advertising or hand it to advertisers.

Every emblem you strike is private. Nothing of yours is ever published unless you press Share this talisman on that emblem’s own page.

When you do, we make an unguessable link and record the moment you chose to share. Anyone holding that link can see the emblem, its marks, its spell, the sky it was struck under, and what you asked for, in your own words. They can also save a copy of the picture. Your name, your address, your birth details and what you paid are never on that page. The link is not listed anywhere and we ask search engines not to index it, but treat it as public: anyone you send it to can send it on.

You can take it back at any time. Press Stop sharing on the same page and the link stops working for everyone who has it, permanently — sharing again makes a different link. What somebody already saved or copied while it was shared is out of our reach, as it would be with anything you send to another person.

Two of them are not a choice, because without them the thing cannot run: the cookie that keeps you signed in, and a short-lived one that can tie a payment to the browser that made it, so a purchase lands on the right account. They are set only when you sign in or pay — arrive and read, and your browser is given nothing at all.

One is a choice, and it is off until you make it. We use Google Analytics to see which parts of this people use — which questions lose them, whether an emblem is ever woken. It sets a cookie and sends what you do here to Google in the United States, whose transfers rest on the EU-US Data Privacy Framework and the standard contractual clauses. Nothing is loaded and no cookie is written until you say yes.

Nothing you write is ever sent there. Not the intention you named, not your emblem, not a line of its spell, not your address. What travels is which step of the build you reached, which card you chose from a list we wrote, and whether something worked — facts about the product, not about you.

Refusing costs you nothing: every part of this works identically either way, and we do not ask twice in the same breath. You can change your mind whenever you like — Cookies at the foot of the front page reopens the question — and we ask again on our own after six months.

There is no advertising here, no advertising cookie, and nothing sold to anybody. Until August 2026 this page said there were no trackers at all, which was true then and is not now; that is the change, said plainly rather than edited out.

Everything of yours stays until you delete it, and goes when you do. Your account, your chart, your emblems and their images, what you agreed to and your record of what you bought are all erased together — we keep no copy of any of it afterwards, and cannot get it back.

Three things are not ours to erase. Stripe keeps its own record of a payment you made — they are the seller, it is their transaction, and tax law requires them to keep it. If you agreed to analytics, Google holds what it collected for fourteen months from your last visit, after which it is deleted on their side automatically. And Sentry deletes an error report within ninety days of receiving it. Deleting your account here does not reach any of them; ask them directly, or refuse analytics and there is nothing of yours at Google to ask about.

Go to the You page, open Ending it, and type the word it asks for. That erases the account and everything listed above. It is immediate, and we cannot bring any of it back afterwards.

You do not have to ask us, and you do not have to give a reason.

If you have paid for an emblem that was never made, take the refund first — the screen offers it, and deleting the account destroys the record the refund is found by.

The letters, if you asked for them — stop them whenever you like, with the link at the foot of any of them or the tick on your You page. Neither asks you why, and neither touches anything else you hold here. The letters that carry a sign-in code or a receipt are not those, and go on arriving.

What you believe, if you told us — press your own answer again on the You page and it is gone from your record that moment. Nobody asks you why, and nothing else you hold here moves.

You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop, or object to what we do with it. Write to hello@mygoodluck.app and we will answer within a month.

If we handle it badly you can complain to the privacy regulator where you live — in Australia that is the Office of the Australian Information Commissioner, and in the EU or the UK it is your national data protection authority. We would rather you told us first.

A model writes the words on your emblem and draws it. It does not score you, profile you, or decide anything about you, and nothing here is used to judge an application, a price or an eligibility. What you type is used to make the thing you asked for, and for nothing else.

One answer of yours does change something we make, and it is named here rather than left to be discovered: if you told us what you believe, that decides which symbols are kept OFF your emblem. Nothing about you is judged by it, no price and no eligibility moves, and the only direction it can act in is to leave out somebody else's holy sign.

Under the terms of the interface we use, what we send is not used to train the model.

This is not for people under 16, and we do not knowingly hold their data.