Privacy Policy

Last updated 3 November 2026

This policy explains how Nephomancy handles your personal data. In short: we collect only what the service needs, we do not store your photos, we never sell your data, and we do not use advertising or analytics trackers.

Who is responsible

Dave Holliday, a sole trader based in the United Kingdom, is the data controller. Contact: hello@nephomancy.com.

What we collect and why

• An anonymous account. When you take your first reading we create a random account id and note your time zone, so your daily limit follows your own day. We use a session cookie (nph_session) to recognise your device. It is strictly necessary for the service to work and lasts up to 180 days, or until you sign out.
• Your email address, if you sign in or subscribe. We use it to send sign-in links and to manage your subscription.
• Your sky photo. Your browser shrinks the photo and removes its hidden metadata, including any GPS location, before uploading it. The photo is analysed by AI models running on Cloudflare Workers AI to describe the sky and write your reading. We do not store your photos. If we ever let you save photos, we will ask you first.
• Your readings. We save each reading to your account: the text, the reading style, the date, and a short description of the sky (cloud types, coverage, light, mood and shapes spotted). Plus members can browse their history.
• Your diary (Plus). The date, mood and note you write, and the reading you link to.
• Usage counts. How many readings you have taken each day, to apply daily limits.
• Your IP address. Cloudflare uses it to run the Turnstile human check, which protects the service from bots. To limit abuse we also keep only a one-way hash of your IP address, for a few days, to cap how many new accounts one network can create. We cannot read your IP address back from the hash.
• Payments. Stripe handles payment. We never see or store your card details. We receive your Stripe customer id, your subscription status and your renewal date.
• Founding members and creators. If you were invited as a founding member or creator, we keep a record of your email address, the type of access you were given, and any short note we made about the invitation. We use it only to give you that access.
• The waitlist. If you joined the waitlist, we hold your email address and sign-up time, and use them only to tell you when Nephomancy launches.

Our legal basis

We process your data to provide the service you ask for (contract), to keep the service secure and prevent abuse (our legitimate interests), to keep accounting records (legal obligation), and for the waitlist (your consent, which you can withdraw at any time).

Who we share it with

We use these service providers, who process data on our behalf:

• Cloudflare for hosting, our database, the Turnstile human check, AI analysis of your photo (Workers AI), and sending sign-in emails.
• Stripe for payments.

We never sell your data and we do not share it for advertising. Our landing page and reading page load fonts from Google Fonts, which means your browser contacts Google when you view them. We may disclose data if the law requires it.

International transfers

Our providers may process data outside the United Kingdom. Where they do, they rely on recognised safeguards such as the UK International Data Transfer Addendum or standard contractual clauses.

How long we keep it

• Account, readings and diary: until you ask us to delete them.
• Sign-in links: they expire after 15 minutes, and unused or old ones are deleted.
• IP address hashes: a few days.
• Payment and accounting records: as long as the law requires.
• Member invitations: until your access ends or you ask us to remove it.
• Waitlist: until we launch and have told you, or until you ask to be removed.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service. To delete your account and its data, email hello@nephomancy.com from the address you signed in with (or tell us the email on the account). We will delete it within 30 days of confirming it is you. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we hope you will contact us first.

Children

Nephomancy is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy we will post the new version here with a new date, and we will tell subscribers about significant changes.