Privacy policy

In short

• We keep only what AstraWin needs to work: your email, your password’s hash, your birth details and chart, your signed-in devices and, if you pay, your payments.
• No advertising, no selling or renting of your data.
• Google Analytics runs only if you accept it in the cookie banner, and you can withdraw at any time.
• To keep AstraWin working we record errors and count page visits with tools we run ourselves, on our own servers, without cookies and without storing your IP address.
• You can download everything we hold about you, or delete your account, from Settings at any time.

Who is responsible

The controller of your data is Unimaxim Ltd, [Registered address], company number (EIK) 208085613, VAT number [VAT number] (“AstraWin”, “we”). For anything about your data, write to [email protected]. We answer within one month.

What we collect and why

Your account

Your email address, a one-way hash of your password (never the password itself), whether you confirmed your email, and the date and version of these terms and this policy you accepted. We need them to give you an account and keep it yours. Legal basis: performing our contract with you (GDPR Art. 6(1)(b)).

Your birth details and chart

Your date of birth, your time of birth if you know it, your birthplace as coordinates rounded to about 1 km, and its time zone, plus the chart calculated from them. They are the service itself: without them there is no chart. We use them only for your chart and the readings built on it, and never to profile you for anyone else. Legal basis: performing our contract with you (Art. 6(1)(b)).

Your signed-in devices

For each device you sign in on: its IP address, the identification string its browser sends (user agent), and when it was first and last used. They let you see and sign out your devices in Settings, and help us stop someone using a stolen session or guessing passwords. Legal basis: our legitimate interest in keeping accounts secure (Art. 6(1)(f)).

Password reset requests

When you ask for a reset link: a hash of the link’s code, when it was asked for and used, and the IP address that asked. They make sure a link works once, for 30 minutes, and let us spot someone requesting links for other people’s accounts. Legal basis: performing our contract (Art. 6(1)(b)) and security (Art. 6(1)(f)).

Pro and payments

If you subscribe to Pro: your plan, its dates and status, the date you agreed to be charged, and for each payment its amount, date, result and Viva’s transaction reference, plus the card brand (such as Visa). Your card number never reaches us: you enter it on Viva’s payment page and Viva keeps it. Legal basis: performing our contract (Art. 6(1)(b)) and our legal duty to keep accounting records (Art. 6(1)(c)).

Emails we send you

We email you only about your account, such as a password reset link. Viva sends you its own receipt for each payment. We do not send newsletters or marketing; if we ever want to, we will ask first.

If you had an account on the earlier AstraWin

When the earlier AstraWin site was replaced on 30 October 2026, we moved its accounts here so you could keep yours. With your account we kept what the old site held: your name, your birth details, birth city and country, the Sun sign it had shown you, and when the old account was created. They are deleted with your account. Legal basis: performing our contract with you (Art. 6(1)(b)).

Keeping AstraWin working: errors, logs and speed

When something goes wrong, we record an error report: what failed, the page it happened on (without the part of the address after a “?”), your browser and operating system, and, for errors on our servers, the number of your account (never your email). Our servers also keep a line for each request (the page, the result, how long it took and your account number) and, to find slow spots, timing records that keep your browser’s identification string and only the network part of your IP address, with its last block set to zero. We measure how fast pages load in your browser and keep only the timings and the kind of page. None of this holds your email, your birth details, your passwords or your cookies. Legal basis: our legitimate interest in keeping AstraWin secure and working (Art. 6(1)(f)).

Page statistics

We count visits with Umami, which we run on our own servers. For each visit it records the page (without the part after a “?”), the site you came from, your browser, operating system, kind of device, screen size, language and the country, region and city derived from your IP address. It stores no IP address, sets no cookies and cannot recognise you on other sites or link a visit to your account. If your browser sends “Do Not Track”, nothing is recorded. We use the counts to see which pages people use. Legal basis: our legitimate interest in understanding how AstraWin is used (Art. 6(1)(f)).

Google Analytics (only if you accept)

If you accept analytics cookies in the banner, Google Analytics records the pages you visit, how you arrived, your browser, device, screen size, language and approximate location, and sets the cookies listed under Cookies below to recognise your browser on later visits. Google does not store your full IP address. It is not linked to your AstraWin account, your email or your birth details, and we use it with Google’s advertising features switched off. If you reject, nothing from Google is loaded. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw from Cookie settings at the foot of any page.

Footballers, coaches and referees

AstraWin shows charts of people in professional football. For them we process their name, date and place of birth, nationality, club, position and photo, which we receive from our football data provider PitchAPI and which come from public sources. We use them only to calculate and show their charts and compare them. Legal basis: our legitimate interest in offering astrology about public sporting figures from data they or their clubs have made public (Art. 6(1)(f)). If you are one of them, you can object at any time by writing to [email protected], and we will remove your chart.

What we don’t do

• No advertising and no advertising networks.
• No tracking pixels or advertising scripts. Google Analytics runs only with your consent, with its advertising features off; our own page statistics (above) cannot follow you anywhere.
• We never sell, rent or trade your data.
• No decisions with legal or similarly significant effects on you are made automatically (Art. 22). Your chart and readings are calculated by software, but they are astrology, not decisions about you.

Cookies and storage

Signing in needs two cookies, which we set without asking:

• aw_at: proves you are signed in. Lasts 15 minutes and is renewed while you use AstraWin.
• aw_rt: keeps you signed in on this device. Lasts 7 days from your last visit and is deleted when you log out.

Both are readable only by our servers, never by scripts on the page, and only over an encrypted connection.

Only if you accept analytics cookies in the banner, Google Analytics sets:

• _ga and _ga_…: tell your later visits apart from other visitors’. Last up to 2 years, and are deleted when you withdraw.

Your answer to the banner is kept in your browser’s storage, never sent to us. Change it at any time from Cookie settings at the foot of every page. Error reports and our own page statistics set no cookies and store nothing in your browser.

Who else processes your data

We keep your data on our own servers in Greece, including the error reports, server logs, timing records and page statistics described above, which run on software we operate ourselves. A few others take part in running AstraWin:

• Cloudflare, Inc. carries all traffic between your browser and our servers and protects them from attacks, so it sees your IP address and the pages you request. It acts as our processor.
• Google Ireland Limited runs Google Analytics for us, only if you accept it. It acts as our processor; Google may transfer the data to the United States under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Viva Payment Services S.A. (Viva Wallet), a payment institution licensed in Greece, takes card payments for Pro. It processes your card and payment details as a controller in its own right, under its own privacy policy and the law that regulates payments.
• [Company that hosts the mail.astrawin.com mailboxes] hosts the mailbox our emails are sent from, so it handles your email address and the emails we send you.
• OpenFreeMap serves the map you use to pick your birthplace. Your browser loads the map directly from it, so it receives your IP address and the map area you view; it does not receive your account or birth details.
• PitchAPI supplies football data and player photos. Your browser loads the photos from its server, which receives your IP address. We never send it data about you.

We give data to authorities only when the law requires it. We have no other recipients, and no one uses your data for their own purposes on our behalf.

Transfers outside the EU

Cloudflare is based in the United States. Transfers to it rely on the EU–US Data Privacy Framework, under which it is certified, and on the European Commission’s standard contractual clauses in its data processing agreement. We transfer no other data outside the European Economic Area ourselves.

How long we keep it

• Your account, birth details and chart: until you delete your account.
• A signed-in device: until 30 days after you log out of it or its session ends.
• Password reset requests: 7 days, used or not.
• Payment records: 10 years, as Greek tax and accounting law requires, even if you delete your account. They are then no longer linked to an account.
• Backups of our database: overwritten after 14 days, so deleted data disappears from them too.
• Server logs: 30 days. They hold your account number, not your email, and no IP address.
• Error reports: 90 days.
• Timing records (with the network part of your IP address): 7 days.
• Page statistics: as long as AstraWin runs. They hold no IP address and cannot be linked to you or your account.
• Google Analytics data (only if you accepted): 2 months, then deleted by Google.

Your rights

Under the GDPR you can:

• See and take your data (Art. 15 and 20): Settings → Your data downloads everything we hold about you as a JSON file.
• Correct it (Art. 16): change your birth details in Settings, or write to us for anything else.
• Delete it (Art. 17): delete your account in Settings. It removes your data at once and signs out every device; only the payment records above are kept.
• Restrict or object (Art. 18 and 21): in particular to processing based on our legitimate interests.
• Complain to the Hellenic Data Protection Authority, Kifisias 1–3, 115 23 Athens, www.dpa.gr, or to the authority where you live or work. We would like the chance to fix it first, at [email protected].

We may ask you to confirm who you are before acting on a request we did not receive from your signed-in account.

Security

Every connection is encrypted. Passwords are hashed with Argon2id (an account moved from the earlier site switches to it at its next login). Sign-in tokens are short-lived and can be revoked from Settings, and repeated failed attempts are slowed down. If a breach ever puts your data at risk, we will tell you and the authority as the GDPR requires.

Children

AstraWin is for adults aged 18 or over. Sign-up checks the date of birth you give, and if you are younger, please don’t sign up. If we learn that someone under 18 has an account, we delete it.

Changes to this policy

When we change this policy, we give it a new version and date and, if you are signed in, ask you to read and accept it before you continue. The terms of use explain the rest of our agreement with you.