Privacy policy
Version 2.0, effective October 1, 2026
This policy explains what personal data Desidera collects, why, on what legal basis, who helps us process it, how long we keep it and what your rights are. It follows the EU General Data Protection Regulation (GDPR).
The short version
- Your journal is yours. Questions, readings, notes and names are encrypted before we store them, and everything is hosted in the EU.
- To write a reading, we send your question and cards to our AI provider, with the names of the people you saved replaced by placeholders. Your journal is never used to train AI models.
- We never sell your data and show no ads.
- Analytics only run if you accept them.
- You can download everything we hold about you, or delete your account and all of it, from your settings at any time.
What we collect and why
Waitlist
If you join the waitlist, we store your email address, your language, whether you agreed to news and offers (and when), the campaign tag of the link you came from, if any, when you confirmed your email, and a salted hash of your IP address that helps us stop abuse. We don't store your IP address itself.
We use this to confirm your signup and to tell you when Desidera launches, and, if you ticked the box, to send occasional news and offers.
Legal basis: your consent (art. 6(1)(a) GDPR). The IP hash is used for our legitimate interest in preventing abuse (art. 6(1)(f)).
Your account
To create an account, we need your email address. If you sign in with Google, Google shares your email address, name and profile picture with us; we use only the email address, and keep the rest as part of the sign-in record. We also store when you confirmed that you are 18 or older and accepted the terms, and when you last signed in.
In your settings you can add a name for Vesper to call you, your language, time zone, preferred tone, whether to include reversed cards, and, optionally, your birth date, which we use for your birth card and numerology.
Legal basis: performing our contract with you (art. 6(1)(b)). Your email address is required to create an account; everything else in your settings is optional.
Your journal
When you use Desidera, we store what you put in your journal: your questions, the cards drawn, the readings Vesper writes, your notes on readings and cards, the people you add and how they relate to you, the topic you choose, how you felt before and after a reading, your rating of a reading, and what happened later when you answer a follow-up. We also record the date and moon phase of each reading.
So that later readings can connect to earlier ones, Vesper keeps a short summary and a list of things it remembers, such as themes, goals and the people involved. You can see and delete these under "What Vesper remembers" in your settings. To find related readings, we also store search indexes (embeddings): lists of numbers calculated from your pseudonymised questions, readings and memories. They can't be turned back into text.
Legal basis: performing our contract with you (art. 6(1)(b)).
Sensitive data. A spiritual journal can reveal things about your religious or philosophical beliefs, your health, your sex life or your sexual orientation. The GDPR calls these special categories of data. We process them only with your explicit consent (art. 9(2)(a)), which you give with a separate checkbox when you create your account. You can withdraw it at any time by deleting the entries concerned or your account. Because the journal can't work without it, withdrawing consent for the journal as a whole means deleting your journal. Withdrawal doesn't affect anything we did before.
Before publishing: add the separate, unticked explicit-consent checkbox to sign-up (and ask existing users), store when it was given, and block the journal without it. Until then this section describes something the product doesn't do yet.
People you write about
You can add people to your journal, for example a partner or a colleague, so Vesper can refer to them. We store their name (encrypted) and the type of relationship you chose. We use this only to provide your journal to you. We never contact these people, never build profiles about them and never combine their data across accounts.
Legal basis: our legitimate interest in providing the journal you asked for (art. 6(1)(f)). Please only add what you need. Deleting a person deletes what Vesper remembers about them.
AI readings
Readings are written by Vesper, an AI, not a person. To write a reading, we send our AI provider the instructions for Vesper, your question, the cards our code drew, and the parts of your journal and memory needed for context. Before sending, we replace your name and the names of the people you saved with placeholders such as [Person A], and we restore them when the answer comes back. This works for names you've saved; a name or nickname you never saved is sent as you typed it, so please avoid other identifying details in your questions.
We never send your email address, account ID, IP address or payment details to the AI provider. Before a reading is written, an AI check sorts your question into a safety category so that Vesper can decline topics it shouldn't answer, such as medical emergencies. We store only that category. None of this has legal or similarly significant effects on you, so there is no automated decision-making within the meaning of art. 22 GDPR.
Your journal is never used to train AI models, neither ours nor the provider's. Read more on the About the guide page.
Legal basis: performing our contract with you (art. 6(1)(b)) and, for sensitive data, your explicit consent (art. 9(2)(a)).
Emails
We send emails you need: sign-in links, waitlist confirmation and confirmation that your account was deleted (art. 6(1)(b)). If you opted in, we also send occasional news and offers (art. 6(1)(a)). You can turn these off in your settings or with the link in every such email.
When you write to us, we use your message and email address to answer you, based on our legitimate interest in handling your request (art. 6(1)(f)).
Analytics
If you accept analytics cookies, we use PostHog to record which pages you visit and a few actions, such as joining the waitlist or switching language, together with your language, the campaign tag of the link you came from and technical data such as browser and device type. We don't send your email address, IP address or anything you write to analytics, and PostHog is set to discard IP addresses.
Legal basis: your consent (art. 6(1)(a)), which you can withdraw at any time in the cookie settings.
Security and error tracking
To keep Desidera working and safe, we and our hosting provider process technical data such as your IP address, browser and the time of a request, and we use Cloudflare Turnstile to block bots on our forms. When something breaks, we record the technical error, such as the page and the browser, with personal data such as email and IP addresses removed before the report is stored.
Legal basis: our legitimate interest in running a secure, working service, preventing abuse and fixing errors (art. 6(1)(f)).
Payments
When paid plans launch, our payment provider processes your payment details; we never see your full card number. We keep records of purchases and invoices because tax and accounting law requires it (art. 6(1)(c)), and use them to provide what you bought (art. 6(1)(b)).
Name the payment provider, say whether it acts as our processor or as an independent controller (a merchant of record is a controller), and list it under "Who helps us".
Our legitimate interests
Where we rely on legitimate interest, we have weighed it against your rights. Each use is limited to what is necessary: abuse prevention stores only a hash of your IP address, error reports are stripped of personal data, logs are short-lived, and the names of people you write about stay encrypted in your own journal, are never used for anything else and are deleted with it. Using data this way is something you can reasonably expect from a service like ours. You can object at any time (see "Your rights").
Who helps us
Your data is stored in the EU (Frankfurt, Germany). We use service providers who process data only on our behalf and under a data processing agreement:
| Provider | What for | Where the data is |
|---|---|---|
| Supabase, Inc. | Database and sign-in | EU (Frankfurt) |
| Vercel Inc. | Hosting | EU (Frankfurt); pages are delivered from worldwide |
| Anthropic, PBC | Writing readings with AI | USA |
| Voyage AI Innovations, Inc. (part of MongoDB) | Search indexes for memory | USA |
| Inngest, Inc. | Running background tasks (receives only IDs, no texts) | USA |
| Plus Five Five, Inc. (Resend) | Sending and receiving emails | USA (emails are sent from Ireland) |
| Cloudflare, Inc. | Blocking bots on forms (Turnstile) | Worldwide |
| PostHog, Inc. | Analytics, only with your consent | EU (Frankfurt) |
| Functional Software, Inc. (Sentry) | Error tracking, with personal data removed | EU (Frankfurt) |
If you sign in with Google, Google Ireland Limited processes the sign-in as an independent controller under its own privacy policy.
Where a provider processes data outside the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework if the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses. You can ask us for a copy of these safeguards.
Cloudflare also uses the technical signals Turnstile collects to improve its bot detection, as an independent controller under its own Turnstile privacy addendum.
We may also disclose data to public authorities when the law requires us to.
Confirm against each provider's current DPA and sub-processor list: the legal entity, the data location, Data Privacy Framework certification or SCCs, and for Anthropic and Voyage the retention period of API data and that training is off (see docs/ai-providers.md).
How long we keep it
| Data | How long |
|---|---|
| Waitlist signups you never confirmed | 30 days |
| Confirmed waitlist entries | Until you remove them, or 12 months after launch if you haven't created an account |
| Your account, settings and journal | Until you delete them or your account |
| What Vesper remembers, search indexes | Until you delete them, the reading or person they belong to, or your account |
| Data sent to our AI providers | Only as long as the provider needs to process the request, under our agreement |
| Analytics events | Up to 12 months |
| Error reports | Up to 90 days |
| Server and security logs | Up to 30 days |
| Emails to and from us about your requests | Up to 3 years after the matter is closed |
| Purchase records and invoices | 5 years from the end of the year of the purchase, as tax law requires |
When you delete your account, we delete your data right away. Copies in our backups are overwritten within 30 days.
Before publishing, make the code match this table: a scheduled job that deletes unconfirmed waitlist signups after 30 days and unused waitlist entries 12 months after launch, PostHog and Sentry retention settings, and a check of Supabase backup retention.
How we protect it
Journal text, including questions, readings, notes, outcomes and the names of people, is encrypted with AES-256 before it is stored, and only our application can decrypt it. Every database table is restricted so that each user can reach only their own rows. Search indexes are stored unencrypted so we can search them, but they are calculated from text with names already replaced and can't be turned back into words. Access to production systems is limited to the people who run Desidera.
Your rights
You have the right to:
- get a copy of your data: use "Download my data" in your settings, or write to us
- correct your data: most of it you can edit yourself
- delete your data: delete single readings, people or memories, or your whole account, in your settings; you can also delete your waitlist entry with the link in any of our emails
- restrict processing, or receive your data in a portable format
- object to processing based on legitimate interest, and to direct marketing at any time
- withdraw your consent at any time, without affecting what happened before
Write to hello@desidera.app from the email address of your account, so we can check that the request is yours. We answer within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live, where you work or where you believe your rights were infringed. We'd be glad if you came to us first.
Age
Desidera is only for people aged 18 or over. We don't knowingly collect data from anyone younger. If you believe a child has given us data, write to us and we'll delete it.
Cookies
We only use analytics cookies if you accept them. Details are in our cookie policy.
Changes to this policy
When we change this policy, we update the version and date at the top. If a change matters for how we use your data, we tell you by email or in the app before it takes effect, and ask for your consent again where the law requires it.