Privacy Policy

This is a standard Privacy Policy template, written to accurately reflect what data Talismos actually collects today (verified in the code, not assumed). It does not replace review by a lawyer specialized in data protection law before it counts as a definitive policy.

Last updated: July 22, 2026.

1. Who we are

Talismos is a divination API (astrology today, more systems planned). This policy explains what personal data we collect, why, and what rights you have over it.

2. Data we collect

• Email — used for login and account communication.
• Password — never stored in plain text. We only keep an Argon2id hash, which cannot be reversed to recover the original password.
• API keys — we only store a SHA-256 hash of the key, never the full key. If you lose a key, we have no way to recover it — you'll need to generate a new one.
• Usage data — how many calls each key made, when, and each response's status (200, 429, etc.), to show your consumption on the dashboard and enforce your plan's limit.
• Billing data — if you subscribe to a paid plan, Stripe processes the payment directly. We only store your Stripe customer identifier (stripe_customer_id) and your subscription history — we never see or store your card number.
• IP address — used momentarily to enforce per-minute request limits (abuse protection) and for standard web server logs.

3. What we do NOT collect

Birth data sent to calculate an astrology chart (/v1/birth-chart, /v1/chart-context) is never stored. It exists only during the calculation, in the server's memory, and is discarded immediately after the response. Our request log only records metadata (endpoint, status code, response time) — never the request body.

We don't use third-party tracking cookies, ad pixels, or third-party analytics tools (Google Analytics, Meta Pixel, etc.) — verified in the source code, not just a claim.

4. Cookies we use

• session — a token (JWT) that keeps you logged into the dashboard. Required for the site to work.
• currency — your currency preference (USD/BRL) on the pricing page. Doesn't identify you personally.

Neither is used for cross-site tracking.

5. Who we share data with

• Stripe — processes payments for paid plans. See Stripe's privacy policy.
• Our infrastructure provider (server and database hosting).

We don't sell or share your data with third parties for marketing purposes.

6. How long we keep your data

For as long as your account is active. If you delete your account from the dashboard, your data is permanently and immediately deleted from our database (email, password, API keys, usage history, subscriptions) — there is no retention period afterward.

7. Your rights

You have the right to:

• Access your data — export a copy in JSON at any time from the dashboard.
• Correction of inaccurate data — update your email by contacting us.
• Deletion — delete your account and all associated data at any time, from the dashboard.
• Portability — the data export is provided in a structured format (JSON), ready to use with another service.
• Withdraw consent — deleting your account withdraws consent for the use of your data.

8. Security

• Passwords: Argon2id (a hash function designed to resist brute-force attacks).
• API keys: SHA-256, never stored in plain text.
• Connection: HTTPS/TLS in production.
• Account lockout after repeated failed login attempts, plus a per-IP request rate limit.

9. Children

Talismos is not directed at anyone under 18, and we don't knowingly collect data from minors.

10. Changes to this policy

Material changes will be reflected in the "last updated" date above.

11. Contact

To exercise any of the rights above, or with questions about this policy: talismosapi@gmail.com.