What we collect
When you create or use a Bad Moon account, we process your email address and authentication information. During onboarding, you provide a first name and birthday. The app requires users to be at least 13 years old. Your birthday is used to determine a Western tropical Sun sign.
The app calculates deterministic astrology context on-device, including planetary positions, planetary signs, the Moon phase when available, and major aspects. For generation, the app sends the first name, Sun sign, calendar date, Moon phase when available, planetary placements, aspects, and recent reading summaries to the Bad Moon Edge Function. Recent summaries can include prior bad advice, supporting observations, actual advice, ratings, and internal planning metadata. The birthday itself is not sent to OpenAI as part of this request.
We do not intentionally request contacts, precise location, photos, camera access, advertising identifiers, health data, or push-notification permissions.
How we use it
We use account information to create and secure your account, restore your session, send confirmation and password-recovery emails, and associate your profile with your account. We use your birthday and the calculated astrology context to generate one daily, astrology-inspired reading. Bad Moon is for entertainment and reflection, not professional medical, legal, financial, or mental-health advice.
The generation service uses the supplied astrology as its factual constraint. OpenAI generates the reading’s bad advice, supporting observation, actual advice, rating, explanation, and internal planning metadata. Bad Moon does not ask the model to calculate planetary positions.
Storage and retention
Your profile, including first name and birthday, is stored in Supabase’s database for your authenticated account. Supabase Auth stores account and authentication data. The iOS app stores the profile, the current daily reading, and recent reading history locally in UserDefaults scoped to the authenticated user. During normal generation, the current iOS app does not write daily readings to the Supabase daily_readings table, although that table exists as backend infrastructure.
Local data is cleared after a successful in-app sign-out or account deletion, and is normally removed when the app is uninstalled according to iOS behavior. Provider systems may retain account, email-delivery, security, request, or backup records according to their own policies. We do not state a fixed deletion timeline unless confirmed with the relevant provider.
Service providers
Supabase: authentication, database storage, and Edge Functions. OpenAI: generation of the daily reading from the request context described above; the API key remains server-side. Resend: may deliver Supabase authentication emails through SMTP if configured for Bad Moon. Cloudflare: may host this website and provide DNS or email-routing services for the Bad Moon domain. The app source inspected for this policy contains no analytics or advertising SDK.
Provider-specific retention and processing practices are governed by the applicable provider terms and privacy policies. Bad Moon does not state a fixed provider retention period or processing location here unless confirmed.
Your choices and account deletion
You can sign out from the in-app Account screen and request a password reset from the sign-in screen. You can permanently delete your account from Account → Delete Account. The authenticated deletion request removes the Supabase Auth user. The associated profile and any server reading rows are intended to be removed by the database’s owner-linked cascade rules. Local profile and reading data is cleared after successful deletion. Provider logs, backups, or records required for security, fraud prevention, billing, or legal compliance may remain subject to the provider’s policies.
To ask about your information, request access or correction, request deletion, or raise a privacy concern, email hello@badmoon.app. Include enough information for us to identify the account, but never send a password, access token, or recovery code. We will handle requests as required by applicable law. Additional rights may apply based on your location, and we may need to verify your identity before responding.
Effective October 12, 2026. Reviewed against the current local app and backend source on October 12, 2026.