Privacy Policy

Mystra (com.antaai.app01mystara, iPhone and Android) · Antaai
Last updated: 20 September 2026

The short version. Mystra works without you creating an account. What you type into a reading, and any photo of a card spread you choose to upload, is sent to our server and passed to a third-party AI provider so a reading can be written for you. Your journal stays on your phone. We measure how the app is used, with the tools named in section 4, so we can tell what is working. We show no ads, we use no advertising identifiers, we do not track you across other companies' apps or websites, and we sell nothing to anyone.

1. Who we are

Mystra is published by Antaai ("we", "us"). If you have any question about this policy or about your data, write to info@antaaistudio.com.

2. What we collect

An anonymous account, created automatically

The first time you open Mystra, an anonymous account is created for you through Google Firebase Authentication. It is a random identifier tied to that installation. It carries no name, no email address and no phone number. We use it to keep track of how many free readings you have used today and whether you have an active subscription.

Your email address and name — only if you choose to sign in

Mystra may offer to connect an account so that a subscription survives changing or resetting your phone: Sign in with Apple on iPhone, and a Google account on Android. This is optional and nothing in the app requires it. If you accept, we receive the email address and display name that the provider gives us, and store them in our Firebase project. If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple's relay address, never your real one. If you never sign in, we never have any of it.

What you write and what you upload

When you ask a question, describe a situation, or upload a photograph of a card spread you have laid, that text and that image are sent over an encrypted connection to our server and forwarded to our AI provider, which generates the reading. This is the core function of the app: without sending it, there is nothing to read.

We do not keep your messages or your photographs after the reading has been written. There is one deliberate exception, described under "How long we keep things" below: if you reach a reading you have not paid for, we hold that finished reading on our server for up to 14 days so that paying unlocks the same reading rather than a differently worded one.

How the app is used

We record what happens in the app — screens opened, buttons tapped, where an intake was abandoned, which paywall design you were shown, how long a reading took to arrive, and whether a request failed. These records are attached to your account identifier and to an identifier for your app installation. They contain no part of what you wrote and no part of any reading. We use them to find what is broken and to decide what to build next.

Crash reports

If the app crashes we receive a report describing what the software was doing, the type of device and the operating system version. It is attached to your account identifier so that we can tell whether one person is hitting the same fault repeatedly.

Your subscription status

Purchases are made through the App Store on iPhone and through Google Play on Android. We use RevenueCat to tell us whether your subscription is active. We receive the status of the purchase and the identifier of the product bought. We never receive, see or store your card number or any other payment details — those stay with Apple or Google.

What stays on your phone and never reaches us

Your journal — the readings you have had and the notes attached to them — is written to storage that belongs to the Mystra app on your own device. It is not uploaded to us. Deleting the app deletes it.

3. What we do not collect

We do not sell personal data, and we do not share it with anyone for advertising.

4. Who processes your data on our behalf

ProviderWhat it handles
Google Firebase AuthenticationThe anonymous account, and your email and name if you sign in.
CloudflareRuns our server. Your requests pass through it; it stores your account identifier, your daily usage count, your subscription status, and any reading held under section 5.
OpenRouter (openrouter.ai)Routes our requests to the AI model that writes the readings. It receives the text and any spread photograph you send, in order to generate a response, and passes it on to the model provider that serves that request — currently DeepSeek.
RevenueCatTells us whether your subscription is active.
Apple (App Store) · Google PlayProcesses the payment itself, on the respective platform.
Google Firebase AnalyticsRecords how the app is used, against your account identifier and an app installation identifier.
PostHog (posthog.com)The same usage records, kept in a form we can query product questions against.
Google Firebase CrashlyticsReceives crash reports and the device and OS details attached to them.

These providers operate internationally, so your data may be processed on servers outside the country you live in, including outside the European Economic Area and outside Türkiye. Each of them is bound by its own agreement with us to process the data only for the purpose described above.

5. How long we keep things

6. Your choices

You can delete your account and everything we hold against it from inside the app, under Profile → Delete my account. Full instructions, including how to ask us to do it for you, are on our account deletion page.

Depending on where you live you may also have the right to ask us for a copy of your data, to have it corrected, or to object to our processing it. Write to info@antaaistudio.com and we will answer within 30 days.

Deleting your account does not cancel your subscription. Subscriptions are managed by the App Store on iPhone and by Google Play on Android, and must be cancelled there.

7. Security

Everything the app sends travels over HTTPS. Our server refuses any request that does not carry a valid authentication token. No system is perfectly secure, but we keep no archive of your readings — only the single unpaid reading described in section 5, for as long as that section says.

8. Children

Mystra is intended for adults and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a child has used the app and given us data, write to us and we will delete it.

9. Changes to this policy

If we change how the app handles data we will update this page and change the date at the top. Material changes will also be announced in the app.

10. Contact

Anta AI Studio — info@antaaistudio.com