COBAL STUDIOS LLC, a New York limited liability company
169 Madison Ave STE 11534 Unit 356, New York, NY 10016, USA
1.1. COBAL STUDIOS LLC ("we," "us," "our") operates Linalux at linalux.app (the "Service"). We decide how and why your personal information is processed. Under EU and UK data protection law, this makes us the "controller." Under US state privacy laws, we are the "business."
1.2. For privacy questions and requests, email privacy@linalux.app. For general support, email support@linalux.app. We communicate by email only. We do not provide telephone support.
1.3. This policy applies to the English-language version of the Service at linalux.app. The Service is web-only. Linalux is also offered in a Turkish-language version for users in Turkey, which has its own privacy notice. Both versions are operated by us and use the same systems and service providers.
2.1. Linalux is a subscription-based digital service. It provides personal insight and interpretation content generated by artificial intelligence, based on the birth details you provide, the text you write, and the photos you upload.
2.2. All Readings are generated by artificial intelligence. Lina AI is an AI chat assistant, not a human.
2.3. Linalux content is provided for entertainment and personal reflection only. It is not medical, psychological, legal, or financial advice. Content is generated by artificial intelligence and its accuracy is not guaranteed. For health, legal, or financial matters, consult a qualified professional.
2.4. We do not use your information to train artificial intelligence models. We use Google's paid Gemini API. Under Google's terms for its paid API services, Google does not use the content we send it to train its models or to improve its products.
3.1. Account and profile information
| Information | How we collect it |
|---|---|
| Email address | When you register or sign in (with a password or an email sign-in link) |
| Password | Optional. You can sign in with an email link instead. Your password is stored only in hashed form by our authentication provider, so we cannot read it. |
| Name | Optional. You can add it to your profile. |
| Gender (Female / Male / Other) | Asked in the Palm Reading flow and saved to your profile |
| Profile photo | Optional. If you upload one, the image itself is stored in our database. |
| Language and country | Detected automatically. You can change your language. |
| Subscription status and plan | Recorded by our system |
| Email verification and welcome status | When you confirmed your email address, saw or postponed the welcome step, and received your Welcome Star. Recorded by our system. We never store the verification code itself, only a hash of it, and the code expires after 10 minutes. |
| Consent records | When you tick a consent box while signed in (the free-text consent described in Section 6, or the Palm Reading consent described in Section 5), we record which consent you gave, the version of the consent text, the language, and the time. |
3.2. Birth information
| Information | Notes |
|---|---|
| Date of birth | You enter it on the welcome step or in feature flows. |
| Time of birth | Optional. You can leave it blank if you do not know it. |
| Place of birth | You search for a city. We save the city you choose with its latitude, longitude, and time zone. |
| Calculated birth chart | Our system calculates it and saves it so it does not need to be recalculated. |
3.3. Other people's birth information
| Information | Notes |
|---|---|
| Another person's date and time of birth | You enter it in Relationship Chart. It is stored in your Account until you delete it or your Account. |
| Relationship type and status (for example spouse, partner, new, or former) | You choose it in Relationship Chart. Stored in the same way. |
| A family member's, child's, friend's, or partner's birth details entered in Bonds | Not saved anywhere. Used only while the page is open, and gone when you close or reload it. The free bond card is calculated on our server and is not sent to artificial intelligence. If you ask for a deep reading, the details are sent to our AI provider to generate it. |
Section 7 explains how we handle other people's information.
3.4. Content you create
| Information | Notes |
|---|---|
| Dream entries: title, description, emotions, colors, whether the dream recurs, and symbols | You enter them in Dream Interpretation and Dream Journal. Stored until you delete them. You can delete dreams yourself. |
| Manifestation intentions and Sign Journal entries | You enter them in Manifestation. Stored in your Account. |
| Ritual intention | You enter it in Rituals (one record per person). Stored in your Account. |
| Chat messages with Lina AI, including Relationship Chat: your messages and Lina AI's replies | Stored as text |
| Quiz answers (for example, attachment style) | You give them in the Love quizzes. Stored in your Account. |
| The question you ask in Ask the Cosmos | Sent to our AI provider to generate the answer. The question itself is not stored. We only count how many questions you ask each day. |
| Readings generated for you | Stored in your Account and shown in My Readings |
| Star usage records | Recorded by our system |
| App feedback: rating and comment | Stored |
| Support messages: topic, message text, your email address, language, reference number, and date | You write them in the form on our Support page. Stored in your Account. Your message is emailed to our support team together with your plan and subscription status, and a confirmation copy is sent to your email address. |
3.5. Photos
| Information | How it is processed | Does Linalux store it? |
|---|---|---|
| Coffee cup or saucer photos (up to 3) | Resized in your browser and sent to our AI provider, Google, to generate your Turkish Coffee Reading | No |
| Palm photos (your dominant hand, and optionally your other hand, up to 2 photos) | See Section 5 | No |
Photos are not stored in Linalux's database or file storage. They are sent to Google only to generate your Reading. Under its terms for the paid Gemini API, Google does not use them to train its models or to improve its products, and may keep them for a limited period only to detect abuse and to meet its legal obligations.
3.6. Technical and usage information
| Information | Purpose | Notes |
|---|---|---|
| Temporary page identifier, feature name, step in a feature flow, and device type (mobile or desktop) | Product analytics | Recorded for visitors who are not signed in too. If you are signed in, it is linked to your Account. The identifier is held only in the page's memory while the page is open. It is not stored in your browser. |
| IP address at registration | Preventing abuse (no more than 5 registrations from the same IP address within 12 months) | We do not store your IP address itself. We store only a hash generated with a secret key (HMAC-SHA256), which cannot be reversed without that key. |
| Request counts | Rate limiting (a maximum number of requests per IP address per minute) | Counted against the same keyed hash. Your IP address itself is not stored. |
| Web push subscription | Sending browser notifications | Only if you allow notifications in your browser |
| Notification preferences | Which notifications and emails you receive | See Section 18 |
| Newsletter email address | Sending our newsletter | Anyone can subscribe, including visitors without an Account. |
| Connection information (IP address, browser information) | Hosting, bot verification, and loading code libraries | Processed by Cloudflare, jsDelivr, and cdnjs. See Section 8. |
3.7. Payment information. Payments are processed by Stripe. Your card details are entered directly with Stripe and never reach us. We keep records of your payments.
3.8. Information stored in your browser. We store some information in your browser's local storage and session storage. Our Cookie Policy describes it.
3.9. What we do not collect or use. We do not use third-party analytics or advertising tools, such as Google Analytics, Meta Pixel, Hotjar, Mixpanel, or advertising networks. We do not show ads.
3.10. If we introduce new features that collect other types of information, we will update this policy before we collect it.
4.1. If you are in the EU/EEA or the UK, the law requires us to have a legal basis for each use of your information. Our legal bases are as follows:
| Purpose | Information used | Legal basis |
|---|---|---|
| Creating and managing your Account and signing you in | Account and profile information | Performance of our contract with you |
| Generating Readings, birth charts, and Lina AI replies | Birth information, text you write, dream entries, quiz answers, coffee cup photos, gender | Performance of our contract with you |
| Palm Reading | Palm photos | Your explicit consent (see Section 5) |
| Sensitive information you choose to include in text | Dream entries, Lina AI chat messages | Your explicit consent (see Section 6) |
| Other people's birth details | Birth details you enter about another person in Relationship Chart or Bonds | Legitimate interests: providing the feature you request, relying on your confirmation of that person's permission (see Section 7) |
| Birth city search | The city name you type | Performance of our contract with you |
| Billing your Subscription and managing Stars, including the Welcome Star | Subscription and payment records, Star usage records, email verification and welcome status | Performance of our contract with you |
| Keeping payment records | Payment records | Compliance with legal obligations (tax and accounting) |
| Service emails, such as sign-in links, email verification codes, password reset emails, report links, and subscription confirmations | Email address, name | Performance of our contract with you |
| Service notifications and periodic emails that you keep switched on, such as Daily Horoscope and moon event notifications and sky reports | Email address, notification preferences | Legitimate interests: providing the features you use. You can switch them off at any time. |
| Browser push notifications | Web push subscription | Your consent |
| Promotional messages and the newsletter | Email address | Your consent. Promotional messages are off unless you switch them on. |
| Security, fraud, and abuse prevention | IP hash, request counts, connection information, bot verification | Legitimate interests: protecting the Service and its users |
| Product analytics | Temporary page identifier, feature, flow step, device type | Legitimate interests: understanding and improving how the Service is used |
| Reviewing app feedback | Rating and comment | Legitimate interests: improving the Service |
| Answering your support requests | Support messages, email address, plan and subscription status | Performance of our contract with you. For suggestions and other messages not about your Account or Subscription: legitimate interests in responding to you and improving the Service |
| Keeping a record of the consents you give | Consent records | Legal obligation (being able to show that you consented) |
| Complying with the law and handling legal claims | Relevant information | Legal obligation, or legitimate interests |
4.2. Where we rely on legitimate interests, you have the right to object (see Section 13).
5.1. Some laws, such as the Illinois Biometric Information Privacy Act and similar laws in Texas and Washington, treat hand geometry as a biometric identifier. We apply this notice to all users of Palm Reading, wherever they live.
5.2. What we collect. We collect the palm photo(s) you upload (your dominant hand, and optionally your other hand, up to 2 photos) and hand landmark points derived from them.
5.3. How it works. Your photo is resized to 800 pixels in your browser. A hand recognition model then runs on your device and finds 21 anatomical points on your hand to align the palm lines. The model file is downloaded from Google's servers, but your photo is not sent anywhere for this step. The resized photo is then sent to Google's Gemini API to generate your Reading.
5.4. Purpose. We use palm photos and hand landmarks only to generate your Palm Reading. We never use them to identify you, verify your identity, or recognize you.
5.5. Consent. Before you upload a palm photo, we ask for your explicit consent to the collection and use described in this Section 5, including sending the photo to Google. If you do not consent, you cannot use Palm Reading, but the rest of the Service is not affected. You may withdraw your consent at any time by no longer using Palm Reading.
5.6. Disclosure. We disclose palm photos only to Google, as our service provider for generating your Reading. We never sell, lease, or trade palm photos or hand landmarks, and we do not otherwise profit from them.
5.7. Retention and destruction. We do not store palm photos or hand landmarks in our database or file storage. The photo is deleted from our systems immediately after it has been processed to generate your Reading. Hand landmarks stay on your device and are discarded when you leave the page. Google processes the photo as our service provider under its terms for the paid Gemini API. Under those terms, Google does not use the photo to train its models or to improve its products, and may keep it for a limited period only to detect abuse and to meet its legal obligations. In all cases, biometric information is permanently destroyed when the purpose for collecting it has been satisfied, or within 3 years of your last interaction with us, whichever comes first.
5.8. Your own palms only. Please upload only photos of your own hands.
6.1. Dream entries, chat messages, Sign Journal entries, and the questions you ask in Ask the Cosmos are free text. They could reveal sensitive information, such as information about your health, sex life, religious or philosophical beliefs, or political opinions. We ask you not to include this kind of information unless you want it to be part of your Reading.
6.2. We ask for your explicit consent once, with a checkbox that is not ticked in advance. We offer it on the welcome step after you register. If you do not give it there, we ask the first time you use one of these features: Dream Interpretation, Dream Journal, Lina AI, Manifestation, or Ask the Cosmos. The checkbox reads: "If what I write includes sensitive information, I give my explicit consent for it to be processed to generate my Reading and to be sent to service providers outside my country." Once you give it, it applies to all five features. You cannot send text in these features until you tick the box. Giving this consent is optional and is not a condition for your Account or your Welcome Star. We process any sensitive information you include only to generate your Reading or Lina AI's reply. Our legal basis is your explicit consent.
6.3. You can withdraw your consent at any time by contacting privacy@linalux.app, by deleting the dream entry, or by deleting your Account. If you withdraw it, you will no longer be able to send text in these features. Withdrawal does not affect processing that took place before. This information is stored until you delete it.
7.1. Relationship Chart and Bonds use another person's birth details. You may enter them only with that person's knowledge and permission. We use these details only to generate the Reading you request.
7.2. Details entered in Relationship Chart are stored in your Account until you delete them or your Account. Details entered in Bonds are not saved anywhere (see Section 3.3).
7.3. If you believe someone has entered your details on Linalux, email privacy@linalux.app. We will handle your request under applicable law, including requests to access or delete your information.
8.1. We use the following service providers to run Linalux:
| Provider | Role | Information | Location |
|---|---|---|---|
| Supabase | Database, authentication, server functions | All information we keep about you | Ireland (EU) |
| Google (Gemini API) | Generating AI content | Birth information, other people's birth details you enter, text you write, coffee cup and palm photos | United States / global |
| Cloudflare | Website hosting, domain name service, forwarding of emails and support messages you send to our addresses, and Turnstile bot verification (sign-in, registration, and account pages) | Connection information, IP address, browser information, and the emails and support messages you send us | Global |
| Resend | Sending emails from lina@linalux.app, including sign-in links, email verification codes, and password reset emails; forwarding your support messages to our support team and sending you a confirmation copy | Email address, name, and the codes and links in the email; the content of your support messages, and your plan and subscription status | United States |
| Stripe | Payment processing | Payment and billing information | United States / Ireland |
| Gmail (Google) | Our email inbox: emails and support messages sent to our addresses (such as support@ and privacy@) are delivered to it, and we read and answer them there | Your email address, your name if you include it, the content of your emails and support messages, and our replies | United States / global |
| jsDelivr and cdnjs | Serving code libraries used on our pages | IP address, browser information | Global |
| Google (MediaPipe model file) | Providing the on-device hand recognition model for Palm Reading | IP address only. Your photo is not sent. | Global |
| OpenStreetMap (Nominatim) | Birth city search | The city name you type | Europe |
8.2. We do not use any other external services to process your personal information.
8.3. We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger, acquisition, or sale of assets. In that case, this policy continues to protect your information.
9.1. We are based in the United States. When you use Linalux from outside the United States, you provide your information directly to a US company.
9.2. Our main database is in Ireland (EU). Our AI provider (Google) and email provider (Resend) are in the United States. Other providers operate globally.
9.3. This means:
9.4. Data protection laws in these countries may differ from the laws where you live. When we transfer personal information from the EU/EEA to Supabase, Resend, Google, Stripe, or Cloudflare, the transfer is based on the Standard Contractual Clauses adopted by the European Commission, which are part of the data processing agreements we have in place with each of these providers. We also apply the security measures in Section 12. You can ask for more information, including a copy of the relevant safeguards, at privacy@linalux.app.
10.1. Account information, birth information, Relationship Chart records, Readings, dream entries, Manifestation and ritual records, quiz answers, Lina AI chats, consent records, welcome status, feedback, and support messages are kept while your Account is active. They are deleted immediately when you delete them or your Account.
10.2. Product analytics events are kept for 24 months from collection and then deleted. Events linked to your Account are deleted earlier if you delete your Account.
10.3. We do not store coffee cup or palm photos (see Sections 3.5 and 5), or birth details entered in Bonds.
10.4. Payment records are kept for as long as tax and accounting laws require. After Account deletion, they are no longer linked to you.
10.5. Your newsletter subscription is kept until you unsubscribe. If you subscribed with your Account's email address, it is also deleted when you delete your Account.
10.6. The hash of your registration IP address and request counts are kept for 12 months and then deleted. The IP hash is not linked to your Account, so deleting your Account does not delete it earlier. It is kept for abuse prevention until the 12 months end.
10.7. Your web push subscription is kept until you withdraw browser permission or delete your Account.
10.8. Our service providers keep their own records under their own retention periods.
11.1. You can delete your Account from your account page. For security, we ask you to confirm your identity just before deletion, for example by signing in again or entering a code we send to your email address. Deletion is permanent and cannot be undone.
11.2. Deletion removes the following in a single operation: your birth and birth chart information; all Readings and Reading texts; dreams and dream interpretations; Lina AI chat records; quiz results; Relationship Chart records, including other people's birth details you entered; Manifestation and Sign Journal records; ritual intentions and notification records; Star usage records; consent records; email verification and welcome status; cached daily Readings; web push subscriptions; analytics events linked to your Account; app feedback; support messages; your newsletter subscription, if it uses your Account's email address; your profile (including name, gender, and profile photo); and finally your login record itself.
11.3. The following are not deleted when you delete your Account:
12.1. We protect your information with the following measures:
12.2. No system is completely secure. If you notice anything suspicious, contact us at privacy@linalux.app.
13.1. You have the right to:
13.2. To exercise your rights, email privacy@linalux.app. We may ask you to confirm your request from your Account's email address. We respond within one month. Where the law allows, we may extend this by up to two further months and will tell you why. Exercising your rights is free.
14.1. We give the rights in this Section 14 to all users in the United States, whatever state you live in.
14.2. You have the right to:
14.3. We do not sell or share personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. So there is nothing for you to opt out of.
14.4. We use sensitive personal information only as necessary to provide the Service you request. So the California right to limit its use does not apply.
14.5. How to submit a request. Email privacy@linalux.app. To verify your identity, we will ask you to confirm the request from your Account's email address. We respond within 45 days. If we need more time, we may extend this by another 45 days and will tell you.
14.6. Authorized agents. An authorized agent may submit a request for you. The agent must provide your signed written permission. We may also ask you to confirm your identity directly with us from your Account's email address. This is not required if the agent holds a valid power of attorney.
14.7. Appeals. If we decline your request, you can appeal by replying to our decision, or by writing to privacy@linalux.app with "Appeal" in the subject line. We will respond within the period your state's law requires. If you are not satisfied with our answer, you can contact your state Attorney General.
14.8. Notice at collection. Over the past 12 months, we have collected the following categories of personal information:
We collect this information directly from you and automatically from your device. The purposes are listed in Section 4, retention periods in Section 10, and the service providers who receive it in Section 8. We have not sold or shared personal information in the past 12 months.
14.9. California residents may also ask whether we disclose personal information to third parties for their direct marketing purposes. We do not.
15.1. We do not sell your personal information. We do not share it for cross-context behavioral advertising or targeted advertising. We do not use third-party analytics or advertising tools. Because none of this happens, we do not offer a "Do Not Sell or Share" link: there is nothing to opt out of. If this ever changes, we will update this policy and give you a way to opt out before it happens.
16.1. Linalux uses artificial intelligence to generate content from your information. We do not use automated decision-making that produces legal or similarly significant effects on you. We do not profile you for advertising.
17.1. The Service is for people aged 18 and over. You confirm your age when you register. The Service is not directed at children, and we do not knowingly collect information from anyone under 18. If we learn that we have, we will delete the information. If you believe a child has used the Service, contact privacy@linalux.app.
17.2. If you enter a child's birth details in Bonds, they are not saved.
18.1. We send emails from lina@linalux.app.
18.2. By default, the notification preferences for the Daily Horoscope, moon events, ritual reminders, Manifestation cycle updates, and monthly and yearly sky reports are on. We may send these notifications and emails only for the preferences you keep switched on. Promotional messages are off unless you switch them on.
18.3. You can change your notification and email preferences at any time in your account settings.
18.4. Our newsletter and any periodic emails we send include an unsubscribe link. You can also unsubscribe from the newsletter by emailing support@linalux.app.
18.5. We send browser push notifications only if you allow them in your browser. You can turn them off in your browser settings.
19.1. We may update this policy. When we do, we will change the "Last updated" date. For material changes, we will notify you by email or within the Service before the changes take effect.