Back

Privacy policy

Last updated 23 September 2026

EightStars ("we") is the controller of your personal data in Gateway Manifest. Contact: hello@eightstars.app.

What we collect and why

  • Account (email and name): signing you in with a one-time code sent to your email. Basis: contract.
  • First name, goal, answers, notes: writing your personal sessions. Basis: contract.
  • Date of birth (optional): light seasonal phrasing only, never astrology. Basis: consent.
  • Age confirmation and eating-disorder answer: deciding whether some topics are safe to offer. Basis: legal obligation and vital interests.
  • Generated scripts and audio: delivering your sessions. Basis: contract.
  • Listening progress: unlocking sessions, streaks and levels. Basis: contract.
  • Payment and subscription status: billing; card details stay with Stripe. Basis: contract and legal obligation.
  • Push subscription: reminders you asked for. Basis: consent.
  • Usage analytics and error reports: keeping the app working. Basis: legitimate interest. You can switch them off in Settings, then Privacy.

Your goal, notes and date of birth are never sent to analytics.

Who processes it

  • Anthropic (via Google Cloud Vertex AI, EU region) writes your session scripts.
  • ElevenLabs turns scripts into speech.
  • Google Cloud (Belgium, europe-west1) hosts the database, the audio and the servers.
  • Vercel hosts the web app.
  • Google Workspace delivers sign-in code emails.
  • Stripe handles payments.
  • Sentry and PostHog receive error reports and usage analytics.

Some of these providers are based in the US. Transfers are covered by the EU-US Data Privacy Framework or Standard Contractual Clauses.

How long we keep it

Until you delete your data or close your account. Invoices are kept for 10 years as required by Lithuanian tax law. Backups roll over within 30 days.

Your rights

You can access, correct, export, restrict or delete your data, object to processing, and withdraw consent. Export and delete are in Settings. Deleting removes your protocols, scripts, audio, notes and history and cancels your plan. Deleting also removes your sign-in.

You can complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or your local authority.

Cookies

We use only the cookies needed for sign-in and security, and local storage on your device for playback position and offline audio. Analytics run without advertising cookies.