How we hold
your data.

IWho We Are

Triple Moon Goddess is a wellness journaling and medical astrology application operated by Lisa Hagan ("we", "us", "our"). For all data protection enquiries, please contact:

Triple Moon Goddess
Lisa Hagan
3654 Thornton Ave, Unit #748
Fremont, CA 94536
United States
Email: Lisa@TripleMoonGoddess.com
Website: triplemoongoddess.com

IIWho This Policy Applies To

This policy applies to all users of the Triple Moon Goddess ecosystem: the natal chart generator, the Health Journal (PWA), the Health Blueprint app, the Tea Moon app, and the phone widget application, together with the paid practitioner applications (Integrative Practitioner, Soul Pattern, Constitutional Health, and Relationship Advice), clients who share their records with a practitioner, and any associated email communications.

Triple Moon Goddess offers its services in the United States. Our own databases, file storage, backups, encryption keys and servers, including the service that calculates charts, are in the United States. The processors in Section V store the data they receive under their own terms: Anthropic stores data in the United States and may route requests through other countries; Stripe may transfer data to other countries, including the United States and India; MailerLite stores newsletter data in the European Union; Google Workspace, which carries our business email and calendar, may store data in any country where Google or its subprocessors have facilities; and Google reCAPTCHA Enterprise, which checks that requests come from our own app pages, is a Google Cloud service that may process data in any country where Google or its subprocessors have facilities. We do not market to or target people outside the United States. If you use our services from elsewhere, the rights in Section XII still apply to you. Consumer health data is also covered by our separate Consumer Health Data Privacy Policy.

IIIWhat Data We Collect

Identity & Contact Data

Collected only if you voluntarily provide it:

Website Contact Form

If you use the contact form on this website, we collect the email address and message you submit, solely so that Lisa can read and reply to your enquiry. The form asks for no name. Our own server emails your message to Lisa; that email is deleted from our mailbox after 30 days, nothing else is stored, and no third-party form service is involved. If Lisa replies, that conversation is kept as normal correspondence. This is separate from the apps: nothing from the contact form is added to your app records. Please avoid including health details or other sensitive information in a contact-form message — if you need to share something sensitive, email Lisa@TripleMoonGoddess.com directly instead.

Session Recordings

Recording a reading is optional. When you enter your birth details you can tick a box consenting to your reading being audio/video recorded; you can also give or decline consent verbally, which Lisa records on your behalf. A recording is only ever made during a live session with Lisa, and you can decline or withdraw consent at any time. Your consent answer is stored against the one-way lookup code for your email, not against your name.

Recordings are kept locally on Lisa’s own computer and are deleted within one month of the session. If we send you a copy of your recording or transcript, it is sent to your email address.

Health & Wellness Data

This is health data, and consumer health data under Washington's My Health My Data Act and similar state laws (see our Consumer Health Data Privacy Policy). It includes daily body scores (mood, energy, optimism, physical/mental stamina), sleep data, symptoms, medication and supplement logs, food and beverage log, tongue observations (Traditional Chinese Medicine), personal notes and reflections, and astrology transit journal responses.

Technical & Device Data

Firebase Authentication UID (anonymous for the free apps; an email sign-in account for clients who share their records with a practitioner), FCM push notification tokens, app preferences (tab config, reminder times, food plan, house system), timezone, and rate-limit counters keyed by anonymous UID.

When an app page opens, Google reCAPTCHA Enterprise runs in the background as part of Firebase App Check (Section V). It reads information about your browser and device and how the page is being used, such as your IP address, browser and screen details, and the timing of mouse, touch and keyboard activity, so Google can judge whether a person or an automated script is using the page. It does not receive your name, email, access code, birth data, or any health or journal data.

We do not collect precise device geo-location (GPS). The only location data we process is the birth location you enter for natal chart calculation — it is supplied by you, not derived from your device's location services. To turn the place you type into coordinates, the place name is sent to the OpenStreetMap Nominatim service through our server.

Usage Data

We use Firebase (Google) infrastructure. Firebase collects basic performance and crash data per its own terms. We do not use Google Analytics, Firebase Analytics, Facebook Pixel, any advertising trackers, session replay tools, or heatmap software. We record which of our apps were used on which day, keyed by the sign-in ID; that record is deleted when you delete your data.

IVHow We Use Your Data

Running the Apps

To provide the apps you use: sign-in, your chart and journal, push notifications, email reminders, and rate limiting.

Health Data

Only with your consent, given in the app before any health data is entered: storing and showing your journal entries, producing the PDF exports you ask for, and sharing with a practitioner you choose. You may withdraw consent at any time (Section XII).

AI Processing

Only with your consent. AI features are entirely optional. In the free apps, each chart receives 5 complimentary AI uses, counted on our server; after that, AI is only available if you choose to add your own Anthropic API key. Practitioner AI runs only on the practitioner's own Anthropic API key: the request goes directly from the practitioner's browser to Anthropic under the practitioner's own Anthropic account, outside Triple Moon Goddess's systems and agreements. An API key you add is stored encrypted on your device only. With no free uses left and no key, no data is ever sent to Anthropic.

When any AI feature is used, only the data relevant to that interaction is sent to Anthropic's API. No name, email, or access code is ever included. Anthropic does not use this data to train models. There are seven AI touchpoints across the apps, each with a just-in-time privacy notice shown before data is sent:

What We Never Do

• Sell your personal data
• Share your data with advertisers
• Use your health data to train AI models
• Combine your identity with your health records in a single document
• Send client names, emails, or birth date, time and place to any AI processor

VThird-Party Processors

VIGoogle User Data and Limited Use

This section describes in full how Triple Moon Goddess accesses, uses, stores, and shares data obtained through Google APIs ("Google user data"). It is provided in addition to the general disclosures elsewhere in this policy.

The Google permissions we request

We request no other Google permissions from you. (Our own business mailbox is reached through Google Workspace by our own service accounts, as described under Email delivery in Section V; that is not your Google user data.) We do not request or receive access to your Gmail, your Google Drive, your Google Contacts, your Google Photos, or your own personal Google Calendar. Individual seekers — users of the free chart, journal, widget, Tea Moon, and intake apps — are never asked to sign in with Google at all; those apps use anonymous authentication.

How Google user data is used

• Your email address from Google Sign-In identifies your practitioner account, matches it to your subscription, and allows us to send you service email about your account. It is stored as a keyed one-way fingerprint (HMAC-SHA256, with the key held in Google Secret Manager) on your account record, with the address itself encrypted in a separate vault under our Google Cloud KMS key.
• Your Google account identifier is used as the internal key for your account records. It is not shared with anyone.
• Calendar access is used only to read availability and to create, update, or cancel Triple Moon Goddess session events on Lisa Hagan's business calendar. When you book a session, your email address is added to that event as the attendee and in the event description so you receive the invitation and video link. Event guests cannot see other guests, invite others, or modify the event. No health data, journal content, or birth data is ever written to a calendar event.

What we never do with Google user data

• Sell it, or transfer it to data brokers, information resellers, or any other party for sale
• Use it for advertising, retargeting, or any other advertising or marketing purpose
• Use it to train, fine-tune, or improve any artificial intelligence or machine learning model, whether ours or a third party's
• Send it to Anthropic or to any other AI processor
• Allow any human to read it, except with your explicit consent, where necessary for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and de-identified
• Transfer it to any third party, except as strictly necessary to provide or improve the feature you requested, to comply with applicable law, or in connection with a merger, acquisition, or sale of assets — in which case we will give notice and obtain consent where required

Retention and deletion of Google user data

Google user data is retained only for as long as your practitioner account is active. When your account is cancelled or deleted, the associated email hash and encrypted email record are deleted and the Google account identifier ceases to be used. To request deletion of any Google user data we hold about you, email Lisa@TripleMoonGoddess.com. You may revoke Triple Moon Goddess's access to your Google Account at any time at myaccount.google.com/permissions. The Google Calendar authorisation is held by Lisa Hagan and may be revoked by her the same way; revoking it immediately ends all Triple Moon Goddess calendar access.

Limited Use commitment

If we change the way this application uses Google user data, we will update this section, update the effective date at the top of this policy, and notify affected users by email before the change takes effect.

VIIWhere Your Data Is

Our databases, file storage, backups, encryption keys, and servers are all in the United States. If you use TMG from outside the United States, your data is stored in the United States. Third-party processors (Section V) may also process data in other countries under their own terms; Section II lists where each one stores it.

VIIIData Retention

IXSecurity Measures

Encryption of Sensitive Data (Managed-Key Cloud KMS)

Your most sensitive data — your email, your birth data, and, for practitioner accounts, practitioner notes and psychological readings — is encrypted at rest with a dedicated Google Cloud Key Management Service (KMS) key. The key lives server-side only. Encryption and decryption happen inside our Cloud Functions; the key is never sent to, or held by, any browser.

Your email and your birth data are each stored once, in their own access-controlled vault. Email is encrypted in one vault and located only through a keyed one-way fingerprint (HMAC-SHA256 with a secret key held in Google Secret Manager) — it is never stored or searched as plain text in our database. Birth data is encrypted in a separate vault, keyed only by your anonymous access code. Neither vault is readable by the apps or by other users; only our server functions can decrypt, and only for a permitted purpose such as sending your chart by email.

Practitioner records about a client — notes and psychological readings — are encrypted with the same managed key on the server at the moment they are saved, and the plaintext is removed. Even if the database were fully compromised, these records would be unreadable, because the key is not in the database and never leaves the server. A practitioner can decrypt only the records of clients who accepted that practitioner's invitation: every decryption is checked on the server against the practitioner's signed-in account and the client's consent (or is made by the administrator).

The following data is protected by Firebase Security Rules rather than field-level encryption: natal chart outputs, client intake answers, intake match results, journal entries, and Soul module session data.

Infrastructure Security

All data transmitted over HTTPS (TLS 1.2+). Data is encrypted at rest by default (Firebase/Firestore), with the sensitive fields above additionally encrypted under our own Cloud KMS key. Your birth data is write-only from the browser — it can be sent in to be stored, but no app or user can read raw birth data back; all chart, transit, and reading calculations run on our secure servers. API keys are stored in Google Cloud Secret Manager — never in code. Firebase Security Rules restrict database access to each authenticated user's own data, and a practitioner's access to a client's records to clients who gave consent. Practitioners and the administrator must use two-step sign-in and must have signed in within the last hour; signed-in sessions end after 30 minutes without activity. The admin portal is restricted to a single authorised account, and admin access to raw birth data (used only to correct a data-entry error) is audit-logged. Identity data and health data are held in separate collections — no single record contains both.

Data Breach Notification

If a personal data breach occurs, we will act without undue delay to investigate and contain it. Where your personal information is affected, we will notify you, and any regulator, as required by applicable state breach-notification laws, including California Civil Code § 1798.82, without unreasonable delay. Because your identity data and your health data are held in physically separate Firestore collections, a breach affecting one does not necessarily expose the other.

XCookies and Local Storage

We do not use advertising cookies or tracking pixels. We use browser local storage and sessionStorage only for strictly necessary app functions:

No third-party tracking cookies are used. Google reCAPTCHA may also set its own security cookie on google.com, under Google's Privacy Policy. Apart from the reCAPTCHA and App Check entries, which are used for Google's check, none of the above keys are shared with any third party. SessionStorage keys expire automatically when the browser tab closes.

XIChildren's Privacy

The full TMG platform — Health Journal, Tea Moon, Health Blueprint, and practitioner apps — is intended for adults aged 18 and over. Readings are for adults only. We do not knowingly store personal data from children under 13. If you believe a child under 13 has submitted data to us, please contact Lisa@TripleMoonGoddess.com and we will delete it immediately.

Age-Appropriate Chart Experience Under 18

The main natal chart app offers a limited, age-appropriate experience for anyone whose birth date shows they are under 18, with parental or guardian consent confirmed before any chart is generated. This experience is designed with privacy as the default: no account is created, no email is collected, and nothing is stored on any server. The natal chart is calculated using our Swiss Ephemeris service (birth date, time, and coordinates are transmitted for computation only and not stored by TMG; the birthplace name is turned into coordinates by OpenStreetMap Nominatim) and stored locally on the user's device under the key tmg_minor_chart (see Section X). Our server refuses to store the birth data of anyone under 18, except when Lisa records a chart herself, in person, after a parent or guardian has given consent. The chart can be cleared at any time by tapping "New Chart." Secondary apps — Health Journal, Tea Moon, Health Blueprint, and the practitioner apps — are not available to users under 18.

Parental or guardian consent is confirmed within the app before chart generation for any user whose birth date indicates they are under 18. By providing consent, the parent or guardian confirms they have reviewed and agreed to this privacy policy on behalf of the minor.

XIIYour Rights

These rights apply to everyone who uses our services, wherever you live:

• Know and access: ask what data we hold about you and who receives it, and get a copy. The Health Journal exports your entries as a PDF or as a Markdown file that also holds a machine-readable copy; ask us for anything else.
• Correct: ask us to fix inaccurate data, such as a mistyped birth date.
• Delete: delete your data yourself at any time: in the Health Journal, open Settings (the gear) and choose Delete All Data; on your chart page, choose Delete Data. Either way you type DELETE to confirm. Deleting removes your records, files and sign-in accounts (your email sign-in, and an anonymous sign-in that held only your charts); payment records keep only amounts and status, and practitioner notes about you stay until that practitioner deletes them. Deleting also reaches the services that hold your email: your MailerLite subscriber record is deleted, your booking events are deleted from our calendar (a session you booked that has not happened yet is cancelled, without a separate notice), and your Stripe customer record is deleted; the payment records Stripe must keep by law stay with Stripe. If one of these services can't be reached, we keep retrying, and Lisa finishes any step that still fails by hand.
• Withdraw consent: delete your data, stop using a feature, turn off journal sharing, or stop sharing your records with your practitioner altogether, in the journal's Settings → Practitioner (or email Lisa@TripleMoonGoddess.com). Stopping sharing deletes nothing. Your practitioner can no longer see your records; the notes they wrote about you are their own records, which they keep and can still read, edit or delete. You control your records and your practitioner controls their notes, as with any professional's notes. Their notes are deleted when their account closes.
• No sale, no discrimination: we do not sell or share your data for advertising, and using your rights never changes the service you get.

California and Other States

California residents (CCPA / CPRA) have the rights above: to know, delete and correct, to opt out of sale (we do not sell data) and to non-discrimination. Categories collected: identifiers, health information, internet/electronic activity (which of our apps you used, and when). Sold or shared for advertising: No. Residents of other states with privacy laws have the same rights. Washington, Nevada and Connecticut residents: see also our Consumer Health Data Privacy Policy.

XIIIPractitioner App Data

The Integrative Practitioner, Soul Pattern, Constitutional Health, and Relationship Advice apps are separate paid-tier applications. A practitioner works only with clients who chose to share their records.

How a Client Shares Their Records

A practitioner invites a client by entering the client's email address. If that email already has a chart with us, the client receives an invitation that works once and expires after 7 days. The client signs in with a single-use link sent to that email and chooses to share their records. Only then can the practitioner see anything. The invitation and the consent are recorded with the client's email encrypted under our managed Cloud KMS key. Lisa, as administrator, may also add a client she reads for directly.

What Practitioners See

Once a client has shared their records, the practitioner sees the client's email address, the chart-derived outputs (sign placements, house positions, constitutional profile, pattern group scores, and comparison signals), relationship charts with another client who has also shared their records, intake answers, and Soul questionnaires. The practitioner sees the client's journal only while the client's "I'm working with a practitioner" setting is on. Practitioners never see the underlying birth date, time, and place, and they do not enter birth data.

What Practitioners Write

Practitioners may write notes, psychological readings, results, and follow-ups about a client who has shared their records. Notes and readings are encrypted with our managed Cloud KMS key on the server at the moment they are saved. A practitioner can delete their own records about a client at any time; they are also deleted automatically when the practitioner's paid subscription is cancelled. The client's own data stays with the client.

Practitioner AI

Practitioner AI runs only on the practitioner's own Anthropic API key, directly from the practitioner's browser to Anthropic. It receives the client's chart placements, scores, intake answers, journal entries and the practitioner's notes, labelled only "CLIENT" — never the client's name, email, or birth date, time or place. See Section IV.

Research

Soul module session records are kept under the client's anonymous access code, never under a name or email, and are deleted when the client deletes their data or the practitioner deletes their records. No name, email, birth date, birth time, or birth location would be included in any published or shared research output.

XIVChanges to This Policy

We will update this policy when our data practices change. Material changes will be communicated via an updated notice on the consent screen within the app and an updated effective date at the top of this document. Continued use of the app after a material change constitutes acceptance. Where legally required, we will re-obtain explicit consent.

XVContact & Complaints

For any privacy-related question, data request, or complaint:

Triple Moon Goddess
Lisa Hagan
3654 Thornton Ave, Unit #748
Fremont, CA 94536
United States
Email: Lisa@TripleMoonGoddess.com

If you are not satisfied after an appeal (Section XII), you can contact your state attorney general or, in California, the California Privacy Protection Agency (CPPA).