Privacy

What we collect, and why.

Ashta asks for unusually personal things — your time and place of birth, your voice, your heart rate. A project whose whole claim is honest measurement owes you a plain account of what happens to them. This is that account.

Last updated: 30 July 2026.

Who this covers

This policy covers theashtaproject.com, the membership area at members.theashtaproject.com, and the forms and studies we run through them. The Ashta Project decides what data is collected and why, and is responsible for it.

If you only read the site and never fill in a form, we do not ask you for anything and we do not build a profile of you.

What we collect

Name and email address: Given when you join the founding circle, contact us, or create a membership account. Used to reply to you, to run your account, and — only if you tick the box — to email you about Ashta.
Date, time and place of birth: Given only if you choose to complete the profiling questionnaire. Several of the systems Ashta is testing — astrology, Human Design, Gene Keys, the I Ching — take birth data as their input, so testing whether they predict anything requires it. Providing it is optional; you can be a member and take part in other studies without ever giving it.
Voice recordings and acoustic measures: Collected only within a study you have joined. We derive acoustic measures from the recording; the measures, not your voice, are what the analysis uses.
Heart rate and heart-rate variability: Collected only within a study you have joined, from a device you connect yourself. In many jurisdictions this counts as health data and attracts extra protection. We treat it that way regardless.
Your goals, self-reports and questionnaire answers: What you say you want to change, and how you rate yourself over time. This is the before-and-after that makes any measurement meaningful.
What you write to us: Messages sent through the contact form or by email, and anything you submit through our questionnaires.
Ordinary technical records: Our hosting provider keeps standard server logs — IP address, timestamp, page requested, browser type — for security and diagnostics. We do not run analytics, advertising or tracking scripts on this site, and we do not set marketing cookies.

Why we collect it, and on what basis

We rely on different legal grounds depending on what the data is for:

Your consent — for research participation, for birth data, for voice and heart-rate data, for marketing email, and for appearing in the documentary. Each is asked for separately. You can withdraw any of them without affecting the others.
Performing our agreement with you — for running a membership account you have signed up for, and for taking payment where a paid tier applies.
Our legitimate interests — for keeping the site secure, preventing abuse, and replying to a message you send us.
Legal obligation — where we are required to keep records, for example for accounting.

Health-related and biometric data is handled to a special-category standard: collected only on your explicit consent, separated from your identity as early as we can, and never used for a purpose you were not told about.

Research data is de-identified by default

Data that goes into a study is separated from your name and email and given a code. Analysis is run on the coded data. Published results are reported at the level of the group, never as an identifiable individual.

We hold the key that links the code back to you, because you have the right to ask us to delete or extract your data and we cannot honour that without it. That key is kept separately from the research data and access to it is restricted.

The commitments in our research standards — hashing, de-identification, documented chain of custody, no medical or diagnostic claims — apply to everything described on this page.

The documentary is a separate, opt-in decision

Being filmed is not part of being a member. It is asked for on its own, it requires your written consent, and you can take part in every experiment without ever appearing on screen. Nobody is filmed who has not agreed in writing to be.

Consenting to appear is not the same as consenting to research, and neither implies the other. You can withdraw filming consent — see the documentary page for how filming works in practice.

Who else touches your data

We use a small number of service providers. They process data on our instructions and are not permitted to use it for their own purposes.

Vercel: Hosts this website and serves its pages. Sees the ordinary technical records described above.
JotForm: Runs the contact form and the profiling questionnaire. Anything you type into one of those forms passes through and is stored by JotForm as well as reaching us.
Google Fonts: Our pages load typefaces from Google's font servers, so loading a page tells Google your IP address and which page requested the font. No account or cookie is involved.
YouTube: Video is embedded through YouTube's privacy-enhanced mode (youtube-nocookie.com), which does not set tracking cookies unless you press play. If you play a video, YouTube's own terms apply to that playback.

We do not sell your data. We do not share it with advertisers. We do not trade it with other organisations.

How long we keep it

The principles we hold to:

Enquiries and messages are kept while we are dealing with them and for a reasonable period afterwards, then deleted.
Account data is kept while your membership is open. Close it and we delete or de-identify it.
Research data is kept in de-identified form for as long as the study record needs to stand up to scrutiny — a published result that cannot be re-checked is not worth publishing. The key linking the code to you is deleted sooner than the data itself.
Records we are legally required to keep, such as financial records, are kept for the period the law requires.

Your rights

You can ask us to:

Show you what we hold about you, and give you a copy.
Correct anything that is wrong.
Delete what we hold, where we are not legally required to keep it.
Stop or limit a particular use, including stopping marketing email at any time.
Withdraw a consent you previously gave. This does not undo processing that already, lawfully, happened.
Object to processing we are doing on the basis of legitimate interests.
Take your data elsewhere in a portable format.

Exercising any of these is free, and asking costs you nothing in standing with the project.

Withdrawing from the research

You can leave a study at any point, without giving a reason. Tell us and we will stop collecting from you immediately. You can additionally ask us to remove the data you have already contributed, and we will — unless it has already been aggregated into a published analysis, in which case we will tell you plainly that it cannot be unpicked, and we will remove everything that still can be.

Leaving a study does not end your membership, and does not affect anything else you take part in.

How to ask

Email contact@theashtaproject.com and say what you want. We will confirm receipt and act on it.

We have not appointed a Data Protection Officer. Enquiries go to the address above and are dealt with by the project directly.

Complaints

If you think we have handled your data badly, tell us first — we would rather fix it than have it escalated. You also have the right to complain to the data-protection regulator in your country, and you do not need our agreement to do so.

Children

Ashta is not intended for children, and we do not knowingly collect data from them. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. Where a change materially affects data you have already given us, we will tell you directly rather than rely on you noticing.

Related: Terms of use · Research standards · Contact.