Did your birth time just move to an image lab?

What the disclosure says and does not say

Midjourney acquired the astrology app Co-Star on July 24. Terms were not disclosed, neither company issued a direct statement, the app's two dozen employees moved to Midjourney, and the report puts the app at roughly 4.3 million monthly active users.^[1]

The app's function also describes what it holds. Co-Star is built around users generating a birth chart, and a birth chart requires a date, a time and a place of birth. The shape of the dataset therefore follows from what the product does rather than from any statement. That is an inference resting on the product's definition, not on what either party said.^[1]

Where the chain breaks

Acquiring a company also transfers control of the data that company holds. Here there is no published document describing to whom the transfer runs, on what terms, or with what retention period. That the buyer is a lab known for image and video generation sharpens the question, but on its own it proves nothing about purpose.^[1]

The strongest competing reading sits in the same report. Midjourney delivers its products mainly through Discord, and the report notes that the Co-Star team's consumer-app experience could help Midjourney build a standalone app of its own. On that reading the centre of gravity is the team, and the dataset is a line item that arrives alongside the acquired company. Today's sources do not let anyone separate the two readings.^[1]

The document that would close this

One publication, not an interpretation, would resolve this: an updated privacy notice for Co-Star users that names the new data controller, states the retention period, and says plainly whether birth information may be used to train or personalise Midjourney's systems. The same text would show whether existing users are given a route to exit and deletion.^[1]

Until that document appears there is no allegation of a breach here. What there is: information 4.3 million people gave to an astrology app now sits with a different company, and the terms of that move have not been published. That is also the next thing to watch — whether the privacy notice is updated, and if it is, whether the named data controller changes with it.^[1]