Privacy Policy

1.1. Account information. When you create an account we collect your phone number (used as your login identifier) and a personal identification number (PIN) you choose. We do not collect your email, full legal name, or government ID for standard account creation. The phone number is the only durable user identifier we hold.

1.2. Birth data. When you request a reading you provide birth year, month, day, hour, minute, gender, and birthplace (city / timezone). You may optionally provide a display name for the chart subject. Birth data is the only input the reading engine needs to compute a chart; we do not collect or infer any other personal identifier from it.

1.3. Reading content. The classical interpretations the engine generates for you (BaZi, compatibility, decade map, annual forecast, etc.) are stored against your account so you can revisit them in your history. Reading content is derived from the engine and your birth data; we do not write narrative content about you beyond what the deterministic engine produces.

1.4. Payment metadata. When you purchase a reading we collect the transaction ID, amount, currency, status, and timestamp from the payment processor (ABA Bank PayWay or KHQR / Bakong). We do not collect, store, or have access to your full credit card number, CVV, bank account number, or PIN. The payment processor handles those fields directly under their own privacy terms.

1.5. Technical data. When you use the Platform we automatically receive your IP address, user agent string, referrer URL, request timestamps, and similar standard web-request metadata. We use this data for rate limiting, fraud detection, bot detection, security incident response, and operational performance monitoring.

1.6. Notifications. If we send you a notification, we record which notifications you have viewed (per-user read state). We do not record your reaction to the content beyond "viewed".

1.7. Feedback. If you submit feedback through the in-app form, we store your feedback text against your account so we can respond and improve the Service. Feedback is treated as sensitive and is only visible to the operator.

2.1. To provide the Services: compute charts, generate readings, save them for revisits, run compatibility analyses between charts you supply, and surface saved profiles you have created.

2.2. To process payments and prevent fraud: verify completed transactions, redeem credits against readings, detect duplicate or replayed transactions, enforce monthly spend caps, and block known bad actors.

2.3. To operate the Platform securely: rate limiting, bot detection, CSRF protection, IP-level blocking when patterns indicate abuse, security event logging, and incident investigation.

2.4. To improve the Service: aggregate, anonymized usage statistics (e.g., which reading types are popular, which fail to load) inform what we build next. Aggregated data is never traceable back to an individual.

2.5. To communicate with you: send platform notifications (new readings, language updates, maintenance windows) through the in-app bell. We do not send marketing SMS or email; the in-app bell is the only channel.

2.6. To comply with legal obligations: respond to lawful requests from competent authorities, defend the Company in legal disputes, and meet record-keeping obligations under applicable law.

3.1. Payment processors. ABA Bank PayWay and KHQR (Bakong) receive the transaction metadata necessary to authorize and confirm your payment. They operate under their own privacy and data-handling terms.

3.2. Hosting and infrastructure providers. The Platform runs on Digital Ocean for hosting and Supabase for database and authentication. These providers process data on our behalf under their own contractual data-handling commitments. We have no commercial reason to share your data outside this operational stack.

3.3. No advertising networks. We do not run third-party advertising and do not share data with advertising networks, data brokers, or analytics resellers. The Platform has no third-party ad pixels, social media login providers, or external analytics SDKs.

3.4. Law enforcement. We will disclose information when compelled by valid legal process (subpoena, court order, or equivalent in our jurisdiction) and only the minimum data necessary to comply.

3.5. Business transfers. If the Company is acquired, merged, or reorganized, your data may be transferred as part of that transaction. In that event we will provide notice through the Platform before any change in data ownership takes effect.

4.1. Account and reading data. We retain your account, saved birth profiles, and reading history for as long as your account is active. If you delete your account, we delete or anonymize this data within thirty (30) days, except where retention is required by law (e.g., transactional records for accounting).

4.2. Payment records. We retain payment transaction records for the minimum period required by applicable financial-services and tax regulations.

4.3. Security logs. Technical logs (IP, request timestamps, rate-limit events, security events) are retained for up to ninety (90) days for operational and incident-investigation purposes, then aggregated or deleted.

4.4. Aggregated analytics. Aggregated, anonymized statistics (with no individual identifiers) may be retained indefinitely for product planning.

5.1. Access. You can view your account, saved profiles, and reading history through the Platform interface at any time.

5.2. Correction. You can update your saved profiles, including birth data, through the Platform interface.

5.3. Deletion. You can delete saved profiles individually, or contact us to delete your entire account. Account deletion removes your profiles, reading history, and per-user notification state, and anonymizes any required retained records (e.g., payment transactions) so they no longer identify you.

5.4. Data portability. You can request a copy of your saved profiles and reading content in a machine-readable format by contacting us. We will respond within thirty (30) days.

5.5. Opting out of notifications. You can ignore or dismiss the in-app notification bell at any time. Because we do not send marketing SMS or email, there is no separate marketing channel to unsubscribe from.

5.6. Withdrawing consent. You can stop using the Platform at any time. Continuing to use the Platform after a Privacy Policy update constitutes your acceptance of the updated terms.

6.1. Encryption. All data in transit between your device and the Platform is encrypted using HTTPS (TLS). Data at rest in our database is encrypted by the hosting provider. Authentication tokens are short-lived and rotated regularly.

6.2. Access control. Internal access to user data is limited to a small number of authorized operators who require it to operate the Platform. Access is logged and audited.

6.3. No method of transmission or storage is perfectly secure. While we use industry-standard measures to protect your data, we cannot guarantee absolute security. You are responsible for keeping your phone number and PIN private.

6.4. Security incident response. If we become aware of a breach affecting your personal data, we will notify you through the Platform and (where required by law) the relevant supervisory authority, in line with applicable breach-notification timelines.

7.1. The Platform is not directed to children under thirteen (13) years of age and we do not knowingly collect personal data from children. If you are a parent and believe your child has provided us with personal data, contact us and we will delete it.

7.2. Birth data submitted for children (by their parent or guardian) is treated as belonging to the account holder who submitted it. The account holder represents that they have legal authority to submit such data on the child's behalf.

8.1. The Platform is operated from Cambodia. Your data may be stored and processed on servers located in the country where our hosting provider operates (Digital Ocean) and where our database provider operates (Supabase). By using the Platform you consent to this transfer and processing.

9.1. We may update this Privacy Policy from time to time. Material changes will be announced through the Platform notification bell. The "Effective Date" at the top of this page indicates when the current version took effect. Continued use of the Platform after a change indicates your acceptance of the updated policy.

10.1. If you have questions about this Privacy Policy, want to exercise any of your rights, or wish to report a data-handling concern, contact us through the in-app feedback form. We aim to respond within fourteen (14) days.