Privacy Policy

1. What we collect

Account data: an email address and a password hash when you register with email, or the basic profile (email address, display name, avatar) you choose to share when you sign in with Google. We do not ask for a phone number.

Reading data: the birth date you enter, and the reading generated from it. Codes are calculated from that date alone.

Order data: which product you bought, the amount, the currency, the order status and the email used at checkout. Card details are entered on the payment provider's page and are never sent to or stored by us.

Technical data: a session cookie that keeps you signed in, and standard server logs (IP address, user agent, timestamp, requested path) that our hosting provider records to serve the page and block abuse.

2. How we use it

To create your account and keep you signed in; to generate and deliver the reading you ordered; to process refunds and answer support requests; to detect fraud and abuse; and to meet our tax and accounting obligations.

We do not sell personal data. We do not use your birth date or reading content to target advertising, and we do not build advertising profiles from it.

Where we use automated systems — including AI models — to draft report text, the output is labelled as generated content. We do not use your reading to train third-party models beyond what is needed to produce that one request.

3. Where data is stored and how it is protected

Account, session and order records are stored in a managed database operated by our cloud infrastructure provider (Cloudflare, including Cloudflare D1). The site itself is served from the same provider's edge network. Transaction records are also held by our payment provider and merchant-of-record partner.

Data is encrypted in transit using HTTPS/TLS for every request between your browser and our servers. Passwords are never stored in plain text: we keep only a salted, iterated PBKDF2-SHA256 hash. Session tokens are random, stored server-side, expire after 30 days, and are transmitted in an HTTP-only cookie.

Access to production data is limited to the operator account, protected by multi-factor authentication. We keep no local copies of the production database.

Retention: account records are kept while your account is open and for as long as needed to serve you. Order and tax records are kept for the period required by accounting and tax rules. Server logs are kept for a short operational window and then discarded. When data is no longer needed, it is deleted or anonymised.

4. Who we share it with

Payment providers and the merchant of record that sells on our behalf, to process your payment, calculate tax and handle refunds and chargebacks. They receive your email address, order amount and country — not your reading content.

Cloud infrastructure and email delivery providers, which host the site, store the database and send transactional email such as sign-in codes and receipts. They process data on our instructions.

Authorities, where we are legally required to disclose, or where disclosure is necessary to investigate fraud or protect someone's safety.

We do not share personal data with advertisers, data brokers or social networks, and we do not transfer your reading to any third party for marketing.

5. Your rights over your data

Access and portability: you can ask us for a copy of the personal data we hold about you. Write to lpz23242324@gmail.com from the email address on the account.

Correction: if your email address or other account details are wrong, you can change them in your account page, or ask us to correct them.

Deletion and account closure: you can ask us to delete your account and the readings attached to it. We will action a verified request within 30 days, and confirm by email when it is done. A small number of records (for example paid invoices) must be retained for tax and accounting purposes for the period the law requires; those records stay but are no longer used to serve you.

Objection and restriction: you can ask us to stop a particular use of your data, or to restrict processing while a correction is checked. If the use is based on consent, you can withdraw consent at any time.

Complaints: if you are in the EEA or the UK, you may complain to your local data protection authority. We would appreciate the chance to resolve it with you first.

We respond to rights requests within 30 days. We may ask you to confirm control of the account email before acting, so that one person cannot delete another person's data.

6. Cookies and local storage

We use one essential cookie to keep you signed in, and local storage to remember your language and theme preference. These are required for the site to work; we do not set advertising or cross-site tracking cookies.

Clearing your browser storage will sign you out and reset your preferences, but will not delete your account.

7. Children

The service is intended for adults. We do not knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we will remove it.

8. International transfers

Our infrastructure and payment partners operate globally, so your data may be processed in a country other than the one you live in, including the United States and the European Union. Where data leaves your region, we rely on the providers' standard contractual safeguards for international transfers.

9. Changes to this policy

If we change how we handle personal data, we will update this page and change the date at the top. Material changes that affect your rights will be announced on the site before they take effect.

10. Contact

Privacy questions and rights requests: lpz23242324@gmail.com. We usually reply within two business days.