Privacy policy

By DailyAstro · Last updated 2026-09-29

This English page is a translation provided for convenience. If it differs in any way from the Chinese original at 私隱政策, the Chinese text prevails.

What we collect

Clerk handles login details and necessary session cookies. Stripe handles payments, subscriptions and required billing details. We do not receive or store full card numbers. When membership is enabled, the app checks login status automatically; payment starts when you choose a plan. Signing in does not sync birth profiles by itself; a member can turn on Profile sync (section 5 under Outbound connections).

Cloudflare D1 stores member IDs, Stripe customer/subscription/invoice IDs, membership status, credit grants, AI request IDs, the explanation kind (today / wealth / date / compatibility / start date), content hashes, dates, completion status and reply text for accounting and recovery. Apart from the profiles a member chooses to mirror with Profile sync (section 5), we do not store raw requests, names or birth dates in D1 or write request contents to application logs. Replies remain until you erase them, one at a time or all at once, on the membership page; you can reread saved replies there, and asking about the same result again returns the saved reply without spending another credit. Usage and billing records are retained separately and are not deleted by clearing browser data.

Email-code login is off unless we turn it on. When it is on, that email session is the membership login. D1 stores the login email, a digest of the login code (not the code itself) and a digest of the session token (not the token itself). The `own_` account id is the member id. A code works for 10 minutes. A session lasts up to 30 days. Signing out immediately revokes that session; other devices stay signed in. This version does not delete challenge or session rows on its own. The server rejects expired or revoked sessions. That path has no Clerk delete-account button. Erasing saved AI text removes that member's replies. It does not delete the email, the code digest, or the session digest. Deleting an account on the Clerk path still covers only the Clerk login.

One-off reports also store order and product IDs, Stripe payment IDs, billing mode and status, generation attempts and content hashes, report text, cited computed facts and follow-up questions. Photos and raw birth dates are never stored or logged. Do not include names or contact details in follow-up questions. Follow-ups send the saved report text to the AI provider. PDF export uses the browser print feature on your device. Erasing all saved AI text on the membership page, or deleting the account, also erases one-off report text; payment and abuse-prevention records remain.

What is stored on your device

The following is kept in your browser's localStorage and stays on this machine, in this browser:

Two more are left over from the old version: baziHistory and baziSettings. If you used the old version, the new one reads them once, the first time it reads records or settings, and moves the contents into da_history / da_settings above. Once moved, we do not delete the original two keys — they stay on your machine until you clear this site's data in your browser yourself.

The chart (the four pillars) is never stored; it is derived from the birth date each time. localStorage does not sync anywhere and does not follow you to a second machine.

Outbound connections

In normal use, only the following requests leave your machine:

1. Google Calendar (optional, started by you)

You first have to enter your own Google Client ID and press “connect Google Calendar”. Only then is Google Identity Services (accounts.google.com) loaded for authorisation, with a scope limited to calendar.events. When you press “add to calendar”, what is sent is the date you picked: the date, the hour range, the day master, and the event title and description. The birth date itself is not sent. You can revoke the authorisation in your Google account at any time.

2. AI explanation: forwarded through our server (optional, you press the button)

When you press AI explanation or AI deep analysis, your browser sends the computed result to /api/explain. The natal-chart tab and the daily card send, respectively: the four pillars with ten gods, 納音, life stages, 命宮／身宮 and the luck-cycle stems and branches (direction as a boolean); the 紫微 palaces, stars and transformations; the sun sign, today's house and moon phase; today's pillar, pattern, element and almanac lines; for the annual reading, the year's stem-branch, ten god, branch relations, 太歲 relation, luck-cycle stem-branch, month pillars and 紫微 year palace; for the recommendation grid, the six domain verdicts, scores and signal lines; for the 奇門 hour chart, the hour, the 局, the nine cells, the pattern verdicts and the directions; for feng shui, the year and month flying-star boards and the 八宅 directions (the 命卦 is one trigram looked up from birth year and gender; neither is sent) — again no name, birth date, age or gender. A tarot reading sends the spread, your question (60 characters at most) and the drawn cards (name, orientation, keywords), and nothing from any chart; an I Ching reading likewise sends only the hexagrams, moving lines and question. The Western chart sends each body's sign, degree and house, the ascendant and today's transit aspects, plus the time-zone offset; never the birth instant and never the city. Name numerology sends only the stroke counts, the five grid numbers and their elements, never the characters you typed (the name is not stored either); synastry sends the aspects, overlays and score; the event picker sends the event, the window, your settings and the rule hits of the candidate days, with every participant written as 「參與者」 and no birth data. After checking membership and allowances, the server forwards it to our AI service providers with the site key. Site-funded AI requires an active membership and sufficient allowance; you do not need your own key.

Palm and face readings (/api/vision): the photo you choose is first shrunk in your browser to a JPEG (longest edge 1024 pixels; re-encoding drops location, camera and time metadata). Only when you press “AI 睇手相” or “AI 睇面相” is it sent once, through /api/vision, to our AI service provider, together with the hand you chose, your dominant hand and your question; no name, birth data, age or gender travels with it. We do not store, cache or log the photo: the server keeps only a hash of the request (so the same photo asked again is not charged twice) and the AI reply text, including the observations the AI lists (for example 「生命線：深長清晰」). The site uses a paid AI service whose terms say the photo is not used to improve the provider's products and is retained only briefly for abuse monitoring. The photo lives in the page's memory and is gone when you leave; please use only a photo of yourself.

What is sent: your day master's heavenly stem and its element, the earthly branches of your chart, and for the chosen day its date, day pillar, score, band and golden hour, each scoring rule with its points, and that day's almanac 宜／忌 terms. A compatibility request also sends the other person's day master and branches. It does not include your name or a family member's name, and it does not include the raw birth date. This is filtered twice — once before sending (in the browser) and once after receiving (on the server) — and both layers copy only the fields on an allow-list, discarding everything else.

Raw requests are not written to the database or application logs; replies and usage records are stored as described above. Cloudflare keeps its infrastructure connection records under its own policy. KV keeps short-lived IP counters, removed after about a day, for additional abuse protection: approximately 8 requests per IP per 10 minutes and 30 per day. Those counters are not precise member balances. D1 checks membership credits and daily limits in one write; daily allowances reset at 00:00 UTC (08:00 Hong Kong). A separate site-wide daily attempt cap includes failed attempts to limit provider costs.

Once data reaches an AI service provider it is governed by their privacy policies, which are outside our control.

An API key you entered in an earlier version may still be stored on your device; the current pages no longer offer personal API-key setup. It is used directly from your browser to your chosen AI service provider only when the server answers no_key (that deployment has no site key) or membership_unavailable (that deployment has no membership service). You pay the provider for that use. Palm and face readings never use your own key. A signed-in member who is refused is never switched to their own key, and your own key is not used to bypass membership credit or daily limits.

3. Fonts and visitor counts

Pages load the Noto Serif TC heading font files (body text uses your device's own system font, nothing is downloaded for it) from fonts.googleapis.com and fonts.gstatic.com. The browser makes this request automatically; it carries no personal data, but it does let Google see your IP address — the same as on any other site that uses Google Fonts.

Visitor numbers come from Cloudflare Web Analytics (opens in a new tab): each page loads a small script from static.cloudflareinsights.com that sends the page address (our addresses never carry birth details), the referring page, the browser type, the country or region and page-load timings to Cloudflare. It sets no cookies, writes nothing to your device's storage, builds no cross-site profile, and never receives the birth details or profiles you enter. We only see totals, such as how many people viewed which page each day.

And that is all: no Google Analytics, no Meta Pixel, no A/B testing tool, no ad network, no error-reporting service, no session recording.

4. Membership login and payment

Clerk (opens in a new tab) provides login unless email-code login is on, in which case the email session is the new membership sign-in. Stripe (opens in a new tab) provides payment and subscription management. Clerk processes member login data under our service contract and this site’s privacy policy. Stripe also processes payment data under its privacy policy. Providers may process data in different regions. Resend (opens in a new tab) sends the login code. Resend receives the email address and the code itself so it can deliver the message, and handles them under its privacy policy.

5. Profile sync (optional, off by default)

The membership page has a switch, “Sync my profiles to this account”, off by default. When it is on, this device's profile table — name, role, birth date, birth hour, gender, birth place (a city), archived flag, and each profile's last-modified time — is sent through /api/member/profiles to the member_profiles table of the membership database (Cloudflare D1), tied to your login account; other devices signed in to the same account with sync on receive the same roster. When one profile was changed on both sides, the newer edit wins; a profile deleted on one device tells the others through a deletion record (profile id and time, kept 90 days). These copies are never used for AI explanations (the AI still receives no names or birth dates) and are not written to application logs. When you turn sync off you choose whether to delete the server copies or keep them; deleting your login account deletes them.

Export (.ics / JSON)

“Export .ics” and Profiles → Backup → “Export profiles (JSON)” both assemble the file inside your browser and download it. Nothing goes over the network. The JSON backup contains only the profile table (name, role, birth date, birth hour, gender, archived flag) — no API keys, settings, history or AI cache. “Import JSON” is likewise read only in the browser and only adds people you do not already have; the welcome screen's “Have a backup? Import JSON” is the same feature. “Download saved explanations (JSON)” on the membership page is also assembled in the browser, from your own replies already shown on that page.

How to delete your data

To request account-data deletion, including an email-code login account, email lagunalau@gmail.com. We verify account ownership before processing the request.

• Delete individual profiles or records on the app's Profiles page.
• With Profile sync on, “Turn off and delete” on the membership page removes the profile copies from D1; deleting your login account removes them too.
• Clearing browser site data removes local profiles, settings and caches.
• We cannot restore erased local birth profiles. The membership page can erase server AI reply text and your local member cache; this does not cancel a subscription or erase usage/billing records.
• Manage subscriptions in Stripe. Deleting your login account stops subscriptions and erases saved server reply text; accounting metadata is retained for reconciliation and abuse prevention. Clearing browser data does not delete an account.
• Events already added to Google Calendar live in your own Google account; delete them in Google Calendar.

Children

Paid membership is for adults. You may create local profiles for children in your household; those birth details also remain in your browser (unless you turn on Profile sync).

Policy updates

The September 2026 membership version adds login, billing, usage and reply records; 10 September 2026 adds optional Profile sync (Outbound connections, section 5). On 22 September 2026 palm and face photo readings were added (section 2). 25 September 2026 names email storage for login codes, delivery through Resend, and how long challenges and sessions are kept. 28 September 2026 states that, once email-code login is on, that session is the membership login and a new sign-in on the member pages does not load Clerk. The old description of having no accounts or database no longer applies. We will update this page and its date when data flows change. You can inspect requests to /api/explain in the Network tab and local data in the Application tab of your browser developer tools.