條款之卷

Effective date:

YunMing (雲命) respects your privacy. This Policy explains what personal data we collect, how we use it, how long we keep it, and the rights you can exercise. It aligns with the Hong Kong Personal Data (Privacy) Ordinance (PDPO), the EU General Data Protection Regulation (GDPR), and the Personal Information Protection Law of the People's Republic of China (PIPL).

1. **Account data** — email address, display name, and a one-way hashed password. 2. **Birth details** — solar or lunar date of birth, time (where known), time zone, birth city, gender, and the name you want in the reading. These are required to compute a BaZi chart. 3. **Face photographs** — **by default, your face reading runs entirely on your device; the photo is never uploaded to or stored on our servers.** Facial proportions, feature shapes, and complexion are computed in your browser and nothing leaves the device. The photo is uploaded only if you actively choose the optional "Deep Read" upgrade, where a vision model reads finer feature shapes. In that case **the original is destroyed immediately after feature extraction and is not retained**, unless you separately opt in to keep it — in which case it is encrypted at rest and you can delete it any time. 4. **Payment data** — we never store full card numbers or wallet identifiers. Stripe and Airwallex handle the transaction; we receive only status and last-four-digit confirmation. 5. **Usage data** — page views, event clicks, device type, browser, coarse region (IP prefix), and crash reports. Used for product improvement and anti-abuse. 6. **Cookies and similar technologies** — for session state, preferences, and anonymised analytics.

1. To compute and write the reading you ordered. 2. To deliver daily fortunes, reading-ready notices, receipts, and important policy updates. 3. To prevent misuse, fraud, and unlawful activity. 4. To improve the product, working from anonymised or aggregated data.

We do **not** sell birth data, photographs, or reading text. We do **not** make them available as training data for any third-party model.

We share only in these cases:

1. **Essential service providers**, under data processing agreements and on a need-to-know basis: - Google (Gemini models — reading text generation) - Fireworks.ai (vision model — used to read feature shapes **only when you choose the optional "Deep Read" upgrade and upload a photo**; the default on-device face reading never sends your photo to this provider or to any other vision model) - Supabase (database hosting, Singapore / Hong Kong region) - Cloudflare R2 (photo and share-card storage; **a photo is stored only if you choose "Deep Read" or opt in to keep it**) - Stripe, Airwallex (payments) - Resend (email delivery) - OneSignal (push notifications) - Sentry, PostHog (error tracking and anonymised analytics) 2. **Legal compulsion** — in response to a valid order from a competent authority in Hong Kong or in your jurisdiction. 3. **Business transfer** — in the event of a merger, acquisition, or asset sale, with equivalent privacy obligations on the receiving party.

| Category | Default retention | |---|---| | Account data | While account is active | | Birth details | While account is active (needed to re-render your reading) | | Face photo (default on-device reading) | **Not uploaded, not stored** (analysed only on your device) | | Original face photo ("Deep Read" upload) | **Destroyed immediately after feature extraction** (unless you opt in to keep it) | | Reading text | While account is active | | Payment records | Seven years (tax and regulatory requirement) | | Usage logs | Twelve months |

When you delete your account, the above data is permanently removed within 30 days, excluding payment records retained for tax compliance.

Regardless of where you live, you have the right to:

1. **Access** — know what we hold about you. 2. **Rectification** — correct inaccurate data. 3. **Erasure** — request permanent deletion. 4. **Restriction** — pause certain uses. 5. **Portability** — receive a machine-readable export. 6. **Objection** — opt out of marketing communications (each email has a one-click unsubscribe).

EU users (GDPR) may complain to a local data protection authority. Mainland China users (PIPL) may contact the Cyberspace Administration. Hong Kong users (PDPO) may contact the Privacy Commissioner for Personal Data.

To exercise a right, email . We respond within 30 days.

Our cloud providers operate in Singapore, the United States, and the EU. Data may cross borders. We rely on Standard Contractual Clauses, encrypted transport, and data minimisation to keep transfers safe.

The Service is not intended for users under 18. If we learn we have collected a minor's data, we delete it.

1. Transport is HTTPS end-to-end. 2. At-rest data is encrypted with AES-256 in Cloudflare R2; for photos this applies only to those you upload via "Deep Read" or opt in to keep — the default on-device reading produces no uploaded or stored photo at all. 3. Only authorised engineers can touch individual records, for troubleshooting, with an audit trail. 4. In the event of a breach, we notify regulators and affected users within 72 hours.

We use three categories of cookies:

- **Essential** — session state, language preference. - **Analytics** — PostHog anonymised events; can be disabled in settings. - **Marketing** — **we do not use third-party advertising tracking cookies.**

Updates are published on this page; material changes are emailed.

Privacy questions and data-rights requests:

---

YunMing 雲命 · Hong Kong Readings are provided for entertainment and cultural reference only, and do not constitute professional advice.