Privacy Policy

Effective: 2026-07-26

This Privacy Policy explains how IChing Oracle Chat ("we," "our," or "us") collects, uses, and protects your information when you use ichingoracle.chat. If you have questions, contact us at [email protected].

1. Information we collect

  • Account information: email address, display name (if you register or sign in via Google).
  • Usage data: IP address, browser type, device info, pages visited.
  • Readings & interactions: questions you submit, hexagrams generated, AI chat messages.
  • Payment information: processed by Stripe. We do not store card numbers.
  • Cookies and similar: see section 5.

2. How we use your information

We use it to provide the I Ching reading and chat services, improve the product, communicate with you about your account, and meet legal obligations. We do not sell your personal data.

3. Legal bases (GDPR / UK GDPR)

  • Contract (Art 6(1)(b)): providing the service you signed up for.
  • Consent (Art 6(1)(a)): optional communications you explicitly opt into.
  • Legitimate interests (Art 6(1)(f)): security, fraud prevention, service improvement.
  • Legal obligation (Art 6(1)(c)): responding to lawful requests.

4. Who we share information with

We share limited information with the following processors and sub-processors:

  • Supabase — authentication and database hosting.
  • Stripe — payment processing.
  • Cloudflare — content delivery, DDoS protection, analytics.
  • OpenAI — AI interpretation of readings (we send your question and hexagram, not your name or email).

We disclose information to legal authorities when required by law.

5. Cookies and tracking

We use only strictly necessary cookies (session authentication). We do not use analytics, advertising, or other tracking cookies, so there is no cookie consent banner — there is nothing optional to consent to.

Aggregate traffic measurement (page views, referrers) is performed by Cloudflare Web Analytics, which is cookieless and does not identify individual users.

6. International data transfers

Your information may be processed outside your country. We rely on EU Standard Contractual Clauses with our US processors.

7. Data retention

  • Account data: while your account is active, then up to 30 days after deletion request.
  • Readings & chat: while your account is active; you can delete individual readings any time.
  • Payment records: 7 years (legal retention obligation for tax purposes).

8. Your rights (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to access, correct, delete, port, and restrict processing of your personal data, plus the right to object and to withdraw consent. Contact us at [email protected].

You also have the right to lodge a complaint with your national data protection authority.

Your Privacy Choices (CCPA / California, plus CO, VA, CT, UT, TX, OR)

If you are a California resident or live in another US state with a comprehensive privacy law, you have the right to:

  • Know what personal information we collect and how we use it.
  • Delete personal information we have about you.
  • Correct inaccurate personal information.
  • Opt out of "sharing" of personal information for cross-context behavioral advertising — we do not share personal information for behavioral advertising, so there is nothing to opt out of.
  • Non-discrimination for exercising your rights.

We do not sell personal information. To exercise any of these rights, email [email protected].

9. Security

We use TLS for all traffic, encrypt data at rest with our infrastructure providers, and apply least-privilege access. No system is perfectly secure; we cannot guarantee absolute security.

10. Children's privacy

Our service is not directed to children under 13 (US) or 16 (EU/UK). We do not knowingly collect data from anyone under those ages.

11. Changes

If we make material changes we will update the effective date above and, where appropriate, notify you in-product.

12. Contact

Questions, requests, or complaints? Email [email protected].