Privacy Policy

1. Introduction

I Ching AI (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website and services (the “Service”) at https://www.iching-ai.ren.

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

We collect the following categories of information:

2.1 Information You Provide Directly

• Questions you submit: The text content you type to ask the I Ching for a reading. This is the primary input for generating your reading results.
• Account information: If you create an account, we collect your email address and authentication credentials. When signing in via Google OAuth, we receive your name and email address from Google.
• Communications: If you contact us via email or other channels, we collect the content of your communications.

2.2 Information Generated by the Service

• Divination records: Hexagram results, changing lines, AI-generated reading text, confidence scores, and timestamps associated with each reading.
• Usage data: Number of readings performed, features accessed, and subscription status.

2.3 Information Collected Automatically

• Payment metadata: Transaction identifiers, subscription status, and payment timestamps from PayPal. We do not receive or store your full credit card number, CVV, or bank account details — PayPal handles all sensitive payment information.
• Technical data: Standard server logs including IP address, browser type, operating system, referring URLs, and timestamps. These are collected by our hosting provider (Vercel) in the normal course of serving web traffic.
• Local storage: We store reading history and session preferences in your browser's localStorage so you can access your readings without signing in. This data remains on your device unless you clear your browser storage.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide the Service: Your question text is transmitted to the DeepSeek API to generate AI-powered I Ching readings. Divination records are saved so you can review your reading history.
• To manage your account: Email addresses are used for authentication, account recovery, and to sync your reading history across devices when signed in.
• To process payments: Payment metadata is used to manage your subscription status, verify access rights, and handle billing-related communications.
• To improve the Service: Aggregated, anonymized usage data helps us understand how users interact with the Service, identify bugs, and improve the quality of our AI readings.
• To communicate with you: We may send service-related emails such as account confirmations, subscription receipts, and important updates. We do not send marketing emails without your consent.
• To comply with legal obligations: We may process your data as required by applicable law, regulation, or legal process.

4. Legal Basis for Processing (EEA / UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, our legal basis for processing your personal data depends on the specific context:

• Contractual necessity: Processing required to provide the Service you have requested (e.g., generating readings, managing your subscription).
• Legitimate interests: Processing for our legitimate business purposes (e.g., improving the Service, preventing fraud) where these interests are not overridden by your data protection rights.
• Consent: Where you have given clear consent for a specific purpose (e.g., receiving optional communications).
• Legal obligation: Processing required to comply with applicable laws.

5. How We Share Your Information

We do not sell, rent, trade, or share your personal data with third parties for their own marketing purposes. We share data only as necessary to operate the Service:

5.1 Service Providers

• DeepSeek API: Your question text, hexagram data, and system prompt are transmitted to DeepSeek's servers for AI inference. DeepSeek processes this data solely to generate your reading. We have configured our integration to minimize data retention by the AI provider.
• PayPal: Our payment processor. When you make a purchase, PayPal collects your payment details, billing address, and transaction information. PayPal shares limited metadata (transaction ID, subscription status, email) with us to enable service delivery. PayPal's use of your data is governed by their own Privacy Policy.
• Supabase: Provides our database and authentication infrastructure. Your account credentials, reading history (for signed-in users), and subscription metadata are stored in Supabase with encryption at rest and in transit.
• Vercel: Hosts and delivers our website. Vercel may collect standard access logs (IP address, user agent, request path) for operational and security purposes.

5.2 Legal Disclosures

We may disclose your information if required to do so by law or in response to valid legal requests by public authorities (e.g., a court order, subpoena, or government demand). We may also disclose information to protect our rights, property, or safety, or that of our users or the public, as required or permitted by law.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, user data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

6. Data Storage & Retention

Your data is stored in the following locations:

• Browser localStorage: Reading history for users who have not signed in. This data remains on your device and is under your control — you can clear it at any time through your browser settings or our History page.
• Supabase (cloud database): Account information, reading history for signed-in users, and subscription metadata. Data is encrypted at rest and in transit. Supabase servers are located in the United States.

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. When your data is no longer needed, we will delete or anonymize it.

7. Cookies & Local Storage

I Ching AI uses browser localStorage to persist your reading history and session state across visits. localStorage is a client-side storage mechanism — data stored there never leaves your device and is not transmitted to our servers unless you are signed in and choose to sync.

We use a minimal session cookie managed by Supabase for authentication purposes when you sign in. This cookie is essential for maintaining your signed-in state and is not used for tracking.

We do not use third-party tracking cookies, analytics cookies, advertising cookies, or any other form of tracking technology. We do not integrate with Google Analytics, Facebook Pixel, or similar tracking services.

8. Your Data Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can request correction of inaccurate or incomplete data.
• Erasure: You can request deletion of your personal data (“right to be forgotten”).
• Data portability: You can request your data in a structured, machine-readable format.
• Restriction of processing: You can request that we limit how we process your data.
• Objection: You can object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, you can withdraw that consent at any time.

To exercise any of these rights, contact us at hw227345915@gmail.com. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

Self-Service Data Management

You can delete your reading history at any time from the History page within the Service. If you are signed in, deleting history from the app also removes the corresponding records from our database. You can also clear localStorage data through your browser settings.

9. International Data Transfers

Our Service is operated from servers located in the United States. If you access the Service from outside the United States, your data may be transferred to, stored, and processed in the United States or other countries where our service providers operate. These jurisdictions may have data protection laws that differ from those in your country.

We take appropriate safeguards to ensure your data remains protected in accordance with this Privacy Policy, including using service providers that maintain industry-standard security certifications and comply with applicable data transfer frameworks.

10. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have inadvertently received personal data from a child under 13, we will delete such information from our records as quickly as possible. If you believe a child under 13 has provided us with personal data, please contact us immediately.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS.
• Encryption of data at rest in our database (Supabase).
• Secure authentication via industry-standard providers (Supabase Auth, Google OAuth).
• Restricted access to personal data on a need-to-know basis.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will update the “Last updated” date at the top of this page.

For material changes, we will provide additional notice — such as a prominent notice on our website or an email notification to registered users. We encourage you to review this Privacy Policy periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For users in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.