Privacy Policy

Effective date: August 9, 2026 · Last updated: August 9, 2026

1. Who we are

Sōngyǐn ("we", "us") is operated by Sōngyǐn (songyin.app), Hong Kong. Contact: [email protected].

2. What we collect

• Birth information you enter: birth date, time, and birthplace (which we convert into approximate coordinates and time zone). This is needed to cast your chart.
• Account: email address (for magic-link sign-in) and chart notes you add.
• Usage events: pages/actions such as casting a chart, opening a reading, sharing a card, or asking a question (for improving the product; not sold).
• Payment: handled entirely by our payment processor (Merchant of Record). We never see or store your card details.
• Device basics: IP address, browser/device type (for security and rate limiting).

3. How we use it

• To cast charts and generate readings. Reading generation is partly automated by a third-party AI provider (DeepSeek) — the birth data and chart facts needed for your reading are transmitted to that provider for processing. Our deterministic chart engine computes the calendar; the AI only writes the reflective interpretation.
• To send magic-link emails and, if you subscribe, receipts and service notices.
• To keep the service safe (rate limits, abuse prevention) and to understand usage.

4. Legal bases (GDPR)

We rely on: your consent (email, optional analytics); performance of contract (providing readings and subscriptions you purchased); legitimate interests (security, improving the product); and legal obligations.

5. Sharing

We share data only with: (a) payment processors (Paddle / Lemon Squeezy, later Stripe) — only what is required to process a payment; (b) our AI provider (DeepSeek) — birth facts needed to generate a reading; (c) email delivery provider; (d) geocoding providers (OpenStreetMap Nominatim / AMAP) — only your typed birthplace, never your account; (e) analytics, if any, in aggregated/anonymized form. We do not sell your data.

6. Retention

Charts and readings are kept until you delete them (deleting your account deletes your charts, saved readings, and derived data). Usage events are kept for up to 18 months. Subscription records are kept as required by tax/accounting law.

7. Your rights

You may access, correct, export, or delete your data at any time from your account (Export / Delete), or by emailing [email protected]. Under GDPR you may also object to or restrict processing, and complain to your local supervisory authority. Under CCPA/CPRA, California users may request disclosure and deletion, and opt out of "sale" (we do not sell data).

8. Cookies & storage

We use browser localStorage for language preference and session tokens. We do not use third-party advertising cookies. If we later add privacy-respecting analytics, we will update this policy.

9. International transfers

We and our processors operate internationally (e.g. EU users' data may be processed in Hong Kong / the US / China via DeepSeek). Where required by law we rely on appropriate safeguards (Standard Contractual Clauses).

10. Children

The service is not directed at children under 16, and we do not knowingly collect data from children under 16. If you believe a child has provided us data, contact [email protected] and we will delete it.

11. Security

We use HTTPS, hashed session tokens, and least-privilege access. No method is 100% secure; we work to protect your data but cannot guarantee absolute security.

12. Changes

We will post changes here and, for material changes, notify you by email. Continued use means acceptance of the updated policy.