Personal Information Collection Statement

1. Purpose of Collection

The birth details you enter — date, time, gender and birth city/location — are used for one purpose only: to calculate your BaZi (Four Pillars of Destiny) chart and the related daily, natal and luck readings. Your birth city is converted to coordinates on your device to compute True Solar Time. If you sign in and generate an analysis report (or the app refreshes one you already have to the current version), the birth data needed for that calculation is computed in server memory and discarded immediately afterwards (see “Your Privacy First” above). If you enter someone else’s birth details, please make sure they are happy for you to.

2. Voluntary Supply

Supplying these details is entirely voluntary. If you do not provide them, the only consequence is that the app cannot calculate a chart for you; there is no other consequence.

3. Optional Cloud Backup and Account Data

If — and only if — you choose to sign in to enable cloud backup, the profiles you have saved are backed up to your own Google Drive (a hidden app-data folder) so that you can restore them on another device, and the related account identifier (such as your email address, a Google account ID, or an Apple account identifier (a relay address from Apple, if you use Sign in with Apple and choose to hide your email)) is processed by our authentication provider solely to enable sign-in. The backup never passes through our servers. Our server keeps only the account records listed in section 4 of the Privacy Policy (such as your account ID, plan, daily usage counts, one-way chart identifiers and unlock records), never your birth details or report content.

4. Classes of Transferees

We do not sell your personal data and we do not use it for direct marketing. Your personal data may be handled by:

• our service provider, Google Firebase, acting as our data processor for account identifiers and — if you turn on daily reminders — your push token, language and time zone; and
• our payment provider, Stripe — acting as our data processor for web tips, Pro subscriptions and one-time report purchases; we receive no card or payment details, and we pass Stripe only our internal account ID and, for a two-year outlook, the one-way chart identifier, so the payment can be matched to its unlock. Stripe also holds your email address and transaction records as a data controller in its own right, under its own terms and retention policy; and
• Apple — if you use Sign in with Apple on the iOS version, Apple verifies your identity and gives our authentication provider an account identifier and your email address (or a relay address); when you close your account in the iOS app we ask Apple to revoke this app’s sign-in access;
• Google Play — for in-app purchases on the Android version (tips, the Pro subscription and one-time report purchases), payment is processed by Google; we receive no card or payment details, only the purchase token and order reference, used to verify the purchase and apply refunds; and
• Google reCAPTCHA — used by our app-integrity check (App Check); it sends standard technical signals (such as your IP address) to Google’s reCAPTCHA service to tell humans from automated abuse; and
• regulators, law-enforcement, or our professional advisers, where reasonably necessary or required by law.

5. Retention

Local data is kept on your device until you delete the profile or clear the app’s data. Cloud backups are kept in your own Google Drive until you delete them in the app, close your account, or delete the app’s hidden data in Google Drive (Settings → Manage apps); the account identifier, together with subscription status, Google Play purchase records, daily usage counters and two-year-outlook unlock records, is deleted when the account is closed; a push-reminder token is removed at the next send after you turn reminders off or it goes stale. After deletion we keep only a minimal record: the deleted account’s internal ID with the time of deletion and, if a Google Play purchase had been refunded, a one-way hash of that purchase marked as refunded. It is kept solely so that a deleted account or a refunded purchase cannot be restored, and contains no email address, birth details or purchase details.

6. Your Access and Correction Rights

You have the right under the Ordinance to request access to, and correction of, your personal data held by us. As most data stays on your device, you can exercise these rights directly in the app by viewing, editing or deleting your saved profiles. For any data held in cloud backup, you can delete it in the app while signed in, or delete the app’s hidden data in Google Drive (Settings → Manage apps); for help, contact Bilibala Shadowpaw Limited at info@bilishadowpaw.com. As permitted by the Ordinance, we may charge a reasonable fee for a data access request, and we will respond within 40 days.

By entering your birth details, you acknowledge that you have read and understood this statement.