1. Who We Are

Bilibala Shadowpaw Limited, a company registered in Hong Kong with its registered office at Unit A, 19/F., Hillier Commercial Building, 65-67 Bonham Strand, Sheung Wan, Hong Kong, is the data user responsible for the app. For privacy matters you may contact us at info@bilishadowpaw.com.

2. Our Privacy Commitment (Zero-Knowledge)

The app is built so that your core astrological data — your birth date, time, gender, birth location, and the charts computed from them — stays on your own device and is never stored on our servers. Even if you enable the optional cloud backup, the backup lives only in your own Google account (a hidden app-data folder in your Google Drive, encrypted with AES-256); we cannot read it and hold no copy of it on our servers. The one exception: when you generate an analysis report or a two-year outlook — or when you open a report made by an older version and the app refreshes it to the current version in the background — the birth data needed for that calculation (with the name you gave the profile) is transmitted over an encrypted channel to our server, computed in memory only, and discarded immediately on completion — it is never written to any log or database. Report content is stored encrypted on your device and in your own Google Drive only; our servers retain only the account records listed in section 4, plus aggregate counts of report outcomes that carry no account ID (such as how often each report-engine version is used, or how many reports fall in each strength band or pattern).

3. Personal Data We Do Not Collect

By default, the following never leaves your device (the only exceptions are generating and refreshing a report — see section 2 above):

your birth date, time and gender;
your birth city / location (used on-device to compute True Solar Time); and
the BaZi charts, readings and reminders calculated from them.

4. Data You Choose to Provide

You may choose to share certain data with us:

Cloud backup — if you sign in to enable backup, your saved profiles are backed up to your own Google Drive (a hidden app-data folder only this app can access) so you can restore them on another device; the backup never passes through or is stored on our servers.
Account & authentication data — to sign in, our authentication provider processes an account identifier such as your email address, a Google account ID, or an Apple account identifier (a relay address from Apple, if you use Sign in with Apple and choose to hide your email).
Your current location (optional) — if you choose “use my location” for the daily chart, the app reads your device location once and uses it on your device solely to compute True Solar Time; only the longitude is used, and it is neither stored nor transmitted.
Daily reminders (optional) — if you turn on push reminders, our server stores your device’s push token (issued by Google Firebase Cloud Messaging), your language setting and your time zone, so a reminder can be sent at 9 a.m. local time. No sign-in is needed, and none of it is linked to your chart or birth data. When you turn reminders off the token is invalidated and removed at the next send; the same happens when it goes stale (for example, the app is uninstalled).
Other people’s details — if you enter someone else’s birth details (a partner, child or parent, for example), please make sure they are happy for you to. They are handled exactly like your own: kept on your device and, when you generate or refresh a report, sent with the name you gave the profile as described in section 2, then discarded.
Communications — if you email us, we receive your message and contact details to respond.
Analysis reports — when you are signed in and generate a report, the calculation completes in server memory (see section 2), and the finished report is stored encrypted on your device only, with an optional copy in your own Google Drive; our servers retain only your account identifier, subscription status, daily usage counts linked to your account, the purchase token and order reference Google provides (if you buy through Google Play) and a one-way hash identifying the chart (derived from your account and the chart’s details; it marks that you have generated a basic report and — if you buy a two-year outlook — records the edition unlocked and whether your first-report price has been used). That identifier is pseudonymous, not anonymous: the number of possible birth details is limited, so someone holding the identifier and your account ID could in theory try to work them out. None of this contains report content.

5. Technical and Usage Data

We use Google Analytics for Firebase to help us understand how the app is used. It automatically collects app-interaction events (such as the screens you view) and device and app identifiers (such as an app-instance ID), together with limited technical information such as app version, device and operating-system type, language setting, and crash diagnostics. Server logs may briefly record IP addresses for security and abuse prevention. This information is used only for analytics and to keep the app secure, and is not linked to your astrological profile or birth data. The app does not use advertising identifiers and contains no advertising SDKs.

6. Cookies and Local Storage

The app uses your browser’s local storage / on-device storage to remember your saved charts and preferences (for example your selected city and active profile). It does not use third-party advertising or cross-site tracking cookies.

7. How We Use Data, and Our Legal Basis

We use the limited data described above only to provide and secure the app, to enable backup and restore if you opt in, to process payments and apply purchases to your account, to send daily reminders if you turn them on, to understand how the app is used (analytics), to respond to your enquiries, and to comply with applicable law. We process personal data on the basis of your consent and for the directly related purposes set out in our PICS, consistent with Data Protection Principle 1 of the Ordinance.

8. Disclosure and Third Parties

We do not sell your personal data, and we do not use it for direct marketing. Personal data may be handled by:

Google Firebase — our provider (Authentication, hosting, the server functions that calculate reports, the database holding the account records listed in section 4, push notifications and Google Analytics), acting as our data processor for your account identifier, those account records, your push-reminder token and analytics data; your backup, by contrast, lives in your own Google account (Google Drive) — your own storage, not our systems; and
Apple — if you use Sign in with Apple on the iOS version, Apple verifies your identity and gives our authentication provider an account identifier and your email address (or a relay address); when you close your account in the iOS app we ask Apple to revoke this app’s sign-in access;
Google Play — if you make an in-app purchase on the Android version (an optional tip, the Pro subscription or a two-year outlook), the payment is processed by Google under the Google Play Terms of Service and Google’s Payments privacy notice; we receive no card or payment details, only the purchase token and order reference Google provides, which we use to verify the purchase, stop it being used twice and apply refunds; and
Stripe — on the web version, tips, Pro subscriptions and one-time report purchases are processed by Stripe; we receive no card or payment details, only notifications of subscription and payment status. So that a payment can be matched to its unlock, we pass Stripe our internal account ID and, for a two-year outlook, the one-way chart identifier. Stripe also holds your email address and transaction records as a data controller in its own right, under its own terms and retention policy; and
Google reCAPTCHA — used by our app-integrity check (App Check); it sends standard technical signals (such as your IP address) to Google’s reCAPTCHA service to tell humans from automated abuse; and
professional advisers, regulators or law-enforcement — only where reasonably necessary or required by law.

9. Cross-Border Data Transfer

Report calculations run on our server in Hong Kong. Our providers may process data on servers outside Hong Kong (including in the United States): Google (sign-in, analytics, push notifications and reCAPTCHA) may handle your account identifier, push token and technical data, and Stripe (web payments) handles payment records and the identifiers used to match them; if you enable cloud backup, the backup is stored in your own Google Drive, where its location is governed by your own agreement with Google. We take reasonable steps to ensure that data we process continues to be protected to a standard comparable with the Ordinance.

10. Data Retention

Data stored locally remains on your device until you delete the relevant profile or clear the app’s data. If you use cloud backup, the backup remains in your own Google Drive until you delete it in the app, close your account, or delete the app’s hidden data in Google Drive (Settings → Manage apps) — revoking the app’s access alone does not delete it; the account identifier we hold via our authentication provider is deleted, together with your subscription status, Google Play purchase records, daily usage counters and two-year-outlook unlock records, from active systems when you close your account, subject to any legal retention requirements. A push-reminder token is not tied to an account: it is removed at the next send after you turn reminders off or it goes stale. After deletion we keep only a minimal record: the deleted account’s internal ID with the time of deletion and, if a Google Play purchase had been refunded, a one-way hash of that purchase marked as refunded. It is kept solely so that a deleted account or a refunded purchase cannot be restored, and contains no email address, birth details or purchase details.

11. Security

We apply industry-standard measures, including encryption in transit and at rest, and app-integrity checks (App Check) against abuse. Your charts are stored encrypted with AES-256 both on your device and inside the backup: the backup lives in a hidden app-data folder in your own Google Drive as ciphertext, readable only by this app under your authorisation. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a personal-data breach occurs that is likely to cause harm, we will take steps to contain and mitigate it, and where appropriate we will notify affected users and the Office of the Privacy Commissioner for Personal Data, Hong Kong.

12. Your Rights (Access and Correction)

Under the Ordinance you have the right to request access to, and correction of, your personal data held by us. Because most data stays on your device, you can exercise these rights directly in the app by viewing, editing or deleting your saved profiles, and by clearing the app’s data. For any data held in cloud backup, you can delete it in the app while signed in, or delete the app’s hidden data in Google Drive (Settings → Manage apps). As permitted by the Ordinance, we may charge a reasonable fee for processing a data access request, and we will respond within 40 days.

13. Children’s Privacy

The app is not directed to children under 18, and we do not knowingly collect their personal data. Users under 18 may use only the no-sign-in, on-device features, with a parent’s or legal guardian’s consent; signing in, cloud backup and any purchase require you to be at least 18. If you believe a child has provided us with personal data, please contact us so we can remove it.

14. Third-Party Links

The app may link to third-party sites (such as our Threads page). We are not responsible for their content or privacy practices; their own policies apply.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the version and date above, and where changes are material we will take reasonable steps to notify you. Your continued use of the app constitutes acceptance of the updated policy.

16. Contact and Complaints

For any privacy question or to exercise your rights, contact Bilibala Shadowpaw Limited at info@bilishadowpaw.com. You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).