Privacy Policy

The short version

Generating a reading requires an account. When you generate one, the reading and the birth details behind it are saved to your account automatically, so you can come back to them. Other users cannot see them. The providers who process them for us are named below, and you can delete any reading, or the whole account, at any time.

Browsing the site — the home page, the sample reading, and these policy pages — needs no account, and stores nothing about you beyond the technical logs our hosting provider keeps for every request. The free type page needs a sign-in; the birth details you enter there are remembered in your own profile (see below) so you never have to type them twice, and your yes / no taps on "the last few years" are counted anonymously: only which line was tapped yes or no, how many years back it was, the language, and whether a gender was given. No birth details, no identity, nothing that can be traced back to anyone.

Who is responsible for your data

CHANFLOW LIMITED, a company incorporated in Hong Kong (company no. 81164855) with its registered office at Room 12, 6/F, The Cloud, 111 Tung Chau Street, Tai Kok Tsui, Hong Kong, operates thechanflow.com and is the data controller for everything described on this page.

It has not appointed a representative in the European Union. If one is appointed, the name and address will be listed here. Every privacy question and request goes to thechanflow@gmail.com and is handled by the company directly.

What we collect

Birth details you enter about yourself: date, and optionally time, birthplace, gender, and a name label. These are what the chart is calculated from. Gender is used for two things only: the direction of the BaZi ten-year cycles depends on it, and the short lines about recent years on the free type page weigh the relationship signals by it. The last set you entered as yourself is remembered in your profile, to pre-fill forms, show your type straight away and draw your chart on the "My chart" page; only you can see it, and your account page lets you make the site forget it at any time.

For a relationship report, the same birth details about the other person — the one you are giving the mirror to — plus a name label for them. They are sent and saved exactly like your own. Only enter another person’s birth details if you are entitled to share them with us.

Anything you type when asking follow-up questions about a reading. It is sent to Anthropic together with the chart, and saved with the reading in your account.

If you arrived through someone's share link, your profile records that person's invite code (eight characters), used only to know who brought whom; it is never displayed.

Where you first came from, if you came through one of our links or another website: the campaign tags on that link (for example "tiktok" and the post it belonged to) or, without tags, the name of the referring site, plus the page you landed on and when. It is recorded once on your account when you sign up, so we can tell which of our posts bring people; it is never shared with anyone, including advertising platforms, and it is included in your data export.

The "that's me" / "not me" marks you tap under each part of a report. Each mark records only which part and which of the two you chose; it is saved with that reading in your account, is never sent to Anthropic, and is deleted with the reading or with your account.

Your email address, only if you create an account. If you sign in with Google, Google also passes us the name and profile-picture link on your Google account, which our sign-in provider stores alongside your account. We do not store passwords, because ChanFlow has none — you sign in with Google or with a one-time code sent to your email.

Profile details you choose to add to your account: a display name, a phone number, and an avatar image. All three are optional and you can clear them at any time; clearing an avatar deletes the image file too. The display name and phone number are visible only to you. An avatar is stored in a public bucket, which means anyone holding its file URL can open it — so do not upload anything you would not put on a public page. We do not text you and we do not verify the phone number — it is a contact detail only, and it cannot be used to sign in or to recover your account.

Basic technical data your browser sends with any web request — IP address, user agent, the address requested, and the time. Our hosting provider records these in its standard access logs, and we use them for security and rate limiting. Our own application logs do not record birth details. The requested address does include the text you type while searching for a birthplace, and the parameters of a share-card image (the element and sun sign derived from a chart).

Sign-in events. Our sign-in provider keeps a security log of when an account signs in, including the IP address, which we do not have a way to edit.

Site usage statistics, in aggregate: which pages are viewed, and in-page actions — opening the door on the home page, completing a sign-in, and following a guide link to the sample or free type card — together with the page address, the site you came from, country, device type and browser. This is Vercel Web Analytics: it sets no cookie and does not identify you; visitors are counted with a one-way code that changes every day. It is not used for advertising.

Who else sees it

Anthropic — generating a reading means sending Anthropic’s models the chart calculated from the birth details (the pillars, ten-year cycles, and other chart positions — your birth year can be inferred from it), together with anything you type in follow-up questions. Your birthplace, its coordinates, and name labels are not sent. Each follow-up re-sends the whole conversation. Anthropic processes this as a data processor for us under its API terms, and keeps request content for a limited period under its own data-retention policy, including a short-lived cache of the chart. We cannot delete what has already been sent.

Vercel — hosts the site and serves every request, keeps the standard access and function logs described above under its own retention period, and provides the aggregate usage statistics described above.

Supabase — stores accounts, saved readings, your birth book, and any avatar image you upload, and keeps the sign-in security log and database backups. This applies only if you sign in.

Resend — delivers the sign-in code email. It receives your email address and the content of that email, only when you ask for a code.

Stripe — if you start a top-up, the checkout page is Stripe’s. We pass it your email address (to prefill the form and send the receipt) and an internal account identifier, so the payment can be credited to your account; your card or wallet details go to Stripe directly and never reach us.

These providers may process your data in a country other than the one you live in. The regions where each provider holds your data, and the safeguards we rely on for transfers out of the EU and the UK (such as a data processing agreement with standard contractual clauses), will be listed here once confirmed.

We do not sell your data, and we do not share it with advertisers.

How long we keep it

Deleted immediately: readings, birth-book entries, profile details, and the avatar file are removed from the live database the moment you delete them or delete your account. We do not keep previous versions of an avatar.

Deleted with a delay: our database provider keeps backups for disaster recovery. A deleted row stays in those backups until the backup window ends, then it is gone and cannot be recovered. We do not restore backups to bring individual data back.

Kept by third parties under their own policies: content already sent to Anthropic, our hosting provider’s access logs, and the sign-in provider’s security log are not touched by deleting a reading or an account. Each expires under that provider’s retention period; we cannot delete them ourselves.

Kept after you delete your account, so the complimentary credits are given once per person and not once per sign-up: a one-way hash of your email address together with how many complimentary credits it has used. It contains no email, no name and no reading, and it is only ever compared against — never displayed or sent anywhere. The hash is taken from a normalized form of the address — for example, Gmail dots and any “+tag” suffix are ignored — so different spellings of one inbox count as one person, whether the accounts exist at the same time or one after another. Signing up again with the same email therefore does not grant the complimentary credits a second time.

Kept because the law requires it: records of payments — what you paid, when, and the payment processor’s reference for it. They are kept for as long as tax and accounting law requires, even after you delete your account. Deleting your account unlinks the record from it in our database; the payment processor’s own records of the payment still identify the payer.

Your choices

Browsing ChanFlow — the home page, the sample reading, and these policy pages — does not require an account. Generating your own reading does: it is tied to your account so we can give you your complimentary credits and keep it for you.

If you have an account, your account page has the buttons for both: delete any individual reading, or delete the whole account — which removes your email, saved readings, birth book, profile, avatar file and credits from the live database and cannot be undone. What remains afterwards is exactly what the section above lists: backups until the window ends, what third parties keep under their own policies, payment records kept as the law requires — those are detached from the deleted account and no longer point to you — and the one-way hash of your email that remembers how many complimentary credits were used.

The same page has “Export all my data”, which downloads everything we hold about you as a single self-contained file. If either button fails, write to thechanflow@gmail.com.

Cookies

We use cookies only to make the site work: one that remembers you have a valid invite during the private preview; one that keeps you signed in, if you sign in; and — if you arrived through someone’s invite link — one that holds that eight-character invite code for up to 30 days, until it has been recorded on your account; and — if you came through one of our links or another website — one that holds where you came from, as described above, for up to 30 days, until it has been recorded on your account.

Your browser also keeps two small things on your device, which never leave it on their own: your language choice, and — when you go from the free type page to the full report — the birth details you just entered, held for that browser tab only so you do not have to type them again, and cleared once the report starts.

We do not use advertising or cross-site tracking cookies.

Children

ChanFlow is not for anyone under 18, and we do not knowingly collect their information. If you believe a child has given us data, write to thechanflow@gmail.com and we will delete it.

Changes and contact

If this policy changes, the date at the top of the page changes with it.

Privacy questions and requests: thechanflow@gmail.com