Privacy Policy
Version 2.0 · Effective 24 October 2026 · Data controller: Daosophy, People's Republic of China
1. Scope
This policy applies to the Daosophy mobile application (iOS and Android), this website, and related services. Daosophy provides entertainment-oriented metaphysics content: BaZi, Zi Wei Dou Shu, astrology, tarot, Feng Shui, palm and face readings, naming, dream interpretation, daily fortune, an AI interpretation assistant, and community features (available only when enabled — disabled at launch).
We do not sell personal information, and we do not use it for cross-app advertising or tracking.
2. Data we collect
2.1 Data you provide
| Data | When | Purpose |
|---|---|---|
| Email address | Registration, sign-in, password reset | Account identity, service emails |
| Password | Registration, sign-in | Authentication (stored as a BCrypt hash; never plain text) |
| Username / nickname | Registration or profile edit | Display in app and community |
| Birth date, time, timezone, gender, city | When you request a chart | Computing charts and readings |
| Palm or face photos | Palm/face reading | Generating the analysis for that request |
| Text prompts, questions, posts | AI readings, tarot, dream, community | Producing the requested content |
| Support messages | When you contact us | Responding to you |
2.2 Data generated when you use the service
- Reading history — so you can revisit past charts and interpretations. For signed-in users this is stored on our servers and may include the input (e.g. birth details) and the generated result.
- AI chat history — for conversation continuity and counting the free daily allowance.
- Favourites and saved charts — stored on our servers.
- Local birth profiles — if you save a name/birth profile for quick form filling, it is stored only in your device's local storage and can be cleared from the form; it is never uploaded.
- Membership and subscription records — plan, channel, start and expiry, and the platform transaction identifier.
- Payment verification data — store receipt or purchase token. We never receive or store card numbers.
- Community content and reports — posts, comments, likes and reports.
2.3 Technical data
IP address, request time, endpoint, response code, user agent, device model, OS and app version, and language — used for security, abuse prevention, troubleshooting and compatibility. Server logs are retained for up to 90 days.
We do not collect: precise GPS location, contacts, calendar, SMS, call logs, health or biometric identifiers, advertising IDs for tracking, or voice recordings (the app has no voice feature).
2.4 Photos (palm and face)
Photos you select are uploaded only to produce the requested analysis. They are processed in memory, used to compute a non-reversible hash for caching the result, and are not written to disk or retained after the response. We do not perform biometric identification and do not use these images to train models.
3. How we use data (and legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and secure your account, authenticate you | Performance of a contract |
| Generate charts, readings and AI interpretations you request | Performance of a contract |
| Provide community features and moderation (when enabled) | Contract; legitimate interests (safety) |
| Process subscriptions and restore purchases | Performance of a contract |
| Prevent fraud, abuse and attacks | Legitimate interests |
| Diagnose crashes and improve reliability | Legitimate interests |
| Send service emails (password reset, security notices) | Performance of a contract |
| Comply with legal obligations | Legal obligation |
| Optional marketing emails, if ever offered | Consent (opt out anytime) |
We do not use your data for automated decision-making that produces legal or similarly significant effects.
4. AI processing
Interpretations are generated by a self-hosted large language model (Gemma 2B) running on our own servers behind our API. Your prompt and relevant context (such as chart data) are sent from the app to our backend and then to our AI service to produce the response. We do not send your data to third-party AI providers for training. Generated content can be inaccurate; see the Disclaimer.
On supported devices you can enable optional on-device AI in Settings. It uses the model provided by your operating system (for example Gemini Nano on Android, Apple Foundation Models on iOS/macOS, or Windows AI Foundry on Copilot+ PCs) and runs locally: when successful, your prompt is not sent to our servers. If unavailable, the app falls back to the server path above. You can turn it off at any time.
Face and palm photos are processed entirely on your device. The photo is never uploaded to our servers and is not saved to your gallery or app storage; the temporary picker file is deleted after reading, and only derived measurements/readings remain in memory while the result is shown.
If community features are enabled, content submitted to public community areas is visible to other users. Do not post sensitive personal information there.
5. Sharing and processors
| Recipient | Purpose | Data |
|---|---|---|
| Apple Inc. | App Store distribution and in-app purchases | Purchase data handled by Apple; we receive verification data |
| Google LLC | Google Play distribution and in-app purchases | Purchase data handled by Google; we receive purchase tokens |
| Paddle / PayPal (only if web/desktop payments are enabled) | Web payment processing | Payment and tax data handled by them |
| Cloud hosting, CDN and email providers | Running servers, storage, backups, TLS, service email | Data stored or transmitted as described above |
We may disclose data if required by law, to protect rights and safety, or in connection with a merger or acquisition (with notice). We do not sell personal information or share it for cross-context behavioural advertising.
6. International transfers
Our servers and providers may process data outside your country. Where required (for example in the EEA or UK), we rely on appropriate safeguards such as Standard Contractual Clauses and limit transfers to what is necessary to provide the service.
7. Security
- TLS/HTTPS for all app-to-server traffic, with HSTS at the edge;
- Passwords stored as BCrypt hashes; JWT-based sessions with expiry;
- Access limited to authorized personnel, with administrative actions logged;
- Payment card data never touches our systems;
- Least-privilege database accounts in production and regular dependency review.
No method of transmission or storage is 100% secure. If a breach affecting your rights occurs, we will notify you and regulators as required by law.
8. Retention
| Data | Retention |
|---|---|
| Account (email, username, password hash, profile) | Until you delete your account |
| Reading history, chat history, favourites | Until you delete the item or your account |
| Subscription and payment records | As needed for entitlement, accounting, tax and disputes (typically up to 3 years) |
| Community posts and comments | Until deleted by you or removed by moderation; may remain in backups for a limited period |
| Server logs | Up to 90 days |
| Deleted accounts | Marked deleted immediately; personal data purged within 30 days (backups within a further 30 days) |
9. Your rights
Depending on your location (GDPR/UK GDPR, CCPA/CPRA and others), you may have the right to access, correct, delete, export, restrict or object to processing, withdraw consent, and lodge a complaint with your local supervisory authority.
| Right | How to exercise it |
|---|---|
| Access / correct | In-app profile, or email privacy@daosophy.com |
| Delete account and associated data | In app: Profile → Delete Account (immediate soft delete; purge within 30 days), or email us |
| Export a copy of your data | Email privacy@daosophy.com; we respond within 30 days |
| Object / restrict | Email privacy@daosophy.com |
| Complaint | Your local data protection authority |
We do not discriminate against you for exercising your rights. We may need to verify your identity before acting on a request.
California residents: we do not "sell" or "share" personal information as defined by the CCPA/CPRA, and we do not use sensitive personal information beyond providing the service.
10. Children
Daosophy is not directed to children under 13 (or under 16 in EEA countries where the digital age of consent is 16). We do not knowingly collect data from children below these ages. If you believe a child has provided data, contact us and we will delete it.
11. Disclaimer
All content is provided for entertainment and self-reflection only. It is not medical, legal, financial, psychological or religious advice, and it is not a prediction of future events. Palm and face readings are symbolic and do not perform biometric identification. Read the full Terms of Service for details.
12. Changes to this policy
We may update this policy. For material changes we will notify you in the app and/or by email before they take effect, and we will update the version and effective date above. Continued use after the effective date means you accept the updated policy.
13. Contact
- General support: support@daosophy.com
- Privacy and data protection: privacy@daosophy.com
- Legal: legal@daosophy.com
Daosophy · Privacy Policy v2.0 · Effective 24 October 2026