Privacy Policy

Personal information you provide to us. We collect personal information that you voluntarily provide when you use our Services or contact us. This may include:

• Email address — collected only when you make a purchase, via Stripe's checkout process. Used for sending access codes, gift notifications, and transactional communications. Free users are not required to provide any personal information.
• First name (optional) — provided only when sending a gift reading to a friend. Used solely to personalize the gift email and not stored by us.
• Questions submitted for readings — sent to our AI service provider (OpenAI) for interpretation. Not permanently stored or linked to your identity.
• Contact form messages — your email and message when you reach out to us.

Payment data. We do not collect or store your credit card numbers, billing addresses, or other financial information. All payment data is handled exclusively by Stripe, our payment processor.

Information automatically collected. When you visit our Services, we automatically collect certain technical information that does not reveal your specific identity:

• IP address — used solely for rate limiting to protect our Services from abuse. Not stored long-term or used for tracking.
• Log data — standard server logs including browser type and request timestamps, maintained by our hosting provider (Vercel) for operational purposes.

Sensitive information. We do not process sensitive personal information.

We process your personal information for the following purposes:

• To deliver our Services — providing I Ching readings and AI-powered interpretations.
• To fulfill and manage orders — processing payments via Stripe and delivering reading credits.
• To send administrative information — access codes, purchase confirmations, gift notifications, and delivery failure notices.
• To respond to inquiries — replying to messages submitted through our contact form.
• To protect our Services — rate limiting and fraud prevention using IP addresses.
• To comply with legal obligations — maintaining records as required by tax and financial regulations.

We only process your personal information when we have a valid legal reason to do so. Depending on your location, this may include:

• Consent — you have given us permission to use your information for a specific purpose.
• Contractual necessity — processing is needed to fulfill services you have purchased.
• Legal obligations — we are required to process your information to comply with applicable laws.
• Legitimate interests — processing is necessary for our legitimate business interests (such as security and fraud prevention), provided those interests are not overridden by your rights.

If you are located in Canada, we may process your information based on express or implied consent. You can withdraw your consent at any time by contacting us at hello@6tosses.com.

We share your data only with third-party service providers who perform services on our behalf. These providers are contractually obligated to protect your information and may only use it as we instruct.

• Stripe — payment processing. Receives your payment details directly; we never see or store them.
• OpenAI — AI interpretation. Receives your reading questions to generate responses.
• Resend — email delivery. Receives email addresses to send transactional emails on our behalf.
• Upstash — data storage. Stores account records (email, credits, access codes) in a secure Redis database.
• Vercel — web hosting. Hosts our website and serverless functions.

We do not sell or share your personal information for advertising, marketing, or any other commercial purpose. We may share information in connection with a business transfer such as a merger or acquisition.

We do not use cookies. We do not use any tracking, advertising, analytics, social media, or third-party cookies. We do not use web beacons, pixels, or fingerprinting.

We use your browser’s local storage (a feature built into your browser) to keep certain information on your device so the Services work across visits. This data lives only in the browser you are using and is never transmitted to or stored on our servers:

• liuyao_token — an anonymous identifier generated in your browser, used to track free reading usage on this device. Does not contain personal information.
• liuyao_access_code — the access code for any reading credits you have purchased, so you do not have to re-enter it every visit.
• liuyao_reading_history — your past readings on this device, including the question you asked, the hexagram cast, and the AI-generated interpretation. This powers the “Your Personal Readings” archive. Because there are no accounts, this history is stored only in this browser. If you clear your browser data, switch browsers, or use another device, those readings will not appear.

You can clear any of this data at any time from your browser settings. Clearing it will remove your reading history and may require you to re-enter your access code.

Yes. We use OpenAI's API to generate I Ching reading interpretations. When you request a reading, your question and hexagram data are sent to OpenAI for processing. OpenAI's API data usage policy applies to this processing.

We do not use AI for profiling, automated decision-making, or any purpose beyond generating reading interpretations.

• Account data (email, credits, access code) — retained as long as your reading credits remain active. Credits do not expire.
• Rate limiting data (IP-based counters) — automatically deleted within 1 hour.
• Magic link tokens — automatically deleted after 24 hours or upon first use.
• First names in gift emails — not stored; used only in transit.
• Reading questions and interpretations — not stored on our servers. Your question is sent to OpenAI at the time of the reading and is not retained by us. A copy of your question, hexagram, and interpretation is saved in your own browser’s local storage so you can revisit your past readings; this data lives only on your device, not on our servers, and is removed when you clear your browser data.

We implement appropriate technical and organizational security measures, including rate limiting, Stripe webhook signature verification, and cryptographically generated access codes. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

We do not knowingly collect data from or market to children under 18 years of age. By using our Services, you represent that you are at least 18 years old. If we learn that we have collected personal information from a user under 18, we will take reasonable measures to promptly delete such data. If you become aware of any such data, please contact us at hello@6tosses.com.

Depending on your location, you may have the following rights regarding your personal information:

• The right to access the personal information we hold about you
• The right to request correction of inaccurate information
• The right to request deletion of your information
• The right to withdraw consent to processing
• The right to data portability
• The right to object to processing

To exercise any of these rights, please contact us at hello@6tosses.com or visit our contact page.

Browser local storage: You can clear local storage at any time from your browser settings. Doing so will remove your reading history and any saved access code, and you may need to re-enter your access code to continue using purchased credits.

We do not use any tracking technologies that would respond to Do-Not-Track signals. Since we do not track users for advertising or analytics purposes, DNT settings do not affect our Services.

If you are a resident of a US state with applicable privacy legislation (including California, Colorado, Connecticut, Virginia, and others), you may have additional rights such as:

• Right to know whether we are processing your personal data
• Right to access, correct, or delete your personal data
• Right to opt out of the sale or sharing of personal data
• Right to non-discrimination for exercising your privacy rights

We have not sold or shared any personal information to third parties for business or commercial purposes in the preceding twelve months.

Categories of personal information collected in the past 12 months:

• Identifiers — email addresses (YES)
• California Customer Records — first name, optional (YES, not retained)
• Commercial information — purchase history, credits (YES)
• Internet activity — NO
• Geolocation data — NO
• Biometric information — NO
• Sensitive personal information — NO

To exercise your rights or appeal a decision, contact us at hello@6tosses.com.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date. If we make material changes, we may notify you by prominently posting a notice on our website. We encourage you to review this notice periodically.

If you have questions or comments about this notice, you may email us at hello@6tosses.com or use our contact form.

Depending on the applicable laws of your country or state of residence, you may have the right to request access to, correction of, or deletion of the personal information we hold about you. To make such a request, please contact us at hello@6tosses.com or visit our contact page.