⚖️ Privacy

Privacy Policy

Last updated: May 31, 2026

At Chimystic, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services. By using Chimystic, you agree to the practices described in this policy.

1Information We Collect

Account Information: When you sign in, we collect your email address via our authentication provider (Supabase Auth).
Birth Data: The birth date, time, and location you voluntarily provide for Bazi readings. This data is stored securely and used only to generate your fortune readings.
Reading History: Your past reading results and lot draws are saved to provide you with a consistent cross-device experience when signed in.
Usage Data: We may collect anonymous usage statistics (page views, feature interactions) to improve our service.

2How We Use Your Information

To generate your personalized Bazi (八字) readings and daily fortune predictions
To save your reading history and allow you to access it across devices
To send you a one-time magic link for passwordless authentication
To respond to your inquiries sent via email
To improve our services based on aggregate usage patterns

3Data Storage & Security

Your data is stored securely using Supabase, a SOC 2 compliant database platform built on PostgreSQL. Supabase provides encrypted data storage (at rest and in transit), automated backups, and strict access controls.

We implement Row Level Security (RLS) policies to ensure that your data can only be accessed by you when authenticated. Our servers never have direct access to your raw password, as we use Supabase Auth's passwordless magic link flow.

4Cookies & Local Storage

We use essential cookies and browser local storage for:

Authentication session management (via Supabase Auth cookies)
Remembering your daily lot draw status (localStorage)
Site preferences and UI state

We do not use third-party tracking cookies, advertising cookies, or social media pixels at this time. If we add analytics in the future, you will be notified.

5Email Communications

We use Resend as our email delivery service. When you request a magic link to sign in, we send an email via Resend containing your authentication link. Resend processes your email address solely for the purpose of delivering this email and does not store or use it for any other purpose.

We do not send marketing emails, newsletters, or promotional communications.

6Third-Party Services

Chimystic uses the following third-party services:

Supabase — Authentication, database, and file storage
Resend — Email delivery for magic link authentication
Vercel — Web hosting and deployment
Google AdSense — Advertising (if and when enabled)

Each service provider has their own privacy policy governing the handling of data. We select providers that maintain industry-standard security practices.

7Your Rights (GDPR & CCPA)

If you are a resident of the European Economic Area (EEA), United Kingdom, or California, you have the following rights regarding your personal data:

Right to Access: Request a copy of the personal data we hold about you
Right to Rectification: Correct any inaccurate or incomplete data
Right to Erasure: Request deletion of your data (subject to legal retention requirements)
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Withdraw Consent: Withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at hello@chimystic.com. We will respond within 30 days.

8Data Retention

We retain your personal data for as long as your account is active. If you delete your account or request erasure, your data will be permanently removed from our systems within 30 days, except where retention is required by applicable law.

Anonymous usage data (not linked to your identity) may be retained indefinitely for analytical purposes.

9Children's Privacy

Chimystic is not intended for children under the age of 16. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal data, we will delete it promptly.

10Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

Questions?

If you have any questions about this Privacy Policy or how your data is handled, please contact us.