Privacy Policy

1. What we collect

FateSpectrum collects only what the readings need:

• Account: your email address (via magic-link email or Google sign-in; with Google we also store the provider account id).
• Reading inputs (not stored): the birth date, birth time, birthplace, optional gender and optional display name you enter on the reading page. They travel in the page link and are processed in memory to compute your reading — they are never written to our database.
• Birthplace geocoding: the place name you type is sent to a geocoding service to resolve coordinates and timezone.
• Daily-horoscope subscription: your email address, birth date, timezone and interface language — just enough to send your sign's horoscope each morning.
• Payments: order metadata (amount, currency, status, Stripe session/payment ids, a hash of the birth data). We never see or store your card details — they go directly to Stripe.
• Lamp offerings: the lamp type, duration, and the wish text you choose to display publicly.
• Analytics: aggregate page-view counts from Plausible (cookieless), plus anonymized session replays and heatmaps from Microsoft Clarity. Anything typed into an input box is masked before it is recorded, and recordings are never linked to your account.
• Operational logs: standard web-server and job logs (request paths, errors, timings) kept for running and debugging the service — they do not include your reading inputs.

2. How we use it

• To compute and display your readings during your visit, unlock paid sections, and let you log back in.
• To send the emails you ask for: log-in links, confirmation emails and, for daily-horoscope subscribers, the optional morning email built from the birth date and timezone you gave at subscription.
• To process payments through Stripe and keep an order record tied to your account.
• We do not sell your data, and we run no advertising or cross-site tracking.

3. Third parties

• Google — sign-in authentication (OAuth). Google receives the sign-in request from your browser; we receive your verified email and account id.
• Stripe — payment processing. Stripe handles your payment details under its own privacy policy.
• Open-Meteo geocoding — the birthplace text you type is sent there to resolve coordinates and timezone.
• Plausible Analytics — cookieless, privacy-friendly page-view statistics hosted in the EU; no cookies, no cross-site tracking.
• Microsoft Clarity — anonymized session replays and heatmaps. Clarity masks all form input content by default, and recordings are never linked to your account (we never pass your email or account id to Clarity).
• Fly.io — hosting of the application and database (United States region).

4. Storage and security

Data is stored in a PostgreSQL database hosted on Fly.io in the United States. Reading inputs are the exception: they are never stored, so nothing about your reading persists after your visit. Log-in sessions are signed cookies; we never store passwords (sign-in is magic-link or Google only). Payment data lives with Stripe, not with us.

5. Retention and deletion

• Reading inputs are not stored at all — once you leave the page, they are gone from our systems.
• Daily-horoscope subscription data (email, birth date, timezone) is kept until you unsubscribe — every email carries a one-click unsubscribe link.
• Account data is kept while your account exists. You can ask us to delete your account at any time by writing to [email protected]; we will delete it and confirm, except records we must keep for accounting (payment records).

6. Cookies

We set one essential session cookie (to keep you logged in). Plausible is cookieless. Microsoft Clarity sets two first-party analytics cookies — _clck (remembers a pseudonymous visitor id for this site) and _clsk (groups your page views into one visit) — they hold no personal details. There are no advertising or cross-site tracking cookies.

7. Children

FateSpectrum is not directed at children under 16, and we do not knowingly collect their data.

8. Nature of the content

Readings are generated for entertainment and traditional-culture study. Birth data is processed solely to produce this content; it is never used for profiling beyond the readings themselves.

9. Changes and contact

We will post any change to this policy on this page with a new date. Questions or deletion requests: [email protected].