Dasar Privasi

1. What We Collect

Account information: email, password (encrypted), and an optional name when you sign up.

Chart inputs: birth date, time, location, and gender that you submit to generate readings — plus the equivalent information for other people you add for compatibility analyses.

Usage data: sign-in timestamps, reading types, payment records, AI chat transcripts, tarot draw history, and anonymised device/browser metadata (IP addresses are used for abuse prevention and immediately aggregated by region after sign-in).

The Master’s memory: short notes the Master keeps about what you tell it of your own life, so that it remembers you next time and on any device (section 11). It is on by default and you can turn it off at any time.

Notifications: if you turn on notifications in the iOS app, we store the push token Apple issues to your device, linked to your account, only to deliver the notifications you chose. You can set notifications to Off in the app at any time, which stops them.

Payment data: on the website, handled via Stripe. We never store card numbers — only Stripe customer/charge IDs and amounts. When you buy in the iOS app, Apple handles the payment; we receive only Apple’s signed record of the purchase (product, transaction ID, date, price and storefront), never your card or your Apple Account details.

Affiliate program data: if you apply to the affiliate program — your display name, application text, the PayPal email you provide if you choose PayPal payouts, and the version and time of the terms you accepted; if you arrive through a partner’s tracked link — the referral cookie on your device (section 8) and, on sign-up, an attribution record of which partner referred you (section 9).

2. How We Use It

To generate the readings and answers you request — what you enter is used solely to produce the output you see.

For account and billing: identifying you, tracking token balance, processing payments (Stripe on the website, the App Store in the iOS app).

To improve the Service: aggregated usage helps us improve reading quality, fix bugs, and improve the interface.

For security: detecting suspicious sign-ins, API abuse, and policy violations.

3. Who We Share With

Infrastructure providers: Vercel (hosting), Supabase (database + auth), Stripe (payments), Anthropic / OpenAI / DeepSeek (AI inference), Resend (transactional email), and — only if you allow analytics cookies — PostHog (product analytics). They process your data strictly as our processors.

Apple: when you buy in the iOS app, Apple processes the payment under its own terms and privacy policy and sends us a signed record of the purchase so that we can deliver it.

Advertising measurement (only if you allow marketing cookies): Meta Platforms (Facebook / Instagram). With your consent, the Meta Pixel on our pages and our server tell Meta which pages you viewed, whether you signed up or started a checkout, and — when you buy — the amount, together with your email address in hashed form, your browser’s user agent and IP address, and Meta’s own cookie identifiers, so that Meta can measure whether our ads led to the visit or the purchase. For this, Meta is a joint controller with us, and Meta’s own privacy policy governs what it does with the data. Your birth details, charts and readings are never sent to Meta. If your browser sends a Global Privacy Control signal, none of this happens.

Legal compliance: only when bound by a lawful subpoena or equivalent process.

Cross-border transfer: some processors (e.g. AI providers, and Meta) are located outside Singapore (e.g. the United States). When we transfer your personal data abroad we contractually require a comparable standard of protection, as the PDPA requires.

We do not sell your chart data to advertisers or data brokers.

Affiliates (partners in our referral program) see aggregates only — clicks, sign-up and purchaser counts, revenue sums — never the identity, contact details, or purchases of anyone they referred.

4. AI Models & Training

Parts of your readings and answers are written with the help of third-party AI models. We send these services only what is needed to complete your request.

Each provider’s own terms govern how it handles that information. We prefer providers that commit not to train on what is sent through their API.

5. Data Retention

Readings and charts: kept until you delete them. You can delete individual charts at any time from your Library.

Tarot history and AI chat: same retention as the linked chart; deleting a chart removes its associated draws and conversations (but not the notes the Master kept from them — see section 11).

Account metadata (email, sign-in timestamps): retained while your account exists. Account deletion clears this within 30 days unless law requires longer retention.

Affiliate program: click telemetry on referral links is deleted automatically after 13 months; the attribution record (which partner referred you) is kept for the life of your account, with its IP hash cleared after 13 months; an affiliate’s own portal-session address hashes are deleted 13 months after they were last seen. Commission, clawback, and payout records are accounting records that Singapore company and tax law require us to keep for at least five years after the last entry — if an affiliate deletes their account, their profile is anonymised but the ledger and any payout email needed to settle an outstanding balance are retained for that period. The record of each acceptance of the Affiliate Program Terms (the version, a fingerprint of the exact text, the time, the browser information, and the account email at that time) is kept for six years after participation ends — the limitation period for contract claims in Singapore — so that it can establish or defend legal claims, including after the account is deleted.

6. Your Rights

Access: download every record you submitted from the Account page.

Correction: edit your profile and charts on the same page.

Deletion: delete individual charts from your Library. To delete your whole account, request it from Account → Danger Zone (a support-desk ticket) or email sales@splashbros.games; we complete deletion within 30 days and confirm by email, except for records the law requires us to keep (section 5).

Portability: export your data as JSON from Account.

Withdraw consent: you may withdraw consent you previously gave at any time (this may limit some features).

Singapore users: under the Personal Data Protection Act (PDPA) you have rights to access and correct your personal data. EU / UK / California residents additionally have the rights granted under GDPR / CCPA. Email sales@splashbros.games to exercise any of these.

No sale, no sharing without a choice: we do not sell personal information. Advertising measurement with Meta, which happens only with your consent, may count as “sharing” under California law; you can opt out at any time by turning marketing cookies off in Cookie preferences, and we treat your browser’s Global Privacy Control signal as that opt-out.

7. Security

All transport uses TLS 1.2 or above.

Passwords are stored using bcrypt-derived hashing (Supabase Auth); we cannot read them in plain text.

The service key for database access is server-side only, never exposed to the browser. Row Level Security policies confine every authenticated user to their own rows.

Breach notification: in the event of a personal-data breach likely to cause significant harm, we will notify Singapore’s Personal Data Protection Commission (PDPC) and affected users within the timeframe required by the PDPA.

8. Cookies & Local Storage

Necessary cookies / localStorage: keep you signed in (Supabase Auth), remember your language preference (NEXT_LOCALE), cache your most recent reading translation for faster rendering, and record your cookie choice itself (dm-cookie-consent, 1 year).

Marketing cookie (optional): when you arrive through a partner’s tracked link (/r/…) we set a referral cookie (dm_aff, 30 days) on your device. It contains only that link’s public code and an optional campaign tag — no personal information. Its sole purpose is to record, when you sign up, which partner referred you so they can be credited for your purchases in the 12 months after you sign up. If you decline marketing cookies in our consent banner, you are not attributed to any partner; you can also clear the cookie at any time.

Analytics cookies (optional): only if you allow it, we load product analytics (PostHog, proxied through our own domain) to understand page views and feature usage.

Advertising cookies (optional, off by default): only if you allow marketing cookies, we load the Meta Pixel, which sets Meta’s cookies (_fbp, _fbc; up to 90 days) to measure whether our Facebook and Instagram ads brought you here. The pixel does not run on sign-in, share or invite pages. We treat your browser’s Global Privacy Control signal as a “no”. You can change your choice at any time from Account → Cookie preferences.

9. Affiliate & Referral Program

As a referred user: if you arrive through a partner’s link and sign up within 72 hours, we store one attribution record (your account ID, the partner and link IDs, a hash of your IP address at sign-up, and an optional campaign tag). It is used only to calculate that partner’s commission (on purchases in the 12 months after you sign up) and changes nothing you receive: your product, prices, and treatment are exactly the same as every other user’s. The partner never sees your identity or your purchases. The record is kept for the life of your account.

If you join the affiliate waitlist, we keep only when you asked (and asked again), how many times, and the optional note you left; we write to your account email only if there is progress. As an affiliate: you must be 18 or older. We store your display name, application text, channel details, the links you create, the version and time of the Affiliate Program Terms you accepted (also kept as a consent record), and the PayPal email you provide if you choose PayPal payouts. We never store bank details. Program notices by email can be switched off in your portal settings. To meet payment and tax obligations we may ask for identity or tax-residency information, which is used only for that purpose. When you use the affiliate portal we also store a salted hash of your network address and compare it with the sign-up hashes of the users you refer, to detect self-referral through a second account; these hashes are deleted 13 months after they were last seen.

Click telemetry: referral-link clicks are recorded in privacy-reduced form only — a salted hash of the IP address (for de-duplication and fraud detection; it cannot be reversed to the address), a coarse device class, and the referring host — and deleted after 13 months.

10. Children

The Service is intended for users aged 16 and above; the affiliate program is for adults aged 18 and above. We do not knowingly collect information from anyone under 16. If you believe we hold such data, contact sales@splashbros.games and we will delete it.

11. The Master’s Memory

What is kept: when you talk with the Master, it keeps short notes about what you tell it of your own life, so that it remembers you in your next conversation and on any device you sign in on — the website and the iOS app read the same notes. Each note is in your own words (at most 140 characters) and is one of: something you are weighing or planning, a person in your life and how they relate to you, a decision you made, a life event and its date, or how you like your readings written. The AI that writes the notes is told not to keep moods, small talk or what the Master itself said, and a note about your chart itself is refused. Health details, money amounts and other people’s private details are kept only when you explicitly ask the Master to remember them; the AI is what recognises them, so if one is kept that you did not want, forget it (see below).

How notes are made: after each answer, that exchange (with up to three earlier exchanges, for context) is sent to one of the AI providers named in section 3, which picks out what is worth keeping. We may also read your earlier conversations the same way, so that what you told the Master before memory existed is not lost; this skips conversations on charts kept in incognito mode, questions an outside AI assistant asked on your behalf, and everyone who has turned memory off.

How notes are used: the Master reads a short profile built from your notes, your name, your own chart, the charts you keep in your Library and the scene you chose for your daily card, plus the notes that bear on what you just asked. Sensitive notes are never part of that profile. Notes are not shared with affiliates, advertisers or Meta, and are not given to outside AI assistants you connect to your account.

Your choices: you can turn memory off at any time (Account → “What the Master remembers” on the website, You → “The Master remembers” in the app); while it is off, the Master keeps nothing new and uses nothing it already has. You can also untick “Remember this conversation” for a single conversation, undo a note the moment it is saved, edit or forget any note, forget everything at once, and download your profile as a Markdown (.md) file on the website.

Retention: notes are kept until you forget them or delete your account; forgetting a note deletes it at once and for good. Deleting a chart does not delete the notes kept from its conversations — forget those on the same page. At most 200 current notes are kept; once that many are on file, nothing new is kept until you forget some.

12. Updates

This policy may evolve as the Service grows. Material changes are posted here with an updated "Last updated" date; if a change materially restricts your rights, we will email you in advance.