Privacy Policy

Account: email address, password hash (we never store plain-text passwords), display name, avatar URL, bio; if you sign in with Google, we also receive your email, name, and avatar from Google.

Usage content: product descriptions, stage, evidence links/images, interview Q&A, destiny graphs and other inputs you submit to drive a simulation; the QuickSim / Deep Sim actions you take and their counts.

Billing: subscription and one-time purchase records, billing periods, Stripe customer ID. Card numbers or Alipay credentials are processed by Stripe / Alipay and never reach our servers.

Technical & log data: timestamp, IP address, browser/device fingerprint, referrer, HTTP status, and similar server-generated logs.

Cookies: a session cookie that keeps you signed in (default 30 days) and necessary preference cookies. We do not run third-party advertising cookies.

To deliver the Service: authentication, simulation generation, destiny analysis, subscription and trial-pack billing, and other core features.

Quota enforcement: to compute and apply QuickSim / Deep Sim quotas based on your plan and trial-pack credits.

Security & anti-abuse: to detect suspicious logins, rate-limit, prevent enumeration, and investigate violations.

Service communications: to send sign-in links, password resets, account security notices, and essential product updates.

Product improvement: to analyse aggregated usage internally and to diagnose and fix issues.

Stripe — international card payments and subscription management. Stripe processes payment data under its own privacy policy.

Alipay — where configured for China-region users, processes CNY payment data converted from USD pricing.

Google — when you use Google sign-in, Google provides us your basic profile (email, name, avatar).

Resend / GoDaddy SMTP — we use one of these to send transactional email (password reset, welcome, etc.).

Volcengine / Doubao and other model providers — content you submit (product descriptions and evidence) is sent to these LLM / image providers to generate simulation results. Please avoid pasting sensitive personal information or trade secrets.

The Service runs on cloud servers leased by the operator. Simulation content and account data live in a local database (SQLite) and object storage on those servers.

If you access the Service from outside mainland China, related data may be transferred to and processed in the countries where the above processors operate, in accordance with their local laws.

Account data is kept for as long as your account exists. Password reset tokens expire after 30 minutes or single use; session cookies default to 30 days.

When you delete your account, we will delete or anonymise the personally identifiable data linked to it within a reasonable period, except for minimum records we must keep for audit, legal, or anti-fraud purposes.

You can view and edit your profile from the Account page, reset your password via "Forgot password", and manage subscription/invoices through the Stripe customer portal.

You may request export, correction, or deletion of your personal data, and may withdraw any prior consent. Where applicable, you have additional rights under GDPR, China's PIPL, CCPA / CPRA, and similar local laws.

To exercise these rights, contact us at the address below. We will respond within a reasonable period (normally no more than 30 days).

The Service is intended for users aged 13 or older and is not directed to children. If you believe a minor has provided us personal information without parental consent, please contact us so we can delete it.

We use password hashing (no plain text), TLS in transit, signed sessions, least-privilege access, and operational logs to protect your data. No system can guarantee absolute security; please keep your credentials safe.

We may update this Policy from time to time. Material changes will be announced in-product or by email; continued use after the update means you accept the new version. The effective date below is updated whenever the Policy changes.