Privacy Policy

1. At a glance

• The free result and today's flow are calculated on your device. If you are not signed in and this browser holds no guest session, your birth details are not sent to our servers for them. If you are signed in, or this browser holds the guest session of a purchase made without signing in, we send them to our server only to check whether you already bought a reading for them; they are compared with your saved profiles and not stored.
• When you look up your birth city, only the city name you type is sent to our server to get the list. Your date and time of birth are not sent.
• We store birth details on our servers only for profiles saved in an account (including the guest account created when you pay without signing in) and for paid readings.
• We do not store the email you enter on the payment page. We store only an HMAC value made from it with a secret key, to find the purchase of a buyer who has lost their session.
• We use no advertising cookies. We use Google Analytics cookies for visit statistics, and you can refuse them.
• Apart from sign-in and email confirmation emails, we send no marketing email or newsletters.
• Deleting your account deletes your birth profiles and readings.

2. Information we process

• Account: email address (not received when you sign in with NAVER), the sign-in method (magic link, Google, Kakao, NAVER or Facebook) and the member identifier that service gives us, screen language, the time you confirmed you are 18 or older. With Kakao, also your nickname and profile picture if you agree (not shown anywhere)
• Guest account (when you pay without signing in): a randomly generated account identifier, when it was created, screen language, the time you confirmed you are 18 or older. No email address. If you add your email with "Keep it with your email" on the "My purchases" page, the address is added and it becomes an ordinary account
• Birth profiles: a label ("me", "mum"…), whether it is your own profile, date and time of birth (solar or lunar, leap month), birth city, sex choice, love-reading perspective, calculation settings, and for other people's profiles the time consent was recorded
• Purchases: product, amount, currency, status, the payment service's order number, an HMAC value made from the email entered on the payment page (the email itself is not stored). We never receive card numbers.
• Readings: the AI-written text, the calculated facts it was written from, model and prompt version, token usage (when the operator turns it on)
• AI writing records (only while the operator has them turned on): the full requests sent to the AI (the calculated saju facts and any past events you chose to send) and the answers it returned while writing a reading. We do not store these by default. When the operator turns them on to check quality and cost, they are kept only for readings written during that time, used only for that check, and deleted after 30 days.
• Compatibility invites: birth details the invited person enters themselves. The person who invited them sees only the compatibility result, never the birth date or chart letters. If the person who invited them buys a Flow Compatibility reading, the flow and indicators calculated from it are used to write that reading.
• A partner you enter yourself: birth details you enter when buying Flow Compatibility, after confirming your partner agreed. Saved to your account as a partner profile with the time of consent, and used to write the reading.
• Support: emails you send to help@sajustation.com (the sending address and the content) and the operator's replies
• Technical: server logs (request ID, path, response status, timing, purchase and reading IDs, and AI token counts), error reports, aggregated visit statistics. Server logs and error reports do not contain birth details, email addresses or reading text.
• The automated-request check when you ask for a sign-in email or start paying without signing in (Cloudflare Turnstile): browser and device information, IP address. We receive only the check's result and do not store it.
• Checkout limit: an HMAC value made from the IP address of the request that opens a payment page. The IP address itself is not stored. It is used only to count how many payment pages one address opens in an hour.
• Visit statistics (Google Analytics): a cookie identifier, the pages you visit (with identifying values removed from the address), events (for example viewing a free result or tapping share), how you arrived, device and browser information, approximate location. See "Cookies and similar technologies" below.
• To decide whether cookie consent is required where you are, we use the country of the request. The country is not stored.

3. Paying without signing in

If you press a buy button without signing in, we first create a guest account with no email address and keep its signed-in state (the guest session) in this browser's sign-in cookie. Birth profiles, the 18+ confirmation, purchases and readings are stored in this account just as in a signed-in account. While the guest session exists, the result page sends your birth details to our server only to check whether you already bought a reading for them; they are compared with this account's profiles and not stored.

We do not store the email address you enter on the payment page (Link). With the purchase, we store only an HMAC value, made with a secret key that only the operator holds. This value cannot be turned back into the email address. We can only check whether an address someone gives us matches it. We use it only to find the purchase of a buyer who has lost their session and tells us the email they paid with. We store the same value for purchases made while signed in, and delete it when you delete your account.

A guest account with no purchase is deleted 7 days after it was created, together with the birth profiles and other data saved in it. Deletion runs once a day; if a payment page was opened from the account in the last day, it waits until the next day. A guest account with a purchase (refunded ones included) is not deleted this way and follows the account rule under "How long we keep it" below.

If you add your email with "Keep it with your email" on the "My purchases" page and press the link in the confirmation email, the account becomes an ordinary account you sign in to with that email, and this policy treats it like any other account.

If this browser's data is cleared or the session is lost before you add an email, the operator cannot tell on its own who you are. Send the payment receipt (the email from Link) or the email address you paid with to help@sajustation.com. The operator checks the purchase by the HMAC value and the payment service's order number, then moves it to an account you sign in to with your email, or refunds it if it has not been opened.

4. Information kept only on your device

The free result's input, the events you add in "Look back on your past", and your theme choice stay in your browser's storage (localStorage, sessionStorage). We never receive them. Clearing the site's data in your browser removes them. One exception: if you tick the box to send your events when buying a Lifetime Reading, only each event's kind and year are sent to our server. Once the payment goes through, they are stored with that purchase and sent to the AI that writes the reading. They are never sent to the payment service. Events whose payment never completes are deleted within 14 days. Deleting your account deletes them.

When you go to sign in, this tab's input is kept in your browser's storage (localStorage) for 15 minutes so the tab the sign-in link opens can carry on. It is removed once that tab takes it, or after 15 minutes.

Your choice in the cookie settings (accept or refuse) is kept in your browser's storage (localStorage). It is not a cookie and is not sent to us.

5. Purposes and legal bases

• Accounts (guest accounts included), birth profiles, today's and this month's flow from your own profile, writing and delivering readings, confirming payments, finding a guest buyer's purchase after they lose their session (the email HMAC value of guest purchases), answering support emails: performance of our contract with you (GDPR Art. 6(1)(b))
• The email HMAC value of purchases made while signed in: our legitimate interest in handling payment disputes and recovering accounts (GDPR Art. 6(1)(f))
• Other people's profiles and an invited person's birth details: consent (GDPR Art. 6(1)(a))
• Security, abuse prevention (the automated-request check, the checkout limit), error tracking, aggregated statistics: our legitimate interest in running the service safely (GDPR Art. 6(1)(f))
• Google Analytics visit statistics: our legitimate interest in improving the service (GDPR Art. 6(1)(f)); for visitors in the EEA, the UK and Switzerland, consent (GDPR Art. 6(1)(a))
• Keeping payment records: legal obligation under tax law (GDPR Art. 6(1)(c))
• Users in Korea: Personal Information Protection Act Art. 15(1)4 (contract) and Art. 15(1)1 (consent); security, abuse prevention (the checkout limit) and visit statistics fall under Art. 15(1)6 (the operator's legitimate interest). You can refuse visit statistics at any time under "Cookie settings" at the bottom of the page.

6. Processors and international transfers

We use the companies below. Some are outside your country (and outside Korea), so your information is transferred abroad. Transfers happen over encrypted connections when you use the service; retention follows "How long we keep it".

These transfers are the outsourced processing and storage needed to perform our contract with you, disclosed in this policy under Art. 28-8(1)3(a) of Korea's Personal Information Protection Act. Each company's privacy contact is listed with it.

• Supabase Inc. (US company): database and sign-in. Data is stored in the Tokyo region, Japan. Transferred: account (guest accounts included), birth profiles, purchases, checkout-limit records (an HMAC value of the IP address), readings, AI writing records (when turned on), past events held until payment, invite details. Privacy contact: privacy@supabase.com
• Vercel Inc. (US): hosting, server functions, visit statistics, AI request routing (AI Gateway). Location: server functions run in the Tokyo region, Japan (hnd1), next to the database; page delivery, visit statistics and AI request routing run in Vercel's regions, including the US. Transferred: request contents, technical information. Privacy contact: privacy@vercel.com
• Stripe and its affiliate Link (US and elsewhere; merchant of record): payment, receipts, tax, refunds and disputes as the seller. Transferred: email, name, billing country and address, phone number if you sign up for Link, payment details, purchase history, and the identifiers that tie a purchase to your account (account and profile IDs and the product). Link's and Stripe's privacy policies also apply. Privacy contact (Link included): dpo@stripe.com
• AI model provider (Anthropic PBC, US, reached through Vercel AI Gateway): writing the text of readings. Transferred: chart facts calculated from the birth details (chart letters, elements, luck pillars and yearly scores), screen language, the profile owner's age if under 18 (for a Flow Compatibility partner, only whether they are under 18), and the kind and year of each past event you chose to send when buying a Lifetime Reading. Never names, emails or free text. Requests ask for zero data retention and no training on the data. Privacy contact: privacy@anthropic.com
• Resend Inc. (US): sign-in and email confirmation emails. Transferred: email address. Privacy contact: support@resend.com
• Google LLC (US): visit statistics (Google Analytics) and the operator's support mailbox (Gmail). Transferred: the visit statistics above, support emails. Set up so that nothing is used for advertising or ad personalisation. Privacy contact: the form at support.google.com/policies?p=privpol_privts
• Cloudflare, Inc. (US): the domain's DNS, forwarding mail sent to help@sajustation.com to the operator's mailbox (Email Routing), and the automated-request check on sign-in email requests and on starting to pay without signing in (Turnstile). Transferred: support emails; browser, device information and IP address during the check. Cloudflare also processes this information for its own purposes, to improve Turnstile's bot detection; Cloudflare's privacy policy applies to that part. Privacy contact: privacyquestions@cloudflare.com
• Functional Software Inc. (Sentry, US): error tracking. Transferred: error details, browser and device information. Request bodies, cookies, email and IP addresses are removed before sending. Privacy contact: compliance@sentry.io

7. KakaoTalk share

On the Korean pages, tapping 'KakaoTalk' loads Kakao Corp.'s (Korea) share feature at that moment. The page address you share (including an invite link), its title and image address, and your browser information and IP address go to Kakao, and Kakao's privacy policy applies from there. We receive nothing from Kakao.

8. If you do not want your information transferred

You can use only the free result, without signing in and without an account or purchase. The free result is calculated on your device, so no birth details are transferred for it. You can also refuse visit statistics in "Cookie settings". Paid readings, accounts and Flow Compatibility invites cannot be provided without the transfers above. Paying without signing in also creates a guest account, so the transfers above happen then as well.

9. How long we keep it

• Account, birth profiles, readings: until you delete your account. Accounts not used for 3 years (no sign-in and no reading opened) are deleted. Accounts with an email get an email 30 days before deletion.
• Birth details entered to answer an invite without signing in: until the person who invited them deletes their account, or sooner on request to help@sajustation.com.
• Guest accounts created by paying without signing in: deleted 7 days after they were created if they hold no purchase. With a purchase (refunded ones included), as for accounts above. A guest account with no email added cannot be told, so it is deleted without notice after 3 years without use.
• The email HMAC value stored with a purchase: as long as that purchase record is kept. Deleted at once if you delete your account.
• The IP address HMAC value used for the checkout limit: deleted at the daily clean-up once a day has passed (at most 2 days).
• Payment records: 5 years (the period for payment records under Korea's Electronic Commerce Act Enforcement Decree, Art. 6). These remain after account deletion for that period.
• Server logs: kept by the hosting provider (Vercel) for up to 1 day, then deleted.
• Error reports: kept by Sentry for up to 30 days, then deleted.
• AI writing records (stored only while turned on): 30 days from writing. Deleted at once if you delete your account.
• AI model provider: not retained after the request (zero data retention)
• Visit statistics (Vercel): only aggregated values that do not identify anyone
• Visit statistics (Google Analytics): the cookies expire after 13 months. Google's records are deleted after 14 months.
• Support emails: kept for 3 years after the matter is closed (the period for dispute-handling records under Korea's Electronic Commerce Act Enforcement Decree, Art. 6), then deleted.

10. Your rights and deletion

• You can delete your account yourself in account settings. A guest account is deleted on the "My purchases" page in the browser where it was created. Birth profiles and readings are deleted at once; copies in backups expire when the backup does.
• You can ask for access, correction, deletion, restriction, objection or a copy of your data (portability) at help@sajustation.com. We respond within 30 days.
• You can withdraw consent; we then delete the profile concerned. If an invited partner withdraws, the person who invited them keeps the text of a reading they have already opened, the results it was written from, and the two people's scores on the invite screen.
• You can complain to a data protection authority: Korea's Personal Information Protection Commission (Personal Information Infringement Report Center, phone 118), Australia's OAIC, or the authority in your EU or UK country.

11. Cookies and similar technologies

Necessary cookies and storage: the cookie that keeps you signed in, and the language cookie (NEXT_LOCALE) that remembers the screen language you chose. The guest session of a purchase made without signing in is kept in the sign-in cookie too. If you block the sign-in cookie, you cannot sign in; if you delete it, a guest purchase with no email added can no longer be opened in this browser. A partner's birth details entered on this device for Flow Compatibility, and the consent given for them, stay in your browser's storage (sessionStorage) and are gone when you close the tab.

Visit statistics cookies: Google Analytics' _ga and _ga_<ID>. They tell a returning visit from a new one and count which pages and features are used, nothing else. They expire after 13 months. Advertising, ad personalisation and Google signals are off, and the cookies are never linked to your account.

What Google never receives: birth details, chart letters, email addresses, or identifying values in addresses, such as invite links and order numbers. Page addresses are sent with these values removed, and of the values after an address only the campaign tags (those starting utm_) are kept. The previous page's address is cut to the site's name (for example naver.com).

How to refuse: choose "Refuse" in "Cookie settings" at the bottom of the site. Visit statistics then stop and the _ga cookies are deleted. You can also block cookies in your browser. The service works the same either way. In the EEA, the UK and Switzerland these cookies are not used until you agree.

Vercel Web Analytics counts page views without cookies. Visitors are told apart by a hash of the request that is discarded after 24 hours. It still counts visits that refused cookies.

12. Children

The service is not directed at people under 18, who cannot create an account or buy. A parent or guardian may create a birth profile for their child; we do not collect the child's contact details.

13. Security

• All traffic is encrypted with HTTPS.
• Row-level security in the database lets each user read only their own data.
• Secret keys are kept only in server environment variables, accessible to the operator alone.
• The operator may open a written reading and its birth details only to check its quality and rewrite it. Every opening is logged.
• Example readings are made only from invented birth details. We do not use any user's birth details or reading as an example.

14. Privacy contact

Privacy officer: the operator of Saju Station, contact: help@sajustation.com

Send questions, requests about your data and complaints to the contact above.

15. Changes to this policy

We post changes on the site 7 days before they take effect (30 days for significant changes).

This policy takes effect on 15 November 2026.