Privacy Policy

1. Data controller and contact

Wang Yufei is the data controller for personal information processed to operate Quick I Ching, except where a third-party provider acts as an independent controller for its own services. Privacy and data-rights requests may be sent to support@quickiching.com.

2. Information we collect

Account and authentication information

• email address, internal user identifier, account status, and account timestamps;
• authentication provider and limited profile information returned when you choose Google sign-in;
• magic-link verification records, session identifiers, and security information needed to sign you in and protect the account.

Quick I Ching does not ask you to create a conventional account password when you use magic links or supported third-party sign-in.

Questions, castings, and readings

• the life area, interpretation goal, question, and context you choose to submit;
• casting method, coin or method steps, line values, hexagrams, changing lines, timestamps, and lifecycle status;
• free previews, paid detailed readings, model and prompt-version metadata, automated validation results, and report status;
• history, deletion, restoration, and account-association records needed to provide the requested features.

Questions may contain sensitive personal context. Submit only information that is necessary for your request, and do not include another person's confidential information without a lawful basis.

Purchases and entitlement information

• product, credit quantity, price, currency, order and transaction identifiers, payment status, timestamps, and credit balance;
• refund, dispute, chargeback, webhook, reconciliation, and fraud-prevention records;
• limited billing information returned by the payment provider, such as country or payment-method type, where available.

Quick I Ching does not receive or store your complete payment-card number, card security code, or full payment credentials. Card and checkout data are processed by Waffo Pancake and its payment partners.

Support and quality-review information

• support emails, feedback, refund requests, transaction references, and correspondence;
• quality-review reasons, supplements, review status, and any replacement credit granted.

Technical, security, and usage information

• IP address, browser and device information, time zone, language, referring page, request timestamps, and application logs;
• session, anti-abuse, rate-limit, integrity, authentication, and fraud-prevention signals;
• Cloudflare Turnstile results and related technical data used to distinguish legitimate requests from automated abuse;
• page and feature usage information when optional analytics has been accepted and the relevant analytics tool is enabled.

3. Why we use information

Legal bases vary by location. Where consent is the basis, you may withdraw it without affecting processing that occurred before withdrawal. We do not use analytics consent as a condition for accessing the core Service.

4. AI-assisted generation

To generate a preview or detailed reading, we may send the question, relevant context, casting result, and structured instructions to AI model infrastructure, including Vercel AI Gateway and configured model providers such as OpenAI. We also process generated text through validation and review steps intended to enforce format, safety, and hexagram-reference rules.

We do not intentionally use your private question content to train our own general-purpose AI models, and we do not authorize service providers to use it for unrelated advertising. AI providers process information under their applicable service and data-protection terms. Avoid submitting government identifiers, financial account credentials, medical records, or other information that is not necessary for a reflective reading.

5. Service providers and disclosures

We disclose information only as reasonably necessary for the Service, for a transaction or request you initiate, to protect rights and security, or to comply with law. Categories of recipients may include:

• Waffo Pancake: Merchant of Record, checkout, payment, tax, receipt, refund, and payment-dispute processing. Waffo Pancake receives payment and billing information directly; full card data is not stored on Quick I Ching servers.
• Vercel: application hosting, deployment, workflow, AI Gateway, and related infrastructure.
• Neon and database infrastructure: managed PostgreSQL storage and database operations.
• Resend: delivery of sign-in links and essential service email.
• Google: Google account authentication when selected by the user, and Google Analytics only under the optional analytics rules below when enabled.
• Microsoft: Microsoft Clarity for consented heatmaps, session recordings, and usability analysis under the optional analytics rules below.
• Cloudflare: DNS, network protection, Turnstile, and abuse-prevention services where configured.
• AI model providers: generation and automated review of requested reading content.
• Professional advisers and authorities: where reasonably necessary for legal, accounting, security, fraud, dispute, or regulatory purposes.

We may also transfer information in connection with a merger, financing, acquisition, sale, or reorganization, subject to appropriate notice and continued protection. We do not disclose your question text to unrelated advertisers.

6. Cookies and optional analytics

Necessary storage and similar technologies support authentication, session continuity, security, fraud prevention, checkout, load balancing, and delivery of features you request. These technologies are required for the relevant function and cannot always be disabled while that function is in use.

Analytics is optional. Google Analytics and Microsoft Clarity load only after the required analytics consent has been obtained under the site's consent controls. Before consent, or after analytics is rejected or withdrawn, the basic implementation does not load either analytics tag for that visitor.

When accepted, Google Analytics measures page and feature usage. Microsoft Clarity may create heatmaps and session recordings to help identify usability problems. Clarity's project is configured not to set cookies by default; the site sends analytics-storage consent only after acceptance, while advertising storage remains denied.

We apply explicit Clarity masking to question context, sign-in and account information, casting results, generated previews and readings, and order status. Masked content is not intended to be uploaded to Clarity. These controls supplement, rather than replace, the rule that private question text, email, reading content, authentication secrets, and payment details must not be sent as analytics events.

Rejecting or withdrawing analytics does not prevent you from casting, signing in, purchasing credits, viewing reports, requesting refunds, exercising privacy rights, or deleting your account. We do not currently use advertising cookies or personalized-advertising profiles.

7. No sale of personal information

We do not sell your personal information. We also do not share personal information for cross-context behavioural advertising as those terms are defined by applicable US state privacy laws. Service-provider processing for hosting, security, payment, authentication, email, requested AI generation, and consented analytics is not a sale by Quick I Ching.

8. International data transfers

Quick I Ching is operated from China and uses providers that may process information in the United States, Singapore, Europe, and other countries. Those countries may have privacy laws different from the laws where you live. Where required, we use provider agreements and other lawful safeguards that may include standard contractual clauses, transfer assessments, contractual confidentiality, security controls, or an applicable adequacy mechanism.

9. Retention, deletion, and anonymisation

We keep information only for as long as reasonably necessary for the purposes described in this Policy, including the following operational periods:

• Anonymous unrevealed casting state: no longer than the applicable completion or reveal window, currently up to 24 hours, after which it expires unless law or security needs require limited records.
• Active account and retained readings: while the account remains active and until you delete the relevant reading or account, subject to operational and legal needs.
• A reading you delete: hidden from normal account access promptly and scheduled for permanent deletion after a recovery window of up to 30 days. Restoration may be available only during that window.
• Account deletion: active sessions and authentication access are removed promptly, the account email is pseudonymised, unused credits are revoked, and associated question, casting, reading, and product-event content is scheduled for deletion or irreversible anonymisation after up to 30 days.
• Payments and compliance: limited order, ledger, refund, dispute, fraud, tax, accounting, and audit records may be retained after account deletion for the period required or reasonably necessary to satisfy legal obligations, prove transactions, prevent abuse, and resolve disputes. Unnecessary question text is not retained in those financial records.
• Security and operational logs: retained for a reasonable period proportionate to incident investigation, integrity, fraud prevention, reliability, and legal needs.
• Analytics: retained according to the configured provider settings and your consent status. We will not state a fixed provider retention period unless that configuration is actually enforced.

Deletion from active systems may not immediately remove encrypted backups. Backup data is isolated from normal use and is deleted or overwritten under the applicable backup lifecycle, unless preservation is legally required.

10. Your privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or a copy of personal information; to withdraw consent; and to appeal or complain to a competent privacy or consumer-protection authority. These rights can be subject to identity verification, legal exceptions, technical limits, and the rights of others.

Account and individual-reading deletion controls may be available directly in the Service. For other requests, email support@quickiching.com from your account address and describe the right you wish to exercise. We will respond within the period required by applicable law and will not discriminate against you for exercising a protected privacy right.

11. Security

We use measures designed to protect information, including HTTPS, access controls, protected production secrets, hashing or pseudonymisation for selected identifiers, encryption for sensitive question content and generation snapshots, integrity checks, rate limits, and audit records. No online system is completely secure. You are responsible for protecting access to your email account, sign-in links, and devices.

12. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from a person under 18. If you believe a minor has provided information, contact support@quickiching.com so that we can investigate and take appropriate deletion steps.

13. Third-party links and independent services

The Service may link to or integrate with third-party services. Their own terms and privacy notices govern information they collect as independent controllers. Review those notices before providing information directly to them.

14. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, data practices, or law. We will update the date above and, for material changes affecting existing users, provide reasonable advance notice through the Service or registered email, normally at least 15 days before the change takes effect unless urgent legal or security action requires a shorter period. Where consent is required for a new purpose, we will request it before that processing.

15. Contact us