What we store. We store your account details (name, email and a securely hashed password), the birth details and family relationships you enter, saved readings and palm photos you choose to save, and ordinary Oracle conversations as described below.
Ordinary chat retention and review. An ordinary Oracle conversation remains visible in the app for up to 30 days after its last activity. A full quality-assurance copy may be available to the operator for up to 60 more days, then it is deleted. If you clear a conversation yourself, its quality-assurance copy may remain for up to 60 days. The operator may review these ordinary conversations to maintain quality, investigate problems and improve the service.
Private safety and optional wellbeing turns. Questions recognized by our private clinical, crisis or optional symbolic-wellbeing safety lane are not saved in chat history, the quality-review archive, calibration, feedback queues or raw-question audits. They are removed from old history when recognized. These lanes return fixed or server-computed safety-limited text and do not send the question or chart to an AI model provider. Recognition is a safety control, not a medical service; do not use the Oracle for emergencies.
How ordinary AI processing works. Ordinary Oracle questions, together with the chart context needed to answer them, may be sent to an AI model provider acting as a service processor. We do not sell personal data. We disclose it only to service providers needed to operate the product, when legally required, or when you direct us to do so.
Optional symbolic-wellbeing consent. This feature is off by default. Availability requires a global enable, account eligibility, a verified adult account owner, and separate versioned consent tied to that person’s saved profile. It does not diagnose, identify a weak organ, assess risk or severity, predict recovery, recommend treatment, or select medical or surgery dates. You can withdraw this consent at any time from Privacy & account, including after paid access expires.
Other operational use. Your saved data is used to compute your requested readings. Changes to saved people and unusual account activity may be logged to prevent misuse.
Service capacity. While the signed-in app is visible, it sends a minimal heartbeat so we can count how many people are online and keep the service responsive. Short-lived AI request markers measure how many answers are being generated at once. These records contain no question, answer, chart, location, IP address or device fingerprint; individual markers expire within minutes and historical capacity records contain counts only.
Access. Your access runs on time-limited codes. When a code expires the app locks until a new code is entered; your data is kept while your account exists.
Your controls. You can withdraw optional symbolic-wellbeing consent without deleting your account. You can also delete your account and the personal data linked to it in the live primary and standby application stores yourself from Privacy & account. If the app is inaccessible, contact the operator for help exercising either control.
Deletion and retention limits. Account deletion is applied synchronously to the live application stores and protected by an erasure marker so deleted rows are not restored from a standby copy or backup. Short-lived abuse-prevention records based only on an IP address expire automatically, normally within 5 to 60 minutes, and cannot reliably be connected back to a deleted account. Copies outside the live application stores—such as infrastructure logs, messages already delivered to an operator mailbox, processing records held by service providers, and offline disaster-recovery backups—follow their own security, legal and retention schedules. If a backup is restored, the erasure marker is reapplied before the restored account data may be used.
Guidance only. Readings are cultural and reflective guidance — not medical, legal or financial advice.
Effective date. 14 August 2026.