Privacy Policy

1. Data we process

• Session data: an anonymous user ID, login cookies, and the technical information needed to keep a session running.
• Account data: your email and login details, handled by Supabase or a sign-in provider such as Google when you create an account.
• Data you actively enter: your question, birth date/time, gender, and whatever else a given tool needs. A birth-data profile is only saved to your account if you choose to save it.
• Transaction data: credit packages, amounts, order IDs, payment status, and anything you send us to reconcile a transaction.
• Technical data: your IP address, kept briefly to limit abuse; aggregated page-view and usage-event data.

Passwords are handled by our authentication provider — maihoathon never sees your password in plain text.

2. On-device reading history

Your questions, calculated results, and completed conversations are saved in your browser's localStorage so you can reopen your Journal. This data doesn't automatically sync to your account. You can delete individual Journal entries, or clear the site's data in your browser.

Your theme choice and a few onboarding states are also saved on-device so the app remembers your preferences.

3. When you request an AI reading

Your question, along with the hexagram/card/date/chart data a reading needs, is sent through maihoathon's servers to an AI provider to generate a response. The in-progress result is held temporarily in Redis and auto-deletes after roughly an hour.

Don't enter ID numbers, home addresses, bank account details, medical records, or anyone else's private information. The AI provider may process data under its own terms; maihoathon only sends the portion of data your request actually needs.

4. Why we use this data

We process data to provide results, maintain your account and credit balance, process payments, prevent fraud, provide support, fix bugs, and improve the service.

maihoathon does not sell personal data and does not use the content of your questions for ad targeting.

5. Third-party services

Data may be processed by the parties we need to run the service:

• Supabase: authentication, profile preferences, balance, and transaction history.
• payOS and its partner banks: creating, confirming, and reconciling payments.
• The AI provider: generating readings on request.
• Vercel: hosting the website and aggregated usage measurement.
• Our Redis provider: holding AI results temporarily and abuse-prevention counters.

Some providers may process data outside Vietnam, depending on their own infrastructure.

6. How long we keep data

• AI results in Redis: roughly one hour.
• On-device reading history: until you delete it yourself, or your browser clears the site's data.
• Account, profile, and balance: for as long as your account is active, or longer if required by law.
• Orders, transactions, and reconciliation records: for as long as needed for accounting, resolving disputes, and legal obligations.
• Abuse-prevention IP counters: expire automatically at the end of each rate-limit window.

7. Your rights and choices

Within the scope of applicable law, you can request to know, view, correct, restrict the processing of, withdraw consent for, or delete your personal data. Withdrawing consent doesn't invalidate processing that was already carried out lawfully beforehand.

For data in your Journal, you can delete it yourself on your device at any time. For account data, please send a request to [email protected]. We may need to verify you own the account before acting on it.

8. Data security and age limits

We apply access controls, data segregation, and encrypted connections appropriate to the scale of this service. That said, no online system is ever completely secure.

Anyone under 16 should only use this service with a parent or guardian's consent and supervision. Please don't submit a child's sensitive data to maihoathon.

9. Changes and contact

This policy may be updated as features or regulations change. The most recent update date is always shown at the top of this page.

If you have a question or a request about your personal data, contact [email protected].