Privacy

Part one: this website

This site is a handful of static pages. It sets no cookies, runs no analytics, embeds no social widgets, and does not track you between visits. There is nothing to opt out of.

The site is served by Cloudflare, which keeps short-lived request logs including your IP address, the page requested, and your browser's user-agent string. Those logs exist to keep the site up and to block abuse. They are not linked to any person and are not used for marketing.

If you send an email, the message and your address sit in the company's mailbox for as long as the correspondence is useful. Nothing is added to a marketing list without you asking for it.

Part two: Ayana

Ayana has not been released. This section states the rules it is being built under, so that they are on the record before anybody's data is involved. It will be replaced by a specific in-app policy at release.

What it holds

• Your birth date, birth time, and birth place. This is what the reading is calculated from. Without it there is no product.
• A name or nickname, so readings can be told apart.
• An email address, used to sign in and to reach you.
• Readings that have been generated, and anything you have written or saved inside the app.
• Basic technical records needed to run the service and investigate faults.

What it does with it

It calculates your reading, stores it, and shows it to you again when you come back. That is what the data is for and it is not used for anything else.

What it will not do

• Your birth details and your readings are not sold or rented, to anyone, for any price.
• They are not used to target advertising. Ayana does not carry advertising.
• They are not used to train machine-learning models without your separate, specific, and revocable agreement. Silence is not agreement.
• They are not shared with employers, insurers, or anyone making a decision about you.

Readings that involve other people

A shared reading needs birth details for everyone in it, and it says things about them, not only about you. Those people have to agree before a shared reading is made, and any of them can withdraw and have their part removed. Their details are used for that reading and are not folded into a wider profile of them.

Other companies involved

Running the service requires a few suppliers: hosting and content delivery, email delivery, and error reporting. They are used only to run the service, they act on the company's instructions, and they are not permitted to use anything for their own purposes. If a supplier ever needs broader access than that, this page will say so by name before it happens.

How long it is kept

Your account data is kept while your account exists. Delete your account and the birth details and readings are deleted, not merely hidden from you. Backups roll off within thirty days. Anonymous, aggregate counts that cannot be traced back to a person may be kept.

Where it lives

Data is stored on servers operated by the company's suppliers, which may be located outside Canada, including in the United States. That means it can be subject to the laws of those countries. The release policy will name the regions in use.

Children

Ayana is not intended for children under 13, and accounts are not knowingly created for them. If one is discovered it is deleted.

Your rights

Under Canadian privacy law, and under the GDPR if you are in the United Kingdom or the European Economic Area, you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, or withdraw an agreement you previously gave. There is no fee, and you do not have to give a reason.

Write to isaac@lonfeng.com. Requests are answered within thirty days. If the answer is unsatisfactory you can complain to the Office of the Privacy Commissioner of Canada, or to your own national data-protection authority.

Security, and changes to this policy

Data is encrypted in transit and at rest, access is limited to people who need it to do the work, and no method is perfectly secure. If a breach is likely to cause you real harm, you will be told, and so will the regulator.

When this policy changes, the date at the top changes with it. Changes that materially affect existing users will be sent by email rather than quietly posted.