Privacy Policy

What we collect

• Account data — your email address and authentication details.
• Profile data you enter — names, relationships, and the birth date, birth time and birth place for yourself and the family members you choose to add.
• Usage data — analytics about how the Service is used, to help us improve it and to measure our advertising. This includes pages visited and actions taken, but never the contents of a reading.
• Purchase data — records of plans and orders. Card payments are handled by Stripe; we never receive or store your full card number.

Birth time is never displayed

Birth time is used only to compute your charts (for example, the BaZi hour pillar). It is stored so your readings stay consistent, but it is never displayed anywhere in the Service. If you don’t know a birth time, you can leave it blank and calculations degrade gracefully.

How we use your data

We use your data to provide the Service: to compute and personalise your almanac and readings, to save your readings so you can view them again, to process purchases, and to respond to your messages. Most almanac and chart calculations run on your own device. Some readings use a third-party AI provider to compose narrative text from the facts our engines compute; we send only the information needed to generate your reading.

We do not sell your data

We do not sell or rent your personal data. We share data only with the service providers needed to run Xuan Lab — for example our hosting and database provider (Supabase), our payment provider (Stripe), our analytics provider (Google Analytics) and our advertising provider (Meta) — and only as needed to provide the Service or as required by law.

Storage and security

Data is stored with our infrastructure providers using industry-standard protections, and access is restricted. No system is perfectly secure, but we take reasonable steps to protect your information and limit what we collect in the first place.

Encryption of birth time. Birth time is the most sensitive detail you give us, so we encrypt it at the field level (AES-256-GCM) before it is stored. The encryption key lives in our application environment and is never held by our database provider — so our database provider stores your birth time only as unreadable ciphertext. Our own servers decrypt it solely to compute your charts, and it is never displayed anywhere in the Service, including back to you. Your birth date and birth place are not field-encrypted; they are protected by our providers’ encryption at rest and by access rules that restrict every record to the account that created it.

Cookies and analytics

We use a small number of cookies needed to keep you signed in and to remember preferences such as your language, plus analytics to understand overall usage.

We also use the Meta pixel. It tells Meta which pages of Xuan Lab you visited and whether you started or completed a reading, so we can measure our advertising and show ads to people who have visited us before. The pixel never receives your name, your birth date, your birth time, or the contents of any reading — it receives page visits and anonymous event names only. We do not use your readings for advertising.

You can opt out of interest-based advertising in your Meta ad preferences, or by blocking third-party cookies in your browser. Blocking them does not affect any part of the Service.

Marketing emails (optional)

When you create an account you can tick a box to receive almanac updates and occasional tips by email. The box is unticked unless you tick it, and we record when you gave your consent. We send marketing only to people who opted in, never by SMS or phone call, and every marketing email lets you unsubscribe. You can also withdraw consent at any time by emailing info@xuanlab.com. Saying no never affects your readings or your account.

If you arrive from our free almanac PDF, we note that as the source of your sign-up so we know the almanac is useful. The PDF itself collects nothing.

Your choices and rights

You can view and edit the people and birth details in your account, and you can ask us to delete your account and associated data. To make a request, email info@xuanlab.com and we will action it within a reasonable time.

If you live in Malaysia or Singapore, the Personal Data Protection Acts give you the right to ask what personal data we hold about you, to have it corrected, and to withdraw consent for its use. You can also tell us not to use your data for marketing. Write to info@xuanlab.com and we will respond within 30 days. Our providers may store and process data outside your country; we choose providers that protect it to a comparable standard.

Children

The Service is not directed to children under 13, and we do not knowingly collect their data. Accounts are intended for adults, or minors under the supervision of a parent or guardian.

Changes and contact

We may update this policy from time to time; the effective date above shows the latest version. Questions or requests? Email info@xuanlab.com.