Privacy Policy

What we collect

• Account data — your email address and authentication details.
• Profile data you enter — names, relationships, and the birth date, birth time and birth place for yourself and the family members you choose to add.
• Usage data — analytics about how the Service is used, to help us improve it and to measure our advertising. This includes pages visited and actions taken, but never the contents of a reading.
• Purchase data — records of plans and orders. Card payments are handled by Stripe; we never receive or store your full card number.

Birth time is never displayed

Birth time is used only to compute your charts (for example, the BaZi hour pillar). It is stored so your readings stay consistent, but it is never displayed anywhere in the Service. If you don’t know a birth time, you can leave it blank and calculations degrade gracefully.

How we use your data

We use your data to provide the Service: to compute and personalise your almanac and readings, to save your readings so you can view them again, to process purchases, and to respond to your messages. Most almanac and chart calculations run on your own device. Some readings use a third-party AI provider to compose narrative text from the facts our engines compute; we send only the information needed to generate your reading.

We do not sell your data

We do not sell or rent your personal data. We share data only with the service providers needed to run Xuan Lab — for example our hosting and database provider (Supabase), our payment provider (Stripe), our analytics provider (Google Analytics) and our advertising provider (Meta) — and only as needed to provide the Service or as required by law.

Storage and security

Data is stored with our infrastructure providers using industry-standard protections, and access is restricted. No system is perfectly secure, but we take reasonable steps to protect your information and limit what we collect in the first place.

Encryption of birth time. Birth time is the most sensitive detail you give us, so we encrypt it at the field level (AES-256-GCM) before it is stored. The encryption key lives in our application environment and is never held by our database provider — so our database provider stores your birth time only as unreadable ciphertext. Our own servers decrypt it solely to compute your charts, and it is never displayed anywhere in the Service, including back to you. Your birth date and birth place are not field-encrypted; they are protected by our providers’ encryption at rest and by access rules that restrict every record to the account that created it.

Cookies and analytics

We use a small number of cookies needed to keep you signed in and to remember preferences such as your language, plus analytics to understand overall usage.

We also use the Meta pixel. It tells Meta which pages of Xuan Lab you visited and whether you started or completed a reading, so we can measure our advertising and show ads to people who have visited us before. The pixel never receives your name, your birth date, your birth time, or the contents of any reading — it receives page visits and anonymous event names only. We do not use your readings for advertising.

You can opt out of interest-based advertising in your Meta ad preferences, or by blocking third-party cookies in your browser. Blocking them does not affect any part of the Service.

Your choices and rights

You can view and edit the people and birth details in your account, and you can ask us to delete your account and associated data. To make a request, email info@xuanlab.com and we will action it within a reasonable time.

Children

The Service is not directed to children under 13, and we do not knowingly collect their data. Accounts are intended for adults, or minors under the supervision of a parent or guardian.

Changes and contact

We may update this policy from time to time; the effective date above shows the latest version. Questions or requests? Email info@xuanlab.com.