Privacy Policy

Privacy Policy

Effective 2026-10-23

This is a draft that will be finalised after legal review before launch. Items marked [to be filled] will carry the operator's details.

[to be filled: operator] (the "Company") operates LUMYRA and handles your personal data as described below. Because saju readings use potentially sensitive data such as your birth date and time, we state exactly what we do with it.

1. What we collect and why

  • Account: email, display name, password (stored as an Argon2id hash, never in plain text) or your Kakao/Google account identifier and email — sign-up, login, notification emails
  • Reading input: name (optional), gender, birth date, birth time (may be unknown), birthplace, lunar-calendar flag, your question (optional), an email for the completion notice (optional) — chart computation and reading generation. Stored encrypted with AES-256-GCM
  • Reading output: the computed chart, the AI-written text and your reading progress — re-reading from your library
  • Support inquiries: reply email and message (stored encrypted) — answering you
  • Automatically: IP address (only a hash is kept for rate limiting), browser type, access time, error logs — security and incident response. No advertising identifiers or third-party tracking cookies

2. Retention

  • Account data and readings: deleted when you delete your account. You will also be able to delete individual readings.
  • Support inquiries: 1 year after they are answered
  • Access logs: 3 months
  • E-commerce records (payments and refunds, after launch): 5 years as required by Korean law

3. Overseas transfer — the AI provider

Reading text is generated through the API of Anthropic, PBC in the United States. For that, the data below is sent to the US. See the overseas transfer notice for details; we ask for separate consent when you request a reading.

  • Sent: the computed chart (stems, branches, elements, ten gods and so on), gender, a table of ages by year, your question
  • Not sent: name, birth date, birth time, birthplace, email. Your name is inserted on our servers after the text comes back
  • Retention: Anthropic does not use API inputs to train its models and deletes them after its operational retention period (per the provider's policy)

4. Processors

  • Hosting and database: Amazon Web Services (Seoul region planned)
  • Email delivery: Amazon SES (verification, password reset, completion notice, inquiry receipts)
  • Social login: Kakao and Google (their privacy policies also apply)

5. Your rights

You can access and correct your data and delete your account at any time from My Page or through the contact page. Requests are handled within 10 days. We do not collect data from children under 14.

6. Security measures

  • Birth details, questions and inquiries are stored only as ciphertext; the key lives in a server-side secrets manager
  • Login sessions use opaque tokens in HttpOnly cookies; the raw token is never stored
  • Logs never contain birth details, session tokens or raw AI prompts
  • All traffic is encrypted with HTTPS

7. Cookies

We use only a session cookie to keep you logged in and browser storage for reading preferences (font size, reduced motion). No third-party advertising or analytics cookies.

8. Data protection officer

[to be filled: name, title, email, phone]. Privacy questions and complaints can also be sent through the contact page.

9. Changes

Changes are announced on the Service at least 7 days before they take effect. If the data we collect or transfer overseas changes, we ask for your consent again.