Mystic Codex gives divinatory readings — astrology, BaZi, Zi Wei Dou Shu, tarot, palmistry, face reading and numerology — through the web app and the Android app. This page sets out what we collect, how we use it, who else sees it, how long we keep it, and how to have it deleted.
What we collect
- Account identifiers. Your email address and password. Authentication is handled by Supabase, which stores the password only as a salted one-way hash. We never see it.
- Birth details. Date of birth, time of birth and place of birth, plus gender if you choose to give it. These drive every personalised reading — they are the reason a reading is written for you rather than for your star sign. You can edit or delete them in the app at any time.
- Photographs of palms and faces. Uploaded only when you choose to take or pick a photo for a palm reading, face reading or Photo Compatibility reading.
- Photographs of another person. A compatibility reading may include a second person’s palm or face. By uploading it you confirm you have their permission.
- The readings themselves. The question asked, the reading returned and the time it was generated, so your history is there when you return.
- Diagnostics and request logs. Crash reports and error traces, plus ordinary web server logs. We do not collect precise location, microphone audio, contacts, calendar or SMS, and we do not run advertising trackers inside the app.
How photographs are handled
Photographs are the most sensitive thing you give us, so they are treated differently from everything else:
- They are uploaded over HTTPS into a private storage bucket scoped to your own account. They are never public, and never listed.
- They are read by the reading pipeline through short-lived signed links that expire within a minute. There is no permanent URL to a photograph you have uploaded.
- They are sent to Anthropic’s Claude to be interpreted, and to no one else.
- They are deleted automatically 30 days after upload by a scheduled job. You do not have to ask.
- If a photograph cannot be interpreted, the reading is not charged for and you are told what to retake.
Who else receives your data
We do not sell, rent or trade personal data, and we disclose it outside this list only where legally compelled. To deliver the product we rely on:
- Anthropic — receives the text of your reading request and, for palm, face and compatibility readings, the photographs themselves. Readings are generated by Claude. Anthropic does not use data submitted through its paid API to train its models.
- Supabase — hosts the database, authentication and the private photo storage.
- Vercel — hosts the application and sees ordinary request logs.
- Upstash — caches generated readings so a reading you have already paid for is not generated twice.
- Google Play Billing — processes subscription payments made inside the Android app. Payment details are handled by Google and never reach us.
- Stripe — processes subscription payments made through web checkout. Card details are handled by Stripe and never reach our servers.
- RevenueCat — reconciles subscription status across both payment routes so your access follows your account rather than your device. Receives your account identifier and subscription state, not payment details.
- Sentry — receives crash and error diagnostics. It does not receive your birth details, your photographs or your reading text.
- Mapbox — powers place-of-birth search, and receives only the partial place name you type.
Subscriptions and billing
Mystic Codex Plus can be bought inside the Android app through Google Play Billing, or on the web through card checkout. Whichever route you use, entitlement is recorded against your account, so a subscription bought on one device works on the others. Manage or cancel an Android subscription through Google Play; manage a web subscription from the subscription page in the app.
How long we keep things
- Photographs — deleted automatically 30 days after upload.
- Birth details and readings — kept until you delete them or close your account.
- Your account — kept until you ask us to delete it, then removed within 30 days.
- Billing records — retained by Google and Stripe under their own policies, typically seven years, for tax and chargeback purposes.
Access, export and deletion
You can delete individual readings and your birth details from inside the app whenever you like. To delete your account and everything we hold about you, use the delete option in the app’s account settings, or email support@mystic-codex.com from the address you signed up with. We confirm and complete deletion within 30 days.
If you are in the EEA, the UK, California, Singapore or another place with statutory privacy rights, you may also request a copy of your data, ask us to correct it, and complain to your data-protection authority. The same address handles all of these.
Data held outside your country
Several processors above operate in the United States. Using Mystic Codex means your data is processed there and in the other jurisdictions where those processors run. We rely on Standard Contractual Clauses or the EU–US Data Privacy Framework where they apply.
Children
Mystic Codex is not intended for children under 13, and we do not knowingly collect their information. If you believe we have, write to the address below and we will delete it.
Changes
When disclosed practices change we update the date at the top of this page, and for significant changes we show a notice in the app.
Who we are
Mystic Codex is operated by INFINITY TECH LLP, a limited liability partnership registered in Singapore (UEN T26LL0996E), of 3 Lor 6 Geylang #06-03, Singapore 399165. INFINITY TECH LLP is the data controller for everything described here. Questions and requests: support@mystic-codex.com.