Auspice Privacy Policy

Last updated: September 16, 2026

This policy explains how Auspice (良辰吉日, “the App”) handles information and the choices available to you. No developer account or registration is required, but names, birthdays, notes, and questions you enter can still be personal information. “No account” does not mean “no personal information is processed.” Reading this policy, using the App, purchasing membership, or allowing system network access does not replace the separate, explicit permission required before sending content to third-party AI.

1. Information stored on your device

• Important dates: Names, birthdays or anniversary dates, Gregorian/lunar calendar selection, optional birth hours, relationships, notes, linked contact identifiers, and each entry’s recurrence and reminder settings that you enter or choose to import.
• Collections and divination history: Saved hexagrams or fortune slips, results and timestamps, and question text and full interpretations saved with a history entry. The current history list keeps up to the latest 50 entries; this does not establish an equivalent retention period for cloud copies or third-party services.
• Local settings and operational state: Language, appearance, separate AI permission choices, usage-frequency records, reminder scheduling records, and similar settings.
• Subscription identifier: The App creates a random UUID, stores it in the device Keychain, and uses it as the RevenueCat App User ID. It is not a name, email address, or advertising identifier, but it can be associated with purchase and subscription records. It should not be understood as completely anonymous or unlinkable. It may survive uninstallation; the current implementation does not synchronize it through iCloud Keychain.

Important dates, collections, history, and settings are primarily stored in local UserDefaults. SyncedStore writes synchronized records with update timestamps. The App may preserve local quarantine copies of data it cannot decode to avoid overwriting damaged records. Eligible data also syncs to iCloud as described below, so it is not accurate to say that everything stays only on your device.

2. iCloud synchronization

At launch, the App attempts synchronization using Apple’s iCloud key-value storage (NSUbiquitousKeyValueStore), not a custom private CloudKit record database. Availability depends on your Apple account, system iCloud settings, and service status. There is currently no separate in-app iCloud switch.

The synchronized categories are important dates, hexagram/fortune-slip collections, and divination history, together with update timestamps. This includes names, birthdays, notes, linked contact identifiers, per-entry reminder settings, and questions and interpretations saved in history. Global reminder preferences, device scheduling records, AI permissions, and usage-frequency state are not part of these three synchronized categories.

Apple synchronizes this information across devices associated with your account. It does not pass through our AI proxy server and is not automatically given to an AI provider because of iCloud synchronization. Declining AI permission does not turn off iCloud synchronization. You can manage the available options for the App in your system Apple account/iCloud settings.

Synchronization resolves conflicts using the update time of each whole data category. Network conditions, capacity limits, or simultaneous offline edits on multiple devices may delay synchronization or overwrite changes. It is not a separate backup service. Reinstalling the App may restore earlier data from iCloud.

3. Live AI: recipients, content, and choices

Third-party AI recipients

The third-party AI recipients covered by your permission are DeepSeek / Google Gemini. Online requests pass through our proxy server, https://fortune-api.hezy.tech, to one provider per request, not to both simultaneously. Production currently uses only DeepSeek. Google Gemini is a disclosed possible recipient and does not currently receive the App’s production requests. Earlier permission covering DeepSeek alone does not automatically expand to this recipient set; you must confirm the updated disclosure when next using the relevant online feature. Before adding a recipient outside this set or materially changing a data use that requires permission, we will update the disclosure and obtain separate, explicit permission.

Two independent permissions

When a feature first needs to send content and its permission has not been granted, the App presents a disclosure. These two permissions are stored separately on your device; allowing or withdrawing one does not change the other:

Requests also include task instructions, output-language instructions, model and transport parameters, and an app-level API access credential. That credential is not your RevenueCat user identifier.

“Not automatically attached” does not mean the content is necessarily anonymous. If you type a name, health information, an address, or someone else’s information into a question, those words are sent with the question. Compatibility scores, factors, and date-selection results may be derived from personal inputs or relate to specific people; they may still be personal information even without the original names or birthdays. Avoid identity-document numbers, banking details, and other unnecessary sensitive information, and do not submit someone else’s information without permission.

Allowing, declining, and withdrawing

• “Allow & continue” authorizes only the scope disclosed. The choice is saved locally, so the App may not ask again each time you use that scope.
• “Not now” declines that scope’s live send. Closing the disclosure with “Cancel” grants no permission and does not continue the pending send.
• Open “Privacy & consent” within the relevant questions/readings or compatibility/date AI feature to review the content and recipients for that scope and choose “Withdraw permission.” This control is not in Settings. Opening or reviewing permission management does not send an AI request. Allowing permission there also does not automatically submit a question or calculation result; you must separately choose to use the relevant online feature.
• Withdrawal affects only that scope. It cancels that feature’s in-flight client request and prevents subsequent sends until you explicitly allow it again. Canceling a client request cannot guarantee that our proxy or an AI provider stops processing content it has already received, and cannot retrieve content already sent. Withdrawal does not delete local history, iCloud copies, or data already processed by a service provider.
• System Wi-Fi/cellular access and AI permission are separate. Declining AI does not prevent almanac use, local calculations, or unrelated features. Subscription services and available iCloud synchronization may still use the network.

Free on-device classical hexagram/fortune-slip readings, the almanac, and local calculations remain available after declining or withdrawing AI permission. Pre-generated on-device general readings do not call an online model for that display; readings that require membership do not become free when permission is declined. For members without a question, the App prefers on-device general readings; if local content is unavailable and online generation is needed, the relevant permission is still required. A path with available local content may show a general reading, not a personalized answer generated for your question. Online compatibility/date reports require the relevant permission.

4. Our server and third-party processing

Our proxy processes requests to forward AI content, return results, manage costs, and prevent abuse. It records connection and operational data such as IP addresses, request status, latency, and usage; rate limiting may use IP addresses. Not attaching a user identifier does not mean that network traffic contains no potentially linkable information. The proxy logging currently known to us does not record question text, but that does not establish that content is never stored elsewhere in the processing chain or promise third-party zero retention. Operational logs and aggregate usage are separate data categories from question content.

We do not use App data for advertising, sell personal information, or conduct cross-app/cross-site advertising tracking. The App does not use IDFA and includes no advertising SDK. Our own processing purposes are not a guarantee of a third party’s retention periods or training practices.

DeepSeek, Google, Apple, and RevenueCat process the information they receive under their applicable terms and privacy policies, including processing for service operation, security, and transaction records. We do not promise third-party “zero retention,” “never used for training,” or processing exclusively in a particular country or region. If you do not want these AI recipients to receive the relevant content, do not allow that live AI scope.

The applicable rules for AI services are the developer API terms, not merely the privacy policy for a consumer chat product. Section 3.3 of the DeepSeek Open Platform Terms of Service places responsibility on developers to disclose processing rules, obtain required permission, and respond to end-user rights requests, with technical support from DeepSeek as necessary. Section 5.5 states that its consumer privacy policy does not cover processing rules for end users of developers’ downstream applications. To request access, correction, or deletion of content already sent, contact us using Section 9. We will handle requests under applicable rules and seek provider assistance where needed; we cannot guarantee that received content can immediately be recalled or deleted.

The Google Gemini API terms distinguish paid and unpaid services. Paid-service terms state that prompts and responses are not used to improve Google products and are covered by its data processing addendum, but may still be logged for a limited period for safety or legal purposes. Unpaid services may use inputs and outputs to improve products and explicitly prohibit submitting personal, sensitive, or confidential information. These rules do not mean that every Gemini service offers no retention or no training. The App does not currently send production requests to Gemini.

5. Subscriptions and other communications

Product and membership-status queries may occur at launch or when related screens are used, not only when you tap a purchase button. Membership does not authorize AI content transmission, and withdrawing AI permission does not cancel a subscription. Restoring purchases on another device relies on Apple purchase records, not on assuming that both devices have the same random identifier.

If you email us, we receive your email address and the information you provide to respond and handle your request. When you open an external policy page or choose to share or export content, the relevant browser, website, or recipient also processes the information you choose to provide.

6. Contacts, calendar, alarms, and notifications

Permissions are requested as needed. Declining restricts the corresponding feature, not unrelated local functionality. You can change permissions in system settings.

• Contacts: Birthday import reads names, contact identifiers, and Gregorian/lunar birthdays within the authorized contact scope so you can select entries to import; it does not read only a birthday field. Export updates the birthday of a contact you specify or creates a contact with a name and birthday following your action. The App does not automatically send your entire address book to AI. Imported important-date entries may sync as described in Section 2, and exported contacts may sync through the system’s contact account.
• Calendar: Important-date reminders use EventKit and request full calendar access to create, read back, verify, and repair reminders in the dedicated “良辰吉日 · Auspice” calendar. The App queries calendars and account sources to find a writable destination; reading private event content from other calendars is not a purpose of this feature. Written entries may include names, dates, notes, and reminder information. A calendar hosted in iCloud or another synchronized account may also be synchronized by that account’s provider.
• Alarms: On devices supporting AlarmKit in iOS 26 or later, the App requests alarm permission for eligible same-day reminders. Actual use depends on support, permission, and scheduling results.
• Notifications: Used for local reminders. When the system calendar or alarm cannot handle the relevant reminder, the App attempts local-notification delivery. Reminders may display names, dates, or other entry content; manage lock-screen previews in system settings.

Delivery depends on system permissions, device state, and scheduling capacity and is not guaranteed in every situation. Revoking permission, uninstalling, or deleting an in-app entry should not be treated as proof that every external contact or calendar copy has been removed. Check the corresponding system apps as well.

7. Storage, security, and your choices

AI proxy communication uses HTTPS. Apple and RevenueCat service communications are handled by their respective systems or SDKs. We limit processing to the purposes of providing the features, but no device, network, or synchronization service can be guaranteed completely secure.

• View, correct, and delete: Manage important dates, remove collections, and delete history entries in the App. When synchronization is available, changes participate in subsequent synchronization. Offline devices, conflicts, synchronization delays, and local quarantine copies can affect cleanup; immediate removal from every location is not guaranteed.
• Uninstall: This normally removes data in the App container, but does not guarantee removal of the Keychain identifier, iCloud data, system contacts/calendar entries, or records held by Apple, RevenueCat, or AI providers. Reinstallation may restore synchronized data.
• Cloud and external copies: Manage available options in system Apple account/iCloud settings and manage exported/shared data in Contacts, Calendar, or with its recipient. Disabling synchronization does not delete existing cloud copies. If the system offers no suitable removal option, contact us for assistance.
• Purchases and subscriptions: Manage or cancel subscriptions through the App Store or the “Subscriptions” section of your system Apple account. Deleting the App, its data, or AI permission does not cancel auto-renewal or delete transaction records retained under applicable requirements or service rules.
• Other information requests: Contact us to ask about information we process or request access, correction, deletion, or other applicable rights. We will handle requests according to their scope and applicable rules. Data held only on your device or in your Apple account that we cannot access must be managed using the relevant device or service controls. Do not send unnecessary sensitive information when making a request.

8. Minors

The App is not a service designed specifically for children, but user entries may contain minors’ birthdays or other information. We therefore do not claim never to process children’s information. Minors should use the App with guardian guidance and avoid submitting sensitive personal information. Guardians can contact us with concerns about the handling of such information.

9. Contact and policy updates

For privacy questions or information requests, contact zionhezy@gmail.com.

We may update this policy as features change and will communicate material changes through an in-app notice or release notes. Before adding an AI provider or materially changing an authorized data use, we will disclose the change and obtain separate, explicit permission where required, rather than treating continued use as that permission.