Privacy Policy

This Privacy Policy explains what Star Mirror collects, how it is used, and the choices you have. We treat birth information as sensitive data and design the product to keep as little of it as possible.

1. What we collect

• Birth information (date, approximate time if provided, birth location, and optional gender) — sensitive data you enter to generate a reading.
• Email address — if you choose to receive a result link or create an account.
• Guest browser identifier — a random cookie that keeps your in-progress reading reachable in this browser. Its cookie lasts 30 days and may be renewed when you visit; it contains a random identifier, not your birth details.
• Minimal technical logs — request and error information for operation, security, and abuse prevention. Processing records may contain information submitted for the relevant feature.
• Privacy-friendly product analytics — on the production website, Vercel Web Analytics collects page paths after query strings and fragments are removed, referrer origin, coarse browser/device/region information, and fixed-name product events with non-identifying category values.

Star Mirror is operated by [FULL LEGAL COMPANY NAME], a company incorporated in Hong Kong, with its registered office at [REGISTERED ADDRESS].

For service, billing, or privacy enquiries, contact support@starmirror.chat.

Effective date: [EFFECTIVE DATE].

2. Birth information and generation records

We use the birth details you submit to calculate charts and generate readings. Choosing not to save a reusable birth archive does not mean that every copy of those details is immediately removed: processing records and generation snapshots may contain submitted details.

If you choose to save a birth archive, it can be used for later readings without entering those details again. Generated charts and reports are separate from the reusable birth archive.

Removing birth inputs does not by itself delete generated charts or reports, and the relevant removal process may retain the birth year and gender used by the product. To remove broader account data, use the relevant deletion controls or contact support@starmirror.chat. Deletion requests are subject to account verification and the scope of the requested action.

3. De-identified derived analytical material

We retain de-identified birth-chart structure and analytical material for system quality and calibration. The retained shared analytical material excludes raw birth values and direct account identifiers. Personal account records and their links are managed separately under the account retention and deletion rules.

This does not authorize unrelated use of your conversations or memories. De-identification is not a claim that every piece of generated material is inherently anonymous.

4. Guest access and retention

Guest readings have a 30-day access and claim window unless successfully added to an account. A random guest browser identifier keeps the browser associated with those readings. Its cookie has a rolling 30-day lifetime; refreshing the cookie does not itself extend a reading’s expiry date.

Adding an eligible reading to an account removes its guest expiry. Account content then follows the retention and deletion rules for that content. A completed card moved to Trash has a 90-day restoration window, subject to the conditions shown in the product.

Expiry of an access or restoration window does not mean that every copy is physically erased at that exact moment. Operational cleanup and any applicable backup or provider retention processes are separate.

We also use session cookies to keep you signed in. Our current product analytics does not use advertising cookies or persistent visitor profiles.

5. Product analytics

We use aggregate product analytics to understand which pages and product steps are used and where a flow may need improvement. Optional analytics runs only on the production website after you explicitly allow it. Rejecting or withdrawing permission stops future browser and server product analytics events; all product features remain available. Necessary security logs and business records continue independently. Events already sent cannot be recalled by changing this setting. We remove query strings and URL fragments before collection and exclude shared-card routes under /c/ entirely.

We do not put your email address, birth details, account, seat or reading identifiers, access tokens, destiny results, report text, or conversation content into analytics events. Vercel Web Analytics does not use analytics cookies or persistent visitor profiles, and Star Mirror does not maintain a separate copy of this analytics dataset.

Support feedback

If you submit feedback while signed in, we store your account identifier, feedback category, message, submission time, and a request identifier used to prevent duplicates. We use this information to understand product issues and feedback. Access is restricted to authorized staff; messages are not public and are not sent to AI providers for analysis.

Feedback is scheduled for deletion after 180 days during daily cleanup. You can request a copy of your submitted feedback by emailing support@starmirror.chat; we verify account ownership. Clearing your account or deleting it removes this feedback. Drafts stay only in the current page’s memory and are lost on refresh. Do not include payment card details or unnecessary sensitive information.

6. How we use your email

• Sending you a secure link to your reading when it is ready.
• Sending one-time verification codes for login and registration.
• Serving as evidence of ownership: when you log in with an email, readings previously sent to that address can be recovered and claimed into your account.
• We do not send marketing email without separate consent.

7. AI, Mirror Self, and conversation memory

When a signed-in account uses Mirror Self, the service saves that account's conversations and may use relevant portions of its existing Star Mirror cards, reports, and saved memories to provide continuity and personalized replies. Only bounded context selected by the service is sent to the disclosed model providers; providers do not receive database access. A destiny interpretation is not treated as a lived experience. Model processing is needed to generate AI replies, but does not give the providers general access to your stored assets.

In the automatic memory experience, when conversation memory is on, relevant statements from your messages may be saved without item-by-item approval. We retain their source and time so that a past statement is not presented as an independently verified fact. Stage-specific memories can stop being used for everyday recall while remaining available for you to view; this is not deletion. You can view, correct, or forget saved memories in the chat memory window, including by asking in chat when the request identifies the memory clearly. Check the result if an action fails or needs clarification.

Turning conversation memory off in this experience stops new memories and cross-conversation memory use. Your existing memories and saved conversations remain, and the current conversation can continue. Turning it back on does not backfill messages from the period when it was off. Accounts still using the earlier confirmation experience show memory suggestions for approval; their “Use confirmed memories” control governs recall, not conversation storage.

Destiny context is controlled separately. In the automatic memory experience, find it in Account Settings under “Mirror Self memory”, along with options to forget all memories or delete all Mirror Self data. Forgetting memories does not delete your conversations; deleting a conversation does not by itself delete independently saved memories, but its original messages will no longer be available as source text. Deleting Mirror Self data does not delete your account or destiny readings. Earlier replies may still contain information used before a setting changed, until those conversations are deleted.

For eligible accounts, we store growth events, experience points (XP), levels, and progress to show your journey with Mirror Self. Turning memory off pauses new growth and keeps existing progress. Deleting a conversation does not remove recorded experience. Forgetting specific memories may reduce related experience and your level. Forgetting all memories, deleting all Mirror Self data, or retesting your own primary card resets your growth.

For Daily Fortune, we store your calendar time zone, daily content, tap and reveal progress, and check-in records so you can return to your saved experience. VIP expiry does not itself delete these records. Use the available deletion controls or contact support@starmirror.chat for deletion requests.

To request a copy of your Mirror Self data or ask to stop future model processing, contact support@starmirror.chat. We verify account ownership before handling data requests.

VIP expiry does not itself delete conversations or memories. Reading, exporting, and deleting your existing Mirror Self data do not require an active VIP membership. Turning memory off, forgetting memories, deleting a conversation, and deleting all Mirror Self data have different scopes, as described above.

8. Your deletion rights

You can request deletion of each of the following, independently or together:

• Conversations with the product.
• Stored memories derived from your usage.
• Long-term profiles and archives (including any saved birth archive or derived birth year).
• Destiny seats and the readings attached to them.
• Your account itself.

Use the relevant in-product controls or send a deletion request to support@starmirror.chat for requests requiring assistance.

9. Cookies and browser storage

We use necessary first-party cookies and browser storage to keep you signed in, recover readings, and preserve working state. We do not use third-party advertising cookies. Optional analytics is a separate choice and does not control these functions.

• Guest identifier (sm_guest_id): 30 days, renewed on visits. This does not change a reading’s own access window.
• Supabase sign-in cookie: the current browser retention setting is up to 400 days and may renew during authentication refresh. The access token inside has a separate, shorter validity; signing out removes the applicable authentication cookie.
• Privacy choice (sm_privacy_choice): 180 days from your selection, without renewal on ordinary visits. It records only the choice, rule version, and selection time. Allowing and rejecting are remembered for the same duration.
• Birth-form draft: session storage, marked to expire after 24 hours and ignored when expired on access. Closing the browser session can remove it earlier; this is not a scheduled deletion service.
• Local storage: seat and reading recovery data, viewed-report state, interface preferences, and sign-in resend timing. Retention depends on each function and browser/site-data cleanup; these entries do not all share one expiry.

Use “Privacy choices” in the footer or account menu at any time to allow or reject optional analytics. No account is required. Your choice applies to this browser; another browser or device, cleared site data, or an expired choice requires a new selection. Vercel’s 24-hour visitor recognition period is not a promise that all aggregate analytics data is deleted after 24 hours.

Service providers and international processing

We use providers for hosting, account and data services, email delivery, and AI processing. The providers below receive data relevant to the services they perform; this does not mean that every provider receives every category of your data.

Data may be transferred to and processed or stored outside Hong Kong and your country, including in mainland China. AI providers receive selected inputs required for the relevant feature, not general access to your account database.

Provider data-use and retention terms differ. Alibaba Cloud states that Model Studio customer data is not used for model training. Kimi’s published policy permits conversation information to support model optimization. We do not make a blanket promise that all providers offer no training use, zero retention, or a fixed maximum retention period. Relevant AI provider information is also available in the product’s processing disclosure.

Future payment processing

When paid checkout is enabled, payments will be processed by [PAYMENT PROVIDER]. We will receive transaction information needed to manage orders, subscriptions, access, refunds, and accounting. We will not store your full payment card number or security code. The provider will be identified before you submit payment.

Necessary transaction records may be retained to meet legal, accounting, fraud-prevention, and dispute-handling obligations, including after an account deletion request. The retention period depends on the type of record and the applicable obligation; deleting an account does not require us to erase records that must lawfully be kept.

10. Changes to this policy

We may update this policy as the product evolves. For material changes we will give notice inside the product or by email before they take effect.

11. Contact

Privacy questions and requests can be sent to support@starmirror.chat.