Privacy Policy

Who we are

bornthis.day is run by Gwabba Ltd., Seoul, Republic of Korea ("we", "us"). We decide how your information is used, so we are responsible for it (the "controller" in EU and UK law, the "personal information processor" in Korean law).

For anything about privacy, write to [email protected]. This address also reaches the person responsible for privacy at Gwabba Ltd. (our privacy officer).

If you use the site without an account

• Your birth date, time, city, district, gender and school are used only to build your page. We don't save them in our database.
• Destiny readings: your birth date, birth time (exact, or the two-hour window you pick), birth city and gender are used to work out your Destiny chart. They are not saved in our database: they travel inside your Destiny link in encrypted form, so only our server can read them. The written reading is saved so it doesn't have to be written again, but it is stored only under the chart's pattern, never with your date, place, name or email.
• The date, city, district and time are part of the page's web address, so they appear in normal web traffic records (see "Technical logs" below). Your gender is kept in a cookie in your own browser until you close it, so the page can use the right words. Schools are never put in web addresses, share links or share images.
• Your country is worked out by Cloudflare from your internet address. We use it to suggest a language and a country and to decide whether to show the cookie notice. We don't save it.

If you make an account

• Account details: your name, email address, whether your email is confirmed, and your password. The password is stored only as a one-way scrambled code (a hash), so nobody can read it, us included.
• If you sign in with Google: Google sends us your name, email address, profile picture link and Google account ID, plus sign-in codes (tokens). We use them only to log you in. We don't get your contacts, files or anything else from Google.
• Login sessions: while you are logged in, we keep the internet address (IP) and browser type of each login, to keep your account secure.
• Saved birth details (only if you choose to save them): date of birth (solar or lunar calendar), time if you know it (or the two-hour window you picked), country, birth city, district, gender if you give it, and the schools you went to if you add them. Your birth time, city and gender are also used for your Destiny reading.
• Ask Destiny chat: the questions you ask and Destiny's answers, saved so you can scroll back, plus how many questions you have used today, your bonus questions, your plan and your time zone (so your daily questions reset at your local midnight).
• Chemistry invites you create: the relationship and nickname you enter, whether you want an email when they answer, and your birth details for that match. When your friend answers, you see their nickname, chemistry score and Destiny Type, never their birth details.
• Destiny purchases (if you buy something): what you bought and when, which chart or match it is for, the amount and currency, whether you paid with PayPal or Stripe and their reference for the payment or subscription, and for Destiny Plus your subscription's status, renewal and cancellation dates. We never see or store your card or bank details: PayPal and Stripe collect them.
• Daily fortune (if you use it): the days in a row you opened it (your streak), and, if you turn on daily messages, the hour, time zone and language you chose and which Destiny chart to send. For phone notifications we also keep the push address your browser gives us.
• Lucky wallpapers: the wallpapers made for you. They are stored privately and only you can open them.
• Result page layout: the order of the cards on your result page and which ones you hide.
• Waitlist (if you join one): the country you're waiting for, your personal invite code, who invited you, your language, and a scrambled (hashed) version of your internet address that can't be turned back into the address. We use the hash only to stop people faking invites. Your place in line and the number of people you invited are calculated from this. On the top-10 invite board we show only your first name and the first letter of your last name. If you're in the top 100 when a country opens, we note your early access and free premium reading.
• Emails: we keep a copy of the waitlist emails we send you (joined, moved up, someone used your link, your country is live) and whether they were delivered. We also send emails you ask for, such as confirming your email or resetting your password. We don't send marketing emails.
• Photos you send: the photo, plus the place, year, caption and credit you give us, and your confirmation that you have the right to share it. Before storing a photo we resize it and remove all hidden information in the file, including GPS location and camera details. Photos are checked by a person, and approved photos are shown publicly with the credit you entered (not your account name or email).

Friend matching (chemistry links)

When someone sends you a chemistry link (bornthis.day/match/…) and you fill in the form, we save the birth date, birth time, birth city and gender you enter with that match, so that you and the person who invited you can both see your chemistry. We save them only because you entered them yourself on that form. Nobody can add your details for you.

• The person who invited you sees the nickname they gave you, your chemistry score and your Destiny Type. They never see your birth date, time or city.
• Anyone with the link can see the result page (the two names, the score and the chemistry notes), so share it only with people you choose.
• If the inviter asked for it, we email them once to say you answered.
• The match is deleted when the inviter deletes their account. You can ask us to delete your details from a match at any time by writing to [email protected] with the link.

Information about every visitor

• Technical logs: like almost every website, our hosting (Railway) and network (Cloudflare) providers automatically record requests: internet address, page address, time, browser type and errors. We use these only to keep the site running and secure. They are deleted automatically after a short time (usually within 30 days).
• Limits against abuse: to stop mass sign-ups and fake invites, we count sign-ups and waitlist joins per scrambled (hashed) internet address per day. These counts are deleted after 90 days.
• Sharing counts: we count how often share buttons are used, how often shared links are opened, and how many new results come from them, per country and per app. These are totals and are not linked to you.
• Destiny counts: how often Destiny previews are seen, readings opened, questions asked, links shared, matches made, paywalls shown and things bought, per day. These are totals and are not linked to you.
• We do not use analytics services, advertising networks, social media pixels or fingerprinting.

Cookies and browser storage

We use only cookies and storage that the site needs to work. That's why there is nothing to accept or reject. There are no analytics, advertising or tracking cookies.

• Login cookies (names starting with "better-auth"): keep you logged in. They are removed when you log out or after about a week without visiting.
• lang: the language you picked with the language switcher. Kept for 1 year.
• bc_music: whether you want music on your result page. Kept for 1 year.
• bc_gender: the gender you picked on the form, so the result page can use the right words. Removed when you close your browser.
• bc_tz: your time zone, so the daily fortune and the luck calendar show your own today. Kept for 1 year. When you go to a checkout, PayPal or Stripe may set their own cookies on their pages for security and fraud prevention.
• In your browser's own storage (not sent to us): your music volume, that you've closed the cookie notice, and your card arrangement during one visit.
• Cloudflare may set a security cookie (such as __cf_bm) to tell people from automated bots.

Who helps us run the site

We share information only with these service providers, only for the jobs below, and they may use it only to provide those services to us:

• Railway (Railway Corporation, United States): hosting, database and photo storage. All the information above is stored here.
• Cloudflare (Cloudflare, Inc., United States): domain name, network delivery and protection from attacks. Every request passes through Cloudflare.
• Google (Google LLC, United States): sign-in, only if you choose "Continue with Google".
• Postmark (ActiveCampaign, LLC, United States): sending our emails. It receives your email address and the email's text.
• Google Gemini (Google LLC, United States): we use it to make labelled illustrations ahead of time. We never send it any information about you or anything you type.
• Anthropic (Anthropic, PBC, United States): its Claude AI writes the Destiny readings and the Ask Destiny answers. For readings we send only a description of the chart (elements, animals and cycles), never your name, email, birth date or place. For Ask Destiny we send your question, your recent messages in that chat, a description of your chart and, if you ask about someone you matched with, a description of their chart. Under its commercial terms, Anthropic does not use this to train its models.
• PayPal (PayPal, Inc., United States, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, or the PayPal company for your country): takes Destiny payments made with PayPal. It receives your email address, what you buy and the price, and collects your payment details itself, under its own privacy policy. It tells us when a payment, refund or subscription change happens.
• Stripe (Stripe, Inc., United States, and Stripe Payments Europe, Ltd., Ireland): takes Destiny payments made by card, Apple Pay or Google Pay, and all payments in countries where PayPal isn't available. It receives your email address, what you buy and the price, and collects your payment details and country itself, under its own privacy policy. It tells us when a payment, refund or subscription change happens.
• Push services (for example Google, Apple or Mozilla, depending on your browser): if you turn on phone notifications, your daily fortune is delivered through your browser maker's push service. It receives the short message, not your account details.
• Google Gemini also paints lucky wallpapers: for these we send only a description of colours, scenery and a symbol, nothing that identifies you.
• Public data services (Open-Meteo, the World Bank, Wikidata and Wikimedia Commons): to build a result page, our server asks them for things like the weather, prices and famous people for a date and place. They receive only the date and place, never your name, email or account.
• Messaging apps and social networks: when you press a share button, the app you choose (for example WhatsApp, LINE or X) receives the link and message you share. Their own privacy policies apply.

We do not sell your personal information and we do not share it for advertising. We may disclose information if the law requires it, to protect people's safety, or to a company that takes over the site (we would tell you first).

Where your information is stored

Our servers and service providers are in the United States, so your information is stored and processed there. That may be outside your own country, including outside the EU, the UK, Korea, Brazil, Canada, Thailand, Vietnam, Singapore and Turkey. Where the law requires it, we rely on standard contract clauses (such as the EU Standard Contractual Clauses and the UK addendum) and the data protection terms of our providers.

For users in Korea (overseas transfer): account, profile, waitlist and photo information listed above is transferred to Railway Corporation (United States, through its servers) when you save it, to store it for as long as your account exists. Email address and email text go to ActiveCampaign, LLC (Postmark, United States) when an email is sent, to deliver it. Requests and internet addresses pass through Cloudflare, Inc. (United States) on each visit, for network delivery and security. Sign-in details pass through Google LLC (United States) when you use Google sign-in. Transfers happen over encrypted connections. If you don't want this, don't make an account. You can still use the site without one.

How long we keep things

• Account, saved details, waitlist places and photos: until you delete them or your account.
• Ask Destiny chats and chemistry invites: until you delete your account. A friend's details in a match: until the inviter deletes their account or the friend asks us to delete them.
• Written Destiny readings and type descriptions: kept, because they are linked only to a chart pattern and not to anyone.
• Purchases and subscription records: until you delete your account. PayPal and Stripe keep their own payment records for as long as the law requires.
• Login sessions: until you log out, or about a week after your last visit.
• Copies of sent emails: 180 days.
• Daily anti-abuse counts: 90 days.
• Technical logs at Railway and Cloudflare: a short time, usually within 30 days.
• Approved photos you sent: shown until you delete your account or ask us to remove them.
• After you delete your account: your information is removed from our database straight away and from backups within 30 days. Totals that can't identify you (like sharing counts) may be kept.

Your choices and rights

• See and download your data: on your account page, press "Download my data" to get a copy of everything we keep about you.
• Correct it: change your saved details on your account page at any time.
• Delete it: delete just your birth details, or press "Delete my account and data" on your account page. This removes your account, saved details, waitlist places, emails, uploaded photos, Ask Destiny chats and the chemistry invites you made.
• Anything else (for example objecting, restricting use, asking questions, or if you can't log in): write to [email protected]. We'll reply within 30 days, or sooner if your local law requires it. We may need to check that the request really comes from you.

We will never treat you worse for using your rights.

Extra information for your region

EU, EEA, UK and Switzerland: we use your information to provide the service you asked for (your account, waitlist and emails: contract), for our legitimate interests in keeping the site secure and fair (logs, limits against abuse, invite checks), and with your consent for optional details you choose to give (gender, birth time, schools, photos). You can withdraw consent at any time by deleting those details. You have the right to access, correct, delete, restrict, object and take your data with you (data portability), and to complain to your local data protection authority.

United States, including California: in the last 12 months we have collected the kinds of information described above: identifiers (name, email, internet address), account and profile details, internet activity on our site (logs), approximate location (country), and content you upload. We collect them for the purposes in this policy. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer things about you. California residents and residents of other US states with privacy laws can ask to know, access, correct or delete their information, and to appeal our answer, by writing to us. You can also use an authorised agent.

Canada (including Quebec): the person responsible for protecting your personal information can be reached at the email address below. Your information is stored outside Canada and Quebec (in the United States), as explained above. You can ask to access or correct it, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or the Commission d'accès à l'information du Québec.

Brazil (LGPD): our legal bases are performing the service you asked for, our legitimate interests and your consent, as described above. You can confirm whether we process your data, access, correct, anonymise, block or delete it, take it with you, learn who we share it with, and withdraw consent. You can complain to the ANPD.

Thailand (PDPA), Vietnam (Decree 13/2023/ND-CP), Singapore (PDPA) and Turkey (KVKK): you have the rights described above, including access, correction, deletion, withdrawal of consent and objection. By making an account, you agree to your information being transferred to and stored in the United States as described above. You can complain to the Thai Personal Data Protection Committee, Vietnam's Ministry of Public Security (A05), Singapore's Personal Data Protection Commission, or Turkey's Personal Data Protection Authority.

Korea (PIPA): we process only the information listed above, for the purposes listed above, and destroy it as described under "How long we keep things" (database records are permanently deleted; files are deleted from storage). You can ask to access, correct, delete or stop processing your information. You can get help from the Personal Information Protection Commission (privacy.go.kr) or the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, phone 118). We do not collect resident registration numbers or other unique identification numbers.

Children

bornthis.day is not for children under 14, or under 16 in the EU and EEA. Children under those ages should not make an account, join a waitlist or send photos. If we learn that we have information from a child under that age, we delete it. If you think a child has given us information, write to [email protected].

Keeping information safe

All connections to the site are encrypted (HTTPS). Passwords and internet addresses used for anti-abuse checks are stored only in scrambled (hashed) form, photo metadata is removed, and only a few people at Gwabba Ltd. can access the database. No system is perfectly secure, but we take care and will tell you and the authorities about a serious breach where the law requires it.

Changes to this policy

If we change how we use your information, we'll update this page and the date at the top. If a change is important, we'll show a notice on the site or email account holders before it takes effect.

Contact

Gwabba Ltd., Seoul, Republic of Korea · [email protected]