What we collect, and what we don't.

1. What we collect

• Your account, if you create one: your email address, a hash of your password (scrypt; the password itself is never stored and we cannot read it), the plan you chose, your language, and the date you signed up. No name is asked for. While you are signed in, the readings you draw and the consulting read-outs you reach are saved to the account, including the conversation that produced a read-out, so they are there when you come back. If you ask for the written assessment, we also record that you asked and copy the request into our internal queue so it gets written. If you ask for a password reset, we email you a one-hour, single-use link; the request is noted in our operations sheet and the link itself is not kept there once sent.
• Inline feedback: if you select text or pick an element on a page and send a note, we keep the page, the text you selected or the element's position and a short snippet of it, your note, when you sent it, and a shortened one-way hash of your IP address; your email address only if you chose to add it.
• Waitlist and contact forms: your email address, the service you chose, the note or message you wrote, when you sent it, and which page you were on. Contact-form submissions also store a shortened, one-way hash of your IP address to deter abuse; it cannot be turned back into your address.
• Readings and consulting chat: the question or messages you type are sent to our AI model provider to generate the reply. If you are signed out, they are discarded from our servers afterwards; if you are signed in, the reading or read-out is saved to your account until you delete it. Either way we log that a reading or a chat turn happened, its cost, and the language, but not its content.
• Your browser: the free reading you draw each day is kept in your own browser's local storage so you can see it again that day. One cookie remembers your language choice; a second one keeps you signed in for 30 days if you have an account, and it goes when you log out. No advertising or analytics cookies, ever.
• Server logs: our hosting provider keeps standard request logs (time, path, status, IP address, user agent) for a limited period for security and debugging.

2. Why we use it

To deliver the service you asked for, to keep you signed in and show you what you saved, to write an assessment you asked for, to email you the copy you requested, to reply if you contacted us, to keep the services within the limits of your plan, and to understand how the services are used in aggregate.

3. Who processes it for us

• Google Cloud hosts the site (United States), stores waitlist and contact entries in a spreadsheet in our Google Workspace, and stores accounts, sessions, saved readings and saved read-outs in Cloud Firestore (United States).
• Anthropic provides the AI model that writes readings and consulting replies. Your text is sent to them to generate the answer under their commercial terms; we do not use it to train models.

We do not sell personal data, and we do not share it with advertisers.

4. How long we keep it

Your account and everything saved on it: until you delete it, which you can do yourself at any time from the account page; deletion is immediate and we keep no copy to restore. Waitlist and contact entries: until you ask us to delete them, or until the related launch or conversation is long over. Chat and reading content when you are signed out: not retained after the reply. Hosting logs: per our provider's default retention (about 30 days).

5. Your choices and rights

If you have an account, the account page shows you everything saved on it, lets you delete any single reading or read-out, and lets you delete the whole account with one confirmation. For anything else, write to us through the contact page to see, correct, or delete what we hold about you, or to leave a waitlist. Depending on where you live, you may have further rights under laws such as the GDPR, the UK GDPR, the CCPA, or Taiwan's Personal Data Protection Act; we will honour them.

6. Children

The card readings are for adults 18 and over. We do not knowingly collect personal data from children.

7. Security

Traffic is encrypted in transit. Passwords are stored only as scrypt hashes with a per-account salt. Session cookies are HttpOnly, Secure, and signed with a key held in a managed secret store, so a stolen database row cannot be replayed. Access to stored entries is limited to StackNative's operators.

8. Changes

We will date any material change at the top of this page.

This English version is the authoritative one. A Chinese translation may be provided for convenience; if the two differ, the English text governs.

Questions: contact Bentley.