Privacy Policy
Draft status — operator confirmation required
This policy describes, factually, what the Dao Oracle application stores and sends today. It is published so that users can read it before registering. It is not yet a legally effective policy, because the controller identity and contact details below have not been confirmed:
Pending items are marked [TO BE CONFIRMED]. Data-protection authority, representative and transfer mechanism depend on the operator's establishment and will be added before the policy takes effect.
1. Who is responsible for your data
The data controller for Dao Oracle is [TO BE CONFIRMED: legal entity name and address]. The privacy contact is [TO BE CONFIRMED: privacy contact email]. Until that mailbox is confirmed, please use the support channel published on the Dao Oracle website.
2. What we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Email address, display name, password hash and password-set time, email verification timestamp, account status, role (USER or ADMIN), registration time, last activity time | To create and secure your account, to sign you in, and to keep an audit trail of administrative access |
| Verification data | Verification-code digest, expiry, attempt count, next-allowed-send time, purpose, delivery provider message id, and a hashed form of the requesting IP address used for send-rate limits | To deliver the six-digit code, to limit abuse, and to prevent code reuse |
| Reading metadata | Selected deity, hexagram identifiers, event type, success or failure, error code, duration in milliseconds, guest or account flag, timestamp | To operate the reading flow, to recover from failures, and to produce aggregate operational statistics |
| Content you enter | Your question, follow-up questions, and — only if you enable memory — the short notes you confirm | To generate the reading and answer follow-ups. Questions are sent to the model provider for inference |
| Optional long-term memory | Up to 20 notes per account, each up to 280 characters, linked to a deity, with save and expiry times | Only to inform later readings for your own account, after you explicitly enable and confirm each note |
| Session data | An opaque session token stored in an HttpOnly cookie, plus its hashed form and expiry on the server | To keep you signed in for up to 24 hours |
| Operational records | Aggregate daily activity, email delivery outcomes, and error counters | To monitor reliability and to detect abuse |
3. What we do not store
- We do not store your password in readable form; only a salted scrypt hash is kept.
- We do not store verification codes in readable form; only an HMAC digest is kept, and it expires after five minutes.
- We do not keep a copy of your reading questions in the operational statistics tables. Those tables record metadata only.
- The operations console does not expose password hashes, verification codes, session tokens or the text of memory notes.
- We do not use advertising or cross-site tracking cookies on Dao Oracle.
Some features store generated text alongside a purchase record. Where a paid draw is completed, the generated interpretation and its audio file are stored with that purchase so that you can read or replay it. Payment features are currently not enabled on this deployment.
4. Cookies
Dao Oracle sets one essential cookie, companion_session. It is HttpOnly, SameSite=Lax, scoped to the site, and expires after 24 hours or when you sign out. It contains an opaque token, not your email address. We do not use it for advertising. Blocking it prevents sign-in.
5. Why we process your data
- To perform our contract with you: creating your account, signing you in, generating readings you request, and providing support.
- With your consent: long-term memory. Consent is optional, granular, and can be withdrawn at any time.
- For our legitimate interests: keeping the service secure, preventing abuse and fraud, rate limiting, and producing aggregate statistics that do not identify you.
- To comply with legal obligations: retaining records where the law requires it, and responding to lawful requests.
6. Who we share data with
We use service providers that process data on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Resend | Delivery of verification emails | Recipient email address, the six-digit code, and delivery metadata |
| Volcengine Ark | Large-language-model inference for readings and follow-ups | The reading prompt, which includes your question, the selected deity, the hexagram and any memory notes you enabled |
| Cloud hosting provider | Servers, network and backups for the service | All data stored by the service, as described above |
Hosting location and the current list of sub-processors are [TO BE CONFIRMED: hosting region and sub-processor list]. We do not sell personal information. We disclose data to authorities only where legally required, and we will state the legal basis where we are permitted to do so.
7. How long we keep data
| Data | Retention |
|---|---|
| Verification codes | 5 minutes, then unusable; attempt counters are kept with the challenge record |
| Sessions | 24 hours after issue, or until sign-out |
| Long-term memory notes | Up to 180 days from saving, or until you delete them |
| Account and reading metadata | For as long as your account exists, then deleted or anonymised on a verified deletion request |
| Purchase and payment records | As required by applicable tax and accounting law [TO BE CONFIRMED: statutory retention period] |
| Server and error logs | Short operational window; rotated by the hosting configuration [TO BE CONFIRMED: log retention] |
8. How we protect data
- Passwords are hashed with scrypt and a per-user salt.
- Verification codes are stored as HMAC digests and compared in constant time.
- Session cookies are HttpOnly and SameSite=Lax; administrative endpoints re-check the account role on the server for every request.
- Administrator access requires an explicitly granted server-side role, and authorization records are written to an audit log.
- Traffic between your browser and Dao Oracle is encrypted with HTTPS.
- Database backups are taken before schema changes and stored with restricted permissions.
No system is perfectly secure. If a breach affects your rights, we will notify you and the competent authority as required by applicable law.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you;
- correct inaccurate data;
- delete your account and associated data;
- withdraw consent to long-term memory at any time;
- object to, or request restriction of, certain processing;
- receive a copy of data you provided, in a portable format;
- lodge a complaint with your local data-protection authority.
To exercise a right, contact [TO BE CONFIRMED: privacy contact email]. We will respond within the period required by applicable law. You will not be charged for a reasonable request.
10. Children
Dao Oracle is not directed to children. Accounts require the user to be at least 18 years old, or the age of majority in their jurisdiction. If we learn that an account belongs to a child below that age, we will close it and delete the associated data.
11. International transfers
Our providers may process data outside your country. Where that happens, we rely on an appropriate transfer mechanism. The specific mechanism and destination countries are [TO BE CONFIRMED: transfer mechanism and destinations].
12. Automated processing
Readings are generated automatically by a language model. They do not produce legal effects and are not used to make decisions about your access to credit, employment, insurance or any other significant benefit. We do not build advertising profiles.
13. Changes to this policy
We will publish a new version number and date when this policy changes. Material changes will be announced on this page before they take effect.
14. Contact
Privacy questions and requests: [TO BE CONFIRMED: privacy contact email]. Postal address: [TO BE CONFIRMED: registered address].
15. Version history
| Version | Date | Status |
|---|---|---|
| 1.0 | 29 October 2026 | Draft published for review; not yet effective |