Privacy Policy
Effective date: September 30, 2026
This policy explains what personal data MeowChing (meowching.com) collects, how we use it and your choices. MeowChing ("we", "us") is responsible for this processing and can be reached at [email protected].
1. Data we collect
| Category | Details |
|---|---|
| Google account data | Google account ID, email address, name and avatar, received when you sign in with Google. |
| Reading content | The question you type (up to 500 characters), your coin casting result, and the AI-generated interpretations and follow-ups. |
| Usage and account records | Free daily uses, credits, credit ledger entries, referral relationships, orders and refund status. |
| Payment data | Orders are processed by Waffo. We receive order and payment status (for example paid, refunded, disputed), amounts and identifiers, not your full card number. |
| Session and technical data | Session and anonymous-session identifiers (stored as hashes on the server), and the IP address used for security and rate limiting. Requests pass through Cloudflare. |
| Sharing data | Share links you create and their revocation status. |
| Analytics data (only if you accept analytics cookies) | Pages visited (with reading IDs and invitation codes removed), campaign tags, device and browser type, approximate location, and on public pages anonymized clicks, scrolls and session replays. Account, reading and invitation pages are not recorded, and questions and readings are never sent. |
Please avoid entering sensitive personal information (such as health details, government IDs or others' private information) into questions.
2. How we use data
- To provide the Service: sign you in, cast and interpret readings, manage free uses, credits and referrals, and show your history.
- To process payments, fulfil orders, and handle refunds and chargebacks.
- To prevent fraud and abuse, including multiple-account abuse, and to secure and rate-limit the Service.
- To operate, debug and improve the Service using sanitized logs and, if you accept, analytics.
- To comply with legal obligations and enforce our Terms.
We do not sell your personal data. We do not use your questions or readings for advertising.
3. AI processing
Your question and casting result are sent to Google Gemini models through a LiteLLM gateway that we operate, on Google Cloud Vertex AI, to generate your interpretation. The reply language follows the language of your question. AI outputs are stored so you can view them. We do not log questions or AI output in our application logs.
4. Legal bases
Where GDPR-style laws apply, we rely on: contract (providing the Service and processing purchases); legitimate interests (security, fraud prevention, service operation and improvement); legal obligation (tax, accounting and legal requests); and consent where we ask for it, such as personalized sharing and analytics cookies. You can withdraw analytics consent at any time on the Cookie Notice page.
5. Sharing and subprocessors
We share data only as needed to run the Service:
| Provider | Role |
|---|---|
| Sign-in (Google account data); Gemini models on Vertex AI (question, casting result). | |
| Cloudflare | CDN and proxy in front of our server; traffic passes through it. |
| Waffo (Waffo.com Limited) | Merchant of Record and payment processing. |
| LiteLLM gateway | Operated by us; routes model requests to Vertex AI. |
| Google Analytics | Usage statistics, only with your consent. Google signals and ad personalization are off. |
| Microsoft Clarity | Usage heatmaps and session replays of public pages, only with your consent. |
Our servers are self-hosted behind Cloudflare. We may also disclose data when required by law or to protect rights and safety. If we are involved in a business transfer, data may transfer with it.
6. Retention
- Free readings: become unavailable to you 30 days after creation. This is not the same as immediate physical deletion: we retain the underlying data in line with this policy.
- Readings cast without signing in: if you never sign in to claim them, their question text is erased once they expire, 30 days after creation. The casting result and minimal usage records are kept.
- Readings that used credits: are kept.
- Deleting a reading: you can delete an individual reading. This erases its question and AI output. Minimal financial and usage audit records (for example that a use or credit was spent) are kept.
- Account and ledger records: kept while your account exists and as needed for accounting, fraud prevention and legal obligations.
- Logs: application logs are sanitized and structured and do not contain questions, AI output, tokens or cookies.
- Shares: stay available for up to 30 days, and end earlier if the reading expires, you revoke the share or you delete the reading.
- Account deletion: self-service deletion is not yet available. You can request deletion by email (see below).
7. Your rights and how to exercise them
Depending on where you live, you may have the right to access, correct, export, delete or restrict processing of your data, to object to processing, and to withdraw consent. To exercise these, including deletion or export of your data, email [email protected] from the email address of your Google account. We may need to verify your identity and will respond within the time required by applicable law. Some records (such as financial and audit records) may be retained where the law or our legitimate interests require. You may also complain to your local data protection authority.
8. International transfers
We and our subprocessors may process data in countries other than yours, including where Google, Cloudflare and Waffo operate. Where required, we rely on appropriate safeguards such as contractual clauses. Our application servers and database are hosted in South Korea (Oracle Cloud, Seoul region) and reached through Cloudflare's global network.
9. Security
We use measures such as HTTPS, Secure and HttpOnly cookies, hashed anonymous-session credentials, same-origin request checks and rate limiting, and we keep secrets out of logs. No system is completely secure, and we cannot guarantee absolute security.
10. Children
The Service is intended for users 18 or over (or the age of majority where you live). We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.
11. Changes
We may update this policy. We will post the new version with an updated effective date and give reasonable notice of material changes.