Privacy Policy
Last updated 2026-10-05
What we collect
You need an account to use this service. Your account stores your email address, a hash of your password (scrypt; we never store the password itself — if you sign in with Google, LINE or Apple we store only the provider name and the user identifier it gives us, never its access tokens), the profile photo you upload (shrunk to 160px on your device before it is sent), your interface language, the time zone you choose, and your personality-test result. We store the birth details you enter: a name or nickname, gender, Gregorian date of birth, time of birth (optional), city of birth and its coordinates, and whose chart it is. The chart itself is not stored; it is recomputed from those details each time. What you write into the AI features and what they generate is kept in your records so you can read it again: questions on the chart form, the line you write for One Question, your tarot question and the cards drawn, the dreams you describe, in-depth reports and follow-up questions. Records are attached to a birth chart: until you have cast one, tarot, dream and palm readings are shown once and not saved. When you buy credits, we store the transaction ID and product provided by the app store (Apple / Google) and a record of credits added, used and refunded; we never handle your card details. If you turn on the daily reading notification (app only, after you agree to the explanation and allow notifications), we store this device’s push token and send one notification each morning through Apple’s push service; turning it off under Me deletes the token.
Services we rely on (including transfer abroad)
AI generation: Anthropic (United States) — your birth details, your question, the tarot cards any dream you write down and the palm photo you take for a palm reading (we never store the photo) are sent there, used only to produce that one result and not to train models. What you type into AI support is also sent there to write the answer; the chat is not saved. Sign-in: Google (United States), LINE (Japan), Apple (United States), handled by them only if you choose them. Payments: Apple App Store and Google Play in-app purchase. Email delivery: Resend (United States). Share-image fonts: Google Fonts (United States) — when a share image is made, the characters it uses (each character once, which can include characters from your name) are sent to fetch the font. Hosting: Vercel (a US company; this site runs in its Tokyo region). Database: our own server in Tokyo. Usage measurement: Google Analytics (United States; it collects device identifiers). Ad measurement: X Corp. (United States) — on the website (starlot.me) only, the X Pixel collects browsing and sign-up conversion data through cookies and similar identifiers; no email address, phone number or name is sent. It is not used inside the iOS or Android apps. You can turn off ad personalization based on this data in X’s Privacy and safety settings: https://x.com/settings/privacy_and_safety . In-app ad measurement: Meta Platforms (United States) — in the iOS app only (from version 1.0.2). The app sends events such as app launch and completed sign-up to Meta to measure Instagram and Facebook ads; no email address, phone number or name is sent. Your device’s advertising identifier (IDFA) is sent only if you choose Allow on the “Allow app to track” prompt; otherwise only aggregated data without it is sent (for example through Apple’s SKAdNetwork), and every feature works either way. You can change this at any time in iPhone Settings → Privacy & Security → Tracking. We do not sell data and, apart from the ad measurement described above, do not share it for advertising.
Cookies and on-device storage
Your login session, language, time zone, the app-lock setting (app only), a short-lived value used during a social sign-in round trip (expires in 10 minutes), a visitor identifier (so records made on this device before you registered move into your account when you sign in), and your choice on the AI notice (kept on your own device). We also use Google Analytics cookies for usage statistics. On the website only, the X Pixel sets ad-measurement cookies (see above), and finishing sign-up stores a conversion marker that expires after 10 minutes. The X Pixel is not used inside the app.
Usage data we record
To see which features get used and what the AI costs, we record which feature, which model, how long it took, whether it succeeded, and the token counts. That record contains no user and no text. For features that use credits, we record per account which feature was used and a reference to the result (so reopening the same result is not charged twice), plus a ledger of credit changes (grants, purchases, uses, returns and refunds).
Keeping and deleting
Your data is kept until you delete your account. In the app, you can delete your account at the bottom of the Me page: you can no longer sign in, your email address is removed from the account and from our mailing and sending records, and your birth details and records are marked deleted and are no longer shown or processed. If you use the website, write to support@gbst.jp and we will do the same; tell us as well if you want the data erased from the database entirely. Credits are one-time purchases, so there is no subscription to cancel; unused credits are lost when you delete your account. Horoscope and reminder emails can be stopped at any time with the unsubscribe link at the bottom of every email.
No professional advice
Written readings on this service (chart readings, tarot, dreams, palm and similar) are generated by AI; the almanac, date picking and the zodiac and animal-sign forecasts are calculated by fixed rules. Everything is for entertainment and self-reflection, and is not medical, legal, financial or any other kind of professional advice.
Operator and contact
偉輝科技株式会社（402, 1-51-3 Chuo, Nakano-ku, Tokyo 164-0011, Japan） / support@gbst.jp