YiCast — Privacy Policy
This Privacy Policy explains how Rauma Holding Oy (Business ID: 2785034-7), trading as Demon Squirrels Game Studio ("we", "us", "our"), collects and uses your information when you use YiCast.
Data Controller: Rauma Holding Oy, Finland (Business ID: 2785034-7). For privacy inquiries, contact privacy@yicast.app.
We respect your privacy and collect only what we need to run the app.
1. What We Collect
Information you provide
| Data | When | Purpose |
|---|---|---|
| Email address | Account creation (optional) | Authentication, account recovery |
| Display name | Account setup (optional) | Personalization |
| Questions & notes | When you write a question or note for a reading | Generating AI interpretations, saving to your journal |
| Feedback text | When you submit feedback | Improving the app |
Information collected automatically
| Data | Purpose |
|---|---|
| Device identifier | Anonymous usage, push notifications |
| Platform (web/Android/iOS) | App compatibility, analytics |
| App version | Bug tracking |
| Timezone offset | Delivering notifications at appropriate times |
| Last active timestamp | Notification scheduling, inactive account management |
| Reading history | Hexagram numbers, reader used, coin used — stored in your journal |
| Purchase records | Jade coin transactions, reading passes |
Information processed but not stored by us
| Data | What happens |
|---|---|
| Questions sent for AI reading | Sent to third-party AI services (see Section 4). We log the hexagram number, reader, and status for debugging — not your question text. |
| Payment details | Handled entirely by Google Play / Apple App Store. We never see your payment card information. |
2. How We Use Your Data
We use your data to:
- Provide the service — generate readings, save your journal, manage your account and purchases
- Improve the app — analyze aggregated, anonymized usage patterns (e.g., which features are popular, where errors occur)
- Send notifications — daily wisdom quotes, reading reminders (only if you opt in)
- Provide support — respond to feedback and troubleshoot issues
- Prevent abuse — detect and prevent fraudulent or unauthorized use
We do not:
- Sell your personal data to anyone
- Use your data for advertising
- Profile you for marketing purposes
- Share your reading questions or journal entries with other users
3. Legal Basis (GDPR)
If you're in the EU/EEA, here's our legal basis for processing:
| Processing | Legal basis |
|---|---|
| Account and service delivery | Performance of contract (Art. 6(1)(b)) |
| Push notifications | Your consent (Art. 6(1)(a)) |
| Usage analytics (aggregated) | Legitimate interest (Art. 6(1)(f)) — improving the app |
| Fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Legal obligations | Legal obligation (Art. 6(1)(c)) |
4. Third-Party Services
We use the following third parties to operate YiCast:
| Service | Purpose | Data shared |
|---|---|---|
| Supabase (US/EU) | Database, authentication | Account data, readings, purchases |
| AI providers (OpenRouter, AIML API) | Generating reading interpretations | Hexagram data, your question (if provided), reader style |
| Google Play / Apple App Store | Payments, app distribution | Purchase transactions (handled by them) |
| RevenueCat | In-app purchase management | Purchase records, anonymous user ID |
Each third party processes data under their own privacy policy. We select providers that offer adequate data protection.
AI providers may process your question text to generate a reading. We do not control how AI providers handle data beyond their stated policies. We do not send your name, email, or account ID to AI providers.
5. Data Storage and Security
- Your data is stored in Supabase (cloud infrastructure).
- All data is transmitted over HTTPS.
- Database access is protected by row-level security — users can only access their own data.
- We do not store passwords directly; authentication is handled by Supabase Auth.
- Local data (readings stored offline) is kept in your browser's IndexedDB.
6. Data Retention
- Account data: Kept as long as your account is active. Deleted upon account deletion.
- Readings: Kept until you delete them, or until your account is deleted.
- Interpret logs (debugging): Kept for 12 months, then deleted.
- Feedback: Kept indefinitely for product improvement (anonymized after account deletion).
- Anonymous usage data: Device IDs and usage logs kept for 24 months.
7. Your Rights (GDPR)
If you're in the EU/EEA, you have the right to:
- Access your personal data
- Correct inaccurate data
- Delete your data ("right to be forgotten")
- Restrict processing of your data in certain circumstances
- Export your data in a portable format (data portability)
- Withdraw consent for push notifications at any time
- Object to processing based on legitimate interest
- Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)
To exercise any of these rights, contact us at privacy@yicast.app. We'll respond within one month. If your request is complex, we may extend this by up to two additional months, in which case we'll inform you of the extension and the reasons for it.
How to Delete Your Account
You can request account deletion by emailing support@yicast.app. Upon deletion, we remove your personal data as described in Section 6. Some anonymized data (e.g., aggregated usage statistics, anonymized feedback) may be retained as it can no longer be linked to you.
8. Children
YiCast is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
9. International Transfers
Your data may be processed outside the EU/EEA (e.g., by AI providers or infrastructure in the US). When this happens, we ensure adequate protection through one or more of:
- An adequacy decision by the European Commission (e.g., EU-US Data Privacy Framework)
- EU Standard Contractual Clauses (SCCs)
- The service provider's binding corporate rules or equivalent safeguards
You can request information about the specific safeguards applied by contacting us.
10. Cookies and Local Storage
YiCast does not use tracking cookies. We use:
- IndexedDB: To store readings locally on your device for offline access
- Local Storage: To store app preferences (language, selected coin, etc.)
These are functional only — no advertising or tracking.
11. Changes to This Policy
We may update this Privacy Policy. If we make significant changes, we'll notify you in the app. The "Last Updated" date at the top will always reflect the current version.
12. Contact
For any privacy-related questions or requests:
Rauma Holding Oy
Business ID: 2785034-7
Country: Finland
Email: privacy@yicast.app
Data Protection Authority:
Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto)
www.tietosuoja.fi
This Privacy Policy should be read together with our Terms of Service and EULA.
We keep this policy honest and readable. If something is unclear, ask us.