1. 適用範圍與聯絡

觀辰 ORI 由 Google Play 開發者「梦荧科技」提供。本政策適用於 ORI 網站、H5 和 Android 應用。聯絡：qiuguanzong@gmail.com。生效日期：2026 年 10 月 12 日。

2. 你提供的資料

• 命盤與問問：稱呼、出生日期、時間、出生地（包括你填寫的座標）、性別、選填背景、排盤結果、問題、回覆和你提交的意見。點選排盤或傳送問題會將相應資料傳至伺服器；不要求裝置定位權限。
• 帳號：帳號名稱、密碼與恢復碼的安全摘要、登入工作階段，以及你主動儲存到帳號的命盤和問答。提供帳號功能不等於所有本機資料自動同步。
• 本機記錄：隨手記、心情、草稿、收藏、語言與外觀設定主要保存在目前裝置。未傳送、未儲存到帳號的本機內容，不會僅因註冊帳號而上傳。
• 運行與安全：請求時間、IP 位址、請求路徑、回應狀態及必要的故障記錄，用於運行服務、限流和排錯。目前 Play 版本未接入廣告 SDK，不收集廣告識別碼。
• 訂單與客服：已有訂單、金額、幣別、付款與退款狀態；你透過電郵提交的聯絡方式和請求內容。我們不要求完整銀行卡號。

錢包建號開放後，你可以選擇用錢包簽名建立帳號，暫不設定密碼。我們會先向你顯示帳號名稱和恢復碼；伺服器只保存恢復碼的安全摘要。請一起保存這兩項，遺失錢包時可用它們設定密碼並找回帳號。出生資料和隨手記不會因建號自動上傳。

3. 問問與服務提供方

• Google Cloud：ORI 應用伺服器部署在新加坡，用於託管、儲存與備份。
• DeepSeek 開放平台：問問生成服務啟用且提問獲受理時，觀辰伺服器才會將問題、必要的出生資料與命盤依據、最近的相關對話（最多 10 則）及會話摘要傳送給 DeepSeek。未啟用第三方生成服務時，按命盤規則答覆；服務不可用時可能返回已標示的命盤摘要。已發出的請求可能繼續由服務商處理，刪除帳號不能撤回該請求。請勿提交身分證件、銀行資料或與問題無關的敏感資訊。你可以不使用問問，繼續查看黃曆等功能。每日一籤使用 DeepSeek 生成且你確認生成時，才會向它傳送命盤日主、日主五行及當天黃曆事實，用於生成中英文短解讀；未啟用時不向它傳送這些資料。此流程不傳送姓名、原始出生日期或時間、錢包地址、提問或筆記。今日籤「問一句」接入 DeepSeek 並開放後，你主動提交的問題、當天籤文及上述必要事實會傳送給 DeepSeek，用於回答這一個問題；不會附帶其他問答記錄、姓名、原始出生資料、錢包地址或筆記。
• Solana 與錢包：支援錢包的版本可選擇關聯錢包公開地址。登入簽名僅驗證地址控制權，不發起交易；ORI 不取得私鑰或助記詞。解除關聯或刪號會刪除 ORI 的帳號關聯，但不能刪除已存在於 Solana 公鏈的地址和交易記錄。我們不會把命盤、提問或隨手記寫入公鏈。你主動查詢 Seeker 資格或領取歡迎禮時，ORI 會向兩家區塊鏈資料服務商傳送已關聯的公開錢包地址，以核對 SGT 持有狀態。SKR 質押查詢開放後，你主動查詢時，ORI 會向兩家資料服務商傳送由已關聯錢包地址派生的公開質押帳戶地址，核對官方池的份額與解除質押狀態。查詢結果不持久儲存為帳號內容。SKR 月度點數開放後，你簽名申請領取時會一併查詢上述 SGT 和質押記錄。簽名僅用於確認本月領取，不會轉帳。這些查詢不傳送出生資料、命盤、提問或隨手記，也不發起交易。

上述處理可能跨越你所在的地區。DeepSeek API 下游使用者資料不適用其消費者聊天產品的同一套政策；我們不承諾服務商零保留或不用於訓練。需要服務商協助的資料請求由我們受理並跟進，服務商副本不因 ORI 刪號而保證同步即時清除。參見 DeepSeek 開放平台條款。

4. 保存期限

• 線上帳號及內容：保存至你刪除帳號或相應命盤。應用內刪除成功後立即移除線上帳號、帳號關聯的錢包地址、已儲存命盤和問答，並使登入工作階段失效。
• 錢包建號與首次設定密碼：待確認請求有效 5 分鐘，含帳號名稱、錢包公開地址、安全摘要和必要的工作階段綁定。過期後不可使用，隨後在新請求、服務啟動或每小時維護時清理。防止重複建號的 IP 摘要與時間只計入最近 1 小時；刪號不會重設這個限額，過期記錄亦由上述清理移除。服務中斷時清理會延後。這些摘要不視作匿名資料。
• 每日一籤：私人結果及每日產生記錄保留最近 7 個香港自然日；每小時維護清理過期記錄，也會在服務啟動及請求產生時清理。刪除或替換命盤會立即移除相關結果；刪除帳號會移除該帳號的結果與產生記錄。籤文顯示後，應用程式可確認並記錄帳號及香港日期，用於顯示本月已看天數與最近 7 日籤曆；該記錄不含具體閱讀時刻。日期記錄保留至當月結束，跨月後僅繼續保留仍在最近 7 個香港自然日內的日期，由相同清理流程移除。刪除或替換命盤不清除這些日期記錄，刪除帳號會一併清除。僅含日期與次數、耗時及已知用量的彙總指標保留 30 個香港自然日，不含正文或個人識別碼。服務中斷時，清理在恢復後執行。
• 今日籤追問：問題、回答、處理狀態、受理時間及帳號當日次數保存最近 7 個香港自然日，由相同的每小時維護及請求清理流程移除。刪除或替換命盤會移除相關問題和回答，但不會重置當天已用次數；刪除帳號會同時移除追問與次數記錄。你提交的問題可能包含個人資料，請只填寫回答所需的內容。
• ORI 專用運行日誌：自記錄產生起最多 14 天，用於安全和故障排查。
• 自動磁碟備份：按 14 天滾動保留，用於故障恢復。線上刪除不會即時改寫歷史備份；恢復時會先重新執行已登記的刪除請求。停用計劃或刪除來源磁碟時，仍需清理其中含 ORI 資料的備份。
• 歷史共用日誌：2026 年 9 月 22–26 日、專用日誌啟用前寫入伺服器共用日誌的 ORI 記錄，安排在 2026 年 10 月 26 日前清理。共用系統日誌採用 30 天保留規則；這不延長新 ORI 專用日誌的 14 天期限。
• 防止帳號被備份恢復：獨立保存帳號識別碼的不可逆摘要和刪除時間，設定為保存 60 天後由雲端儲存自動清理（執行可能有延遲），僅用於核對刪除，不保存帳號名稱、命盤或問答。
• Seeker 歡迎禮：領取時保存活動編號、SGT 唯一編號的摘要、點數、領取時間、回執編號及帳號關聯，用於入帳及防止重複領取。刪除帳號會移除帳號關聯與該帳號的點數明細；活動期間保留不含帳號名稱、錢包地址或簽名的最少領取記錄，活動結束後清理。SGT 摘要仍可能與公開鏈上資料關聯，不作匿名資料處理。
• SKR 月度點數：領取時保存月份、質押門檻、SGT 編號的摘要、點數、領取時間、回執編號及帳號關聯，用於入帳及每月防重。刪除帳號會移除帳號關聯與點數明細；其餘最少回執目前沒有自動到期清理。SGT 摘要可能與公開鏈上記錄關聯，不視為匿名資料。簽名請求包含公開錢包地址及受保護的工作階段綁定，最多 5 分鐘有效，過期後由每小時維護或新請求清理；簽名原文不入庫。核驗事件記錄帳號、固定結果和時間，保留 31 天；刪號時移除該帳號的請求和核驗事件。服務中斷會延後清理。
• 最少帳務記錄：刪號後僅保留訂單號、金額、幣別、交易或退款時間、付款渠道及流水號、結算和退款狀態，用於對帳、退款及帳務留存。自交易完成或退款完成的較晚日期起保留 7 年，到期清理；進行中的退款先保留處理所需的最少資料，完成後起算。不為帳務留存命盤、問答、錢包帳號關聯或整份付款回執。

這些期限適用於 ORI 控制的資料；公鏈記錄無法撤回，服務商獨立副本按其實際處理安排受理刪除。7 年是 ORI 採用的帳務保留規則，並非對所有地區法定期限的說明。

5. 刪除帳號與其他選擇

進入「我的」→「帳戶與安全」（或「帳號與安全」）→「刪除帳戶」（或「刪除帳號」），輸入目前密碼並確認。若帳號有自動續訂，會先確認取消續訂；失敗時會保留帳號並提示重試，不會顯示刪除成功。刪除成功後，會員及帳號權益終止。詳見刪除帳號與資料。

無法登入時，可電郵申請；核實帳號控制權後 30 天內完成並告知結果。請勿傳送密碼或恢復碼。你也可聯絡我們申請查閱、更正或匯出。刪除裝置記錄可在「我的」→「資料與隱私」操作；其他裝置上的未同步記錄需要分別刪除。

6. 安全與更新

我們透過 HTTPS、存取控制和受保護的密碼儲存保護資料。沒有網絡服務能保證絕對安全。資料用途或處理方式發生重要變動時，我們會更新本頁日期與內容；實際開放的付費功能及其渠道以購買頁為準。

7. 自願體驗反饋

體驗反饋開放後，你可自願提交 1–5 星評分及最多 200 字的一句意見，用於改善 ORI。提交前需確認用途。反饋不會自動附上帳號、命盤、出生資料、錢包或頁面內容；你填寫的文字仍可能包含個人資料，請勿填寫敏感資訊。評分與文字只供內部核查，不公開展示，也不傳送給 DeepSeek。

內容保留 30 天，到期後不再顯示，並於下一個五分鐘維護週期清理；停機時在恢復後處理，關閉收集也會繼續清理。你可在同一裝置的反饋頁撤回。撤回後立即清空內容，只保留防止遲到請求重複寫入的憑據摘要至原期限。明文撤回憑據只保存在本機，30 天後失效；清除瀏覽器資料後無法透過帳號找回。刪除帳號不會自動定位這份獨立反饋，請先在原裝置撤回。服務日誌及備份仍按本政策相應期限處理。

8. 產品使用統計

使用統計開放後，兼容版本會在已登入時記錄前台使用、開啟羅盤、查看提醒設定、確認開啟提醒、開啟公開分享及邀請入口。記錄包含帳號識別碼、固定動作名稱、香港日期、接收時間及去重識別碼，不記錄出生資料、簽文、問題、筆記、錢包位址或裝置廣告識別碼。用途是找出操作問題、衡量回訪及改善產品，不用於廣告追蹤。

帳號關聯的使用記錄最多保留 35 個香港自然日，刪除帳號時一併刪除。關閉採集後仍於每小時維護或服務啟動時清理到期記錄，停機時在恢復後執行。內部頁面及匯出的每日快照只含匯總，排除已明確設定的團隊測試帳號，不含逐條行為或帳號清單。訪客及未接入的舊版本不算作已觀測使用者，未完整觀測的時段不會冒充零。

9. 可選的 .skr 邀請

開放後，你可填寫對方的 .skr 網域名稱產生合盤邀請。伺服器將網域推導出的公開鏈上帳戶地址交給兩家資料服務商，核對目前持有人；查詢不附上你的帳號、出生資料、命盤、問題或筆記。網域並非 Seeker 資格或 ORI 註冊證明，頁面不會告訴你對方是否擁有 ORI 帳號。你仍可複製連結自行分享。

為處理重試及收件，我們保存傳送帳號、請求識別碼、網域與用途的摘要、邀請憑據及建立和到期時間，不保存明文網域。摘要仍可能透過公開網域推測，不視為匿名資料。能配對目前關聯錢包時，收件項目亦包含收件帳號及公開錢包地址，清單不顯示傳送人的身分或出生資料。輔助請求記錄及收件項目有效期最長 30 天，到期即無法存取，並於建立新邀請、服務啟動或每小時維護時清理；關閉功能仍會清理，停機時恢復後執行。已完成的收件項目亦於同樣維護中移除。

解除錢包關聯、找回帳號或刪除帳號會移除相應收件關聯；刪除傳送帳號會刪除其請求記錄。移除收件項目不會撤銷已分享的普通連結，任何持有有效連結的人仍可按合盤頁說明使用。普通邀請沿用原有到期及一次完成規則；為限制頻繁查詢，另保存帳號限流摘要、次數及一小時到期時間；到期後不再計數，並於後續限流請求中清理。產生或投遞邀請不會發放點數；完成合盤後的邀請獎勵沿用應用當時開放的規則及上限。本功能不發起鏈上交易。日誌及備份按本政策各自期限處理。

10. 自願訓練包內測日誌

訓練包內測開放後，你可以自行選擇或輸入命例，並自願同意將本輪命例、問題、模型原答、生成與規則核對回執、人工預期及主動提交的反饋保存在 ORI 後台，用於內部核查及後續訓練資料準備。頁面說明用途後才收集，不會因開啟頁面、選擇命盤或修改草稿而自動上傳訓練日誌。每次提交反饋會新增版本記錄；使用者意見及程式一致性不直接作為專家真值。此功能保存候選資料，不會自動開始模型訓練，亦不公開展示命例。

日誌自首次記錄起最多保存 180 天，後續運行或反饋不延長原期限；到期後無法存取，並於服務啟動、請求及定時維護時清理，停機時在恢復後執行。你可在內測頁匯出或撤回相應記錄，撤回成功後從線上資料庫刪除。已關聯帳號的內測日誌隨帳號刪除一併移除；訪客憑據只供目前瀏覽器讀取及撤回，清除瀏覽器資料後可能無法再憑原裝置定位記錄，可聯絡我們申請協助。備份仍按第 4 節的 14 天滾動期限保留。帳號刪除沿用已登記的恢復刪除機制；訪客撤回目前刪除線上記錄，不保證即時移除歷史備份中的副本。恢復舊備份時須核對並處理已撤回及到期記錄。

模型生成僅在你主動點選並同意後，將必要的命盤曆法事實及問題傳送給 DeepSeek；人工預期及反饋不附入生成請求。內部訓練候選匯出會去除直接帳號識別碼、存取憑據、姓名及原始出生定位欄位，保留必要四柱、節令、問題、原答、出處及反饋。自由文字仍可能含個人資料，匯出不視為匿名資料，須人工篩選及處理後再用於訓練。請只提交有權使用的命例，避免身分證件、銀行資料及無關敏感資訊。

1. Scope and contact

ORI (观辰 / 觀辰) is provided by the Google Play developer “梦荧科技”. This policy covers the ORI website, H5 and Android app. Contact: qiuguanzong@gmail.com. Effective: 12 October 2026.

2. Data you provide

• Charts and Ask: your chosen name, birth date, time and place (including coordinates you enter), gender, optional background, chart results, questions, replies and feedback. Creating a chart or sending a question sends the relevant data to our server. Device location permission is not required.
• Account: username, protected password and recovery-code digests, login sessions, and charts and conversations you choose to save. Creating an account does not automatically sync all local data.
• Local records: journal entries, mood, drafts, bookmarks, language and appearance mainly stay on the current device. Unsent, unsaved local content is not uploaded merely because you register.
• Operation and security: request time, IP address, request path, response status and necessary error records, used to run, protect and troubleshoot the service. The current Play build includes no advertising SDK and does not collect advertising identifiers.
• Orders and support: existing orders, amounts, currencies, payment and refund status, and contact details and requests you send by email. We do not ask for full payment card numbers.

When wallet signup is available, you can choose to create an account with a wallet signature without setting a password. Your username and recovery code are shown first; the server stores only a protected digest of the code. Save both together so you can set a password and recover the account if you lose the wallet. Signing up does not upload birth details or journal entries.

3. Ask and service providers

• Google Cloud: ORI application servers are hosted in Singapore for hosting, storage and backups.
• DeepSeek Open Platform: When Ask generation is enabled and a question is accepted, ORI’s server sends the question, necessary birth details and chart evidence, recent relevant conversation (up to 10 messages) and a conversation summary to DeepSeek. When third-party generation is disabled, it replies using chart rules; if unavailable, a reply labelled as a chart summary may be returned. A dispatched request may continue to be processed by the provider; deleting your account cannot withdraw it. Please do not submit identity documents, bank details or unrelated sensitive information. You can use the almanac and other features without using Ask. When DeepSeek generation for Daily reading is enabled and you confirm it, the server sends only your chart’s day master, its element and that day’s almanac facts to DeepSeek for a short Chinese and English reading; when it is disabled, those facts are not sent to DeepSeek. This flow does not send your name, original birth date or time, wallet address, questions or journal. If the daily-reading followup becomes available with DeepSeek, submitting a question sends that question, today’s reading and the necessary facts above to DeepSeek to answer it. Other conversation history, your name, original birth details, wallet address and journal are not attached.
• Solana and wallets: supported builds offer optional wallet linking. A sign-in signature proves control of an address without initiating a transaction. ORI does not obtain private keys or seed phrases. Unlinking or account deletion removes ORI’s account link, but cannot erase addresses or transactions already on the public Solana ledger. We do not write charts, questions or journals to the blockchain. When you choose to check Seeker eligibility or claim a welcome gift, ORI sends your linked public wallet address to two blockchain data providers to check SGT ownership. When SKR staking checks are available and you request one, ORI sends the public staking account address derived from your linked wallet to two data providers to check shares and unstaking status in the official pool. Results are not stored as account content. When monthly SKR credits are available, signing a claim also requests both the SGT and staking checks above. The signature confirms a claim for that month without transferring funds. These lookups do not send birth details, charts, questions or journals, and do not initiate transactions.

Processing may occur outside your location. DeepSeek’s consumer-chat privacy policy does not cover downstream API end-user data. We do not promise zero provider retention or that provider data is excluded from training. We handle and follow up requests requiring a provider’s assistance; deletion from ORI does not guarantee immediate deletion of a provider’s separate copies. See the DeepSeek Open Platform terms.

4. Retention

• Online account and content: until you delete the account or relevant chart. Successful in-app deletion immediately removes the online account, linked wallet address, saved chart and conversations, and invalidates login sessions.
• Wallet signup and first password: pending requests expire after 5 minutes and contain the username, public wallet address, protected digests and necessary session binding. Expired requests cannot be used and are removed during new requests, service startup or hourly maintenance. An IP-address digest and time count toward signup limits for only the latest hour; deleting an account does not reset this limit. Expired records are removed by the same cleanup. Cleanup may be delayed during an outage. These digests are not treated as anonymous data.
• Daily reading: private readings and daily generation records cover the latest 7 Hong Kong calendar days. Hourly maintenance removes expired records, as do service startup and generation requests. Deleting or replacing a chart immediately removes its readings; account deletion removes that account’s readings and generation records. After a reading is displayed, the app may confirm its display and record your account and the Hong Kong date to show this month’s reading days and the latest 7-day reading calendar; this record has no precise reading time. Dates are kept through the end of their month and, across a month boundary, while still within the latest 7 Hong Kong calendar days, then removed by the same cleanup process. Deleting or replacing a chart does not remove these dates; deleting your account does. Aggregates containing only dates, counts, duration and reported usage are kept for 30 Hong Kong calendar days, without reading text or personal identifiers. If the service is interrupted, cleanup resumes after recovery.
• Daily-reading followups: questions, answers, processing status, acceptance time and your account’s daily usage counts are kept for the latest 7 Hong Kong calendar days, then removed by the same hourly maintenance and request cleanup. Deleting or replacing a chart removes the related questions and answers without resetting that day’s used allowance. Account deletion removes both followups and usage counts. A question you submit may itself contain personal information; include only what the answer needs.
• Dedicated ORI operational logs: up to 14 days from creation, for security and troubleshooting.
• Automatic disk backups: a rolling 14-day schedule for disaster recovery. Online deletion does not immediately rewrite old backups. Registered deletion requests are reapplied before a restored service becomes available. Backups containing ORI data still need to be removed if the schedule stops or the source disk is deleted.
• Historical shared logs: ORI records written to shared server logs on 22–26 September 2026, before dedicated logging began, are scheduled for removal by 26 October 2026. Shared system logs follow a 30-day rule; this does not extend the 14-day limit for new dedicated ORI logs.
• Protection against restored accounts: an irreversible account-identifier digest and deletion time are kept separately under a cloud-storage policy that automatically deletes them after 60 days (execution may be delayed), solely to enforce deletion after recovery. They contain no username, chart or conversation.
• Seeker welcome gift: a claim stores the campaign identifier, a digest of the SGT mint identifier, credits, claim time, receipt identifier and account link to award credits and prevent duplicate claims. Account deletion removes the account link and its credit history. A minimal claim record without a username, wallet address or signature remains while the campaign runs and is removed when the campaign ends. The SGT digest may still be linked to public blockchain data and is not treated as anonymous.
• Monthly SKR credits: claims record the month, stake threshold, a digest of the SGT mint identifier, credits, claim time, receipt identifier and account link, to award credits and prevent repeated monthly claims. Account deletion removes the account link and credit history; the remaining minimal receipts currently have no automatic expiry. SGT digests may be linked to public blockchain records and are not treated as anonymous. A signature request contains the public wallet address and protected session binding. It expires within 5 minutes and is then removed during hourly maintenance or new requests; signed message text is not stored. Verification events contain the account, a fixed result and time, and are kept for 31 days. Account deletion removes its requests and verification events. Cleanup may be delayed during an outage.
• Minimal accounting records: after deletion, only order ID, amount, currency, transaction or refund time, payment channel and transaction ID, settlement and refund status remain for reconciliation, refunds and accounting records. These are kept for 7 years from the later of transaction completion or refund completion, then removed. A pending refund retains only the details needed to process it; the period starts when completed. Charts, conversations, linked wallet identity and full payment receipts are not retained for accounting.

These periods apply to data controlled by ORI. Public ledger records cannot be withdrawn; requests for providers’ separate copies follow their actual processing arrangements. Seven years is ORI’s accounting retention rule, not a statement of the statutory period in every jurisdiction.

5. Deletion and your choices

Open You → Account & security → Delete account, enter your current password and confirm. Any auto-renewal must be confirmed cancelled first; if cancellation fails, the account remains and you can retry. A failure is not shown as successful deletion. Successful deletion ends associated account and membership access. See the account and data deletion guide.

If you cannot sign in, email us. We complete the request and notify you within 30 days after verifying account control. Do not send passwords or recovery codes. You may also request access, correction or export. Use You → Data & privacy for local records, and delete unsynced records separately on other devices.

6. Security and updates

We use HTTPS, access controls and protected password storage. No online service guarantees absolute security. Material changes will be reflected in this page and its date. Purchase screens identify the paid features and channels that are actually available.

7. Voluntary experience feedback

When available, you may submit a rating from one to five and an optional thought of up to 200 characters to help improve ORI. You confirm this purpose before sending. Account, chart, birth, wallet and page details are not attached automatically. Your own text can still contain personal information; please leave out sensitive details. Ratings and text are for internal review, are not published and are not sent to DeepSeek.

Content is kept for 30 days, then hidden from results and removed during the next five-minute maintenance cycle. Cleanup resumes after outages and continues when collection is disabled. You can withdraw feedback on the same device. Withdrawal clears its content immediately and retains only receipt digests until the original expiry to prevent delayed duplicate writes. The plain withdrawal receipt stays on your device and expires after 30 days. It cannot be recovered through your account after browser data is cleared. Deleting an account cannot locate this independent feedback; withdraw it on the original device first. Service logs and backups follow their separate retention periods in this policy.

8. Product usage measurement

When measurement is enabled, compatible versions report signed-in foreground use, compass opens, reminder-settings visits, confirmed reminder enabling, and public-share or invitation openings. Records contain the account identifier, a fixed action name, Hong Kong date, receipt time and deduplication identifier. They do not contain birth details, readings, questions, notes, wallet addresses or advertising identifiers. We use them to find usability issues, understand return visits and improve the product, not for advertising tracking.

Account-linked usage records are kept for at most 35 Hong Kong calendar dates and removed when the account is deleted. Hourly maintenance and service startup remove expired records even after collection is disabled; cleanup resumes after outages. Internal reports and daily exports contain aggregates only and exclude explicitly configured team test accounts. They do not export account lists or individual actions. Guests and older versions without this reporting are outside the observed population. Incomplete observation periods are not reported as zero.

9. Optional .skr invitations

When available, you can enter someone's .skr domain to create a compatibility invitation. The server sends the derived public blockchain account addresses to two data providers to check the current holder. The lookup does not attach your ORI account, birth details, chart, questions or notes. A domain does not prove Seeker eligibility or ORI registration, and the page does not reveal whether the recipient has an ORI account. You can still copy and share the link yourself.

To handle retries and inbox delivery, we retain the sender account, request identifier, a digest of the domain and purpose, invitation receipt, and creation and expiry times. The plain domain is not stored. The digest may be guessed from public domains and is not treated as anonymous. If a currently linked wallet matches, the inbox entry also contains the recipient account and public wallet address; the list does not disclose the sender's identity or birth details. Auxiliary request records and inbox entries expire within 30 days and are no longer accessible after expiry. They are removed on new invitations, service startup or hourly maintenance, including when the feature is disabled; cleanup resumes after outages. Completed inbox entries are removed during the same maintenance.

Unlinking a wallet, account recovery or account deletion removes the relevant inbox associations. Deleting the sender account removes its request records. Dismissing an inbox item does not revoke a shared ordinary link: anyone holding a valid link may still use it under the compatibility page's terms. Ordinary invitations keep their existing expiry and single-completion rules. To limit repeated lookups, we also retain a digest of the account-based rate-limit key, a count and a one-hour expiry. Expired entries no longer count and are removed by later rate-limited requests. Creating or delivering an invitation does not grant credits. Any reward for completing a reading follows the invitation reward settings and limits then enabled in the app. This feature does not initiate blockchain transactions. Logs and backups follow their separate retention periods above.

10. Voluntary training-beta logs

When the training beta is available, you can choose or enter a chart and voluntarily agree to retain that case, questions, original model replies, generation and rule-check receipts, your expectations and actively submitted feedback in ORI’s backend for internal review and preparation of future training material. Collection follows the purpose notice. Opening the page, selecting a chart or editing a draft does not automatically upload a training log. Each feedback submission adds a version to its history. User opinions and agreement with a program are not automatically expert ground truth. This feature retains candidate material, does not automatically start model training, and does not publish cases.

Logs are kept for at most 180 days from the first record. Later runs or feedback do not extend that deadline. Expired records cannot be accessed and are removed during service startup, requests and scheduled maintenance; cleanup resumes after outages. You can export or withdraw the relevant record from the beta page. Successful withdrawal removes it from the live database. Account-linked beta logs are removed with the account. Guest receipts allow access and withdrawal from the current browser; after clearing browser data, you may no longer be able to locate the record from that device. Contact us for assistance. Backups follow the rolling 14-day period in section 4. Account deletion follows the existing registered restoration-erasure process. Guest withdrawal currently removes live records and does not guarantee immediate removal from historical backup copies. Restoring an older backup requires checking and handling withdrawn and expired records.

Only when you actively click and consent to model generation are the necessary calendar facts and question sent to DeepSeek. Your expectations and feedback are not attached to that generation request. Internal training-candidate exports exclude direct account identifiers, access credentials, names and original birth-location fields, while retaining necessary pillars, seasonal facts, questions, original replies, sources and feedback. Free text can still contain personal information; an export is not treated as anonymous and requires human screening and processing before training use. Submit only cases you are entitled to use, and leave out identity documents, banking details and unrelated sensitive information.