1. Who is responsible
Field of Change is operated by hasamijimmychafferer. Contact us about privacy or your information at hasami0113@outlook.com.
This policy covers the website, its account journal, and report-credit purchases. An unavailable sign-in or payment method does not send information to that provider.
2. What we collect and why
Readings and learning notes. When you reveal an I Ching reading, we store the question, six lines, result-access status, and creation time on the website’s server—even if you do not write a reflection. It appears automatically in your reading history. We also store reflections and learning notes you choose to save, including their titles, source references, and update times. These records let you revisit and learn from your practice. Please avoid including sensitive health, financial, identity-document, or third-party information.
Tarot reflections. Drawing tarot cards stores your optional question, selected spread, drawn cards and orientations, chosen deck positions (for interactive draws), the generated editorial reading and its version, creation time, and any reflection you save. These appear automatically in your private journal and are included in export and deletion. Guest tarot readings move to your account with the disclosed browser-journal sign-in choice. Editorial card readings use our English library without sending a question for AI interpretation.
Interactive tarot decks. Shuffling prepares a private, server-side deck linked to your current journal, with a 30-minute drawing window. Your question is not submitted until you choose to turn over your cards. The unfinished deck is removed when a reading is saved, when replaced by another shuffle, or when its journal owner is deleted or transferred at sign-in. Expired unfinished decks become unusable immediately and are removed in bounded cleanup batches as new decks are prepared. Unfinished selections do not sync between devices; completed readings follow the journal controls above.
Optional tarot AI. Only when you expressly agree and select “Add an AI interpretation” do we send that reading’s question, spread, card identities and orientations to Cloudflare Workers AI. Our English card meanings are supplied as interpretation context. We do not send your email, account identifier, private notes, other readings or birth details. The resulting interpretation, model, consent-policy version and generation time are saved with the reading and included in export and deletion. We retain short-lived request counters to limit abuse and cost. We do not intentionally log prompts or responses, use AI Gateway prompt logging, or create a separate prompt archive. Cloudflare processes requests on its infrastructure; its Workers AI data policy states that customer content is not used to train models without explicit consent. This is not a guarantee that no provider technical metadata exists. You can use editorial readings without using AI.
Account information. We use the sign-in provider’s verified identifier to associate records with your account. We may receive your email address and display name. We do not collect your email or Google password in this website. The sign-in service handles credentials and account recovery. Using different sign-in identities can create separate accounts; we do not merge them simply because their email addresses match.
Before sign-in, “Add this browser’s readings and learning notes to my account” is selected by default. If you leave it selected and complete sign-in, we move that browser journal into your verified account automatically. Uncheck it on a shared device or if those records are not yours. Without sign-in, records remain linked to the guest browser cookie. You can also import your own browser journal later from Account.
Complimentary VIP membership. If the site owner grants you access, we store your account ID, membership start and expiry times, revocation status, and a history of membership changes with the operator’s account identifier. The owner can look up the exact account ID you provide and view its display name, email, and membership status; VIP controls do not expose journal content. Your current membership is included in your account export. Membership and its change history are removed from the active database when your account is deleted. VIP grants no access to other members’ records.
Purchases. We store your account’s order reference, chosen package, amount and currency, payment and refund status, Stripe transaction references, accepted purchase-terms version, and report-credit redemptions. These records deliver your purchase, prevent duplicate credits, resolve payment problems, and support necessary accounting. Stripe handles card details; we do not receive your full card number or security code. We do not send your reading question, birth details, or journal notes to Stripe.
Essential technical information. Cookies identify a guest journal or signed-in session. Our hosting and identity providers may process IP addresses, browser information, request metadata, and security logs to deliver and protect the service. The application does not intentionally log journal content or authentication tokens.
BaZi. The current calculator processes birth date, time, and time-zone choices in your browser. It does not submit or save them to your account or our database. Downloaded charts remain on your device. If you copy birth details into a saved journal note, that note is stored like any other journal entry.
If you separately choose to keep a BaZi report while signed in, we store its four derived stem/branch pairs, calculation-method and report versions, creation time and report-access status in your private account. A derived chart can still reveal information about birth timing and is not anonymous. The birth date, time, birthplace and time-zone form fields are not submitted with it. You can download or delete saved BaZi reports in My journal, and they are included in account export and deletion.
3. Cookies and browser storage
The essential guest cookie lasts up to one year and links this browser to its server-side records. Clearing that cookie does not delete the records; it can make them inaccessible. A signed-in session, when available, lasts up to seven days unless you sign out or delete the account. A short-lived sign-in cookie protects the redirect process. These are access and security cookies, not advertising cookies.
A draft I Ching question may stay in this tab’s session storage until the reading is created or the browser tab’s session ends. Downloaded exports are files you control. We do not use browser storage as the permanent journal database.
4. Who can receive information
We do not sell your personal information, publish private entries, or use them for targeted advertising. Authorized operators and service providers may access information when necessary to operate, support, or secure the service, or respond to a valid legal obligation. This is not an end-to-end encrypted diary.
The local preview stores its application database on the operator’s Mac. The public website uses OpenAI Sites and Cloudflare infrastructure. Auth0 processes sign-in information. Google also processes information when you choose Google sign-in. The application does not send your reading text or learning notes to a sign-in provider. Stripe processes checkout and payment information when you choose to purchase. These services may process information in countries outside your residence, including the United States, under their applicable service and data-protection terms. Contact us with questions about service providers or international processing.
If you use an assistant-enabled browser, the reading page offers tools that the assistant can invoke to read the visible casting state or prepare a question. That includes your visible question. No assistant request is made automatically by those tools. Use them only if you want to share that context with your chosen assistant service.
Live checkout charges the one-time amount you approve on Stripe. No ad network or rewarded-ad service is connected. We will update this notice and implement any required choices before introducing advertising. Payment never gives an advertiser access to your journal.
5. Your controls and retention
Use My journal to edit or delete individual notes and readings, including unsaved readings. Use Account & privacy to export all records associated with the current account or guest journal, including unsaved readings, or delete those website records. Account deletion also revokes its website sessions and removes access to unused report credits. Resolve open checkouts and contact us about unused credits first. It does not delete your Google or identity-provider account; contact us about provider-side identity deletion.
Records stay in the active database until you delete them or ask us to remove them, subject to any applicable legal retention obligation. Deletion removes them from the active application database. Minimal purchase records are detached from the deleted account and retained for payment reconciliation, dispute handling, fraud prevention, and applicable legal obligations. Stripe retains its own transaction records under its policies. Copies of other records may remain in operator backups or provider recovery systems until those copies expire. If a backup is restored, deletion requests must be reapplied. Contact us for retention details or a request concerning those copies.
On a shared device, sign out and remove any downloaded exports yourself. Only bring a guest journal into an account if those records belong to you. If you lose access to a guest cookie, we may be unable to identify its records safely. Never email us passwords, sign-in codes, or session cookies.
6. Safeguards and their limits
The application checks record ownership on server requests, uses parameterized database queries, protects state-changing requests against cross-site submission, and restricts access cookies from page scripts. Live account sign-in requires HTTPS; the development preview may use HTTP on localhost. Hosting services provide their own infrastructure safeguards. The local database is not encrypted by this application.
No website can guarantee that a breach or unauthorized disclosure will never happen. We aim to minimize collection and access, investigate security incidents, and make notifications where required. Please contact us promptly if something appears wrong.
7. Privacy requests and applicable rights
Depending on your location, you may have rights to access, correct, erase, or obtain a copy of your data, restrict processing, object to processing, or complain to your local privacy regulator. Contact hasami0113@outlook.com; we may need to verify your identity before responding.
We use requested account and journal information to provide the service, and essential technical data to secure it. Where a consent-based optional feature is introduced, you will be told how to withdraw consent. We use purchase records to fulfill your order, manage payment disputes, and meet applicable legal obligations.
The site offers reflective, educational material, not automated decisions with legal or similarly significant effects. You can explore its public learning material without creating an account. The service is not intended for children.
8. Changes to this policy
We will update the date on this page when this notice changes, and provide additional notice for material changes when appropriate. Questions are welcome at hasami0113@outlook.com.