Legal

Privacy policy

This site collects as little as we can get away with, and stores most of what it needs on your own device rather than a server. Below is everything that moves, where it goes, and the one exception we want you to actually read.

Last updated: October 7, 2026

The short version

• Your birth details are stored in your browser only — never on a server.
• The model that writes your reading receives a chart, not your birth data.
• Your IP address is hashed before it is stored, and only to prevent abuse.
• No account, no tracking cookies, no analytics, no ads.
• One thing to actually read: the reading is generated by an AI provider, and under free-tier terms some providers may use requests to improve their models. Details in Who processes data.

Who we are

Still and Deep — an independent project operating this website. For the purposes of applicable data-protection law, the project is the controller of the data described on this page.

What we collect

Your birth details

• Sent to our server to compute the chart — the calculation needs the date, time and city — and not stored. There is no user database and no birth-data table anywhere.
• Kept in your browser’s local storage afterwards, so returning does not mean retyping them. The reading is cached there too.
• “Forget my details” at the bottom of your chart erases all of it immediately, as does clearing your browser storage. You do not need our help to delete it, because we never had a copy.

What the language model receives

• A short structured description of the finished chart: the four pillars, the day master, the element distribution.
• It receives nothing else — not your birth date, time, city, or any text you did not type into the chart form.

Your IP address

• Collected to enforce rate limits and prevent abuse (a small number of free AI calls can be exhausted otherwise).
• Stored only as a salted hash — a one-way fingerprint, not the address itself. We cannot and do not attempt to reverse it back to you, and it is not linked to any account, because there are no accounts.
• The hash and its rate counters expire automatically within days.

Technical logs

• Request timestamps, endpoint names, and token counts for cost accounting. No birth data, no chart content, no browsing history.

What we do not collect

• No accounts — no name, email, or password is ever requested.
• No tracking or advertising cookies.
• No analytics or ad SDKs — nothing on this site reports your behaviour to a third party.
• No payment information — the site is currently free, and if that ever changes, payments will be handled by a processor disclosed here first.

Who processes data

We use three processors. None of them receives your birth details as-is; what each one sees is listed.

• Vercel Inc. (United States) — hosts the site and runs the API. Sees standard platform request metadata, as any web host does.
• Upstash Inc. (United States) — operates the rate-limiting store. Sees salted IP hashes and usage counters. Nothing else.
• OpenRouter and upstream AI providers (United States) — generate the reading text. They receive the structured chart description described above, and nothing about you.
  
  The part worth reading: the current model is used under a free tier, and some free-tier providers reserve the right to use request content to improve their models under their own terms. What they would receive is a chart, not birth data or anything identifying — but if you are not comfortable with that, skip the AI reading; the chart itself is computed and displayed without any AI involvement. If we move to a provider without that clause, this page will say so.

Why we process this (legal bases)

• Performance of a contract — computing the chart and generating the reading you asked for.
• Legitimate interests — rate limiting and abuse prevention, to keep the free service available at all.

International transfers

The site is operated worldwide, and all three processors process data in the United States. Where data comes from the UK, EU, or elsewhere, transfers rely on the processors’ recognised transfer frameworks (such as the EU Standard Contractual Clauses, which all three publish on their sites).

How long data is kept

• Birth details and cached readings: in your browser, until you erase them. We keep no copy.
• Salted IP hashes and rate counters: automatically within days.
• Platform logs: per each provider’s default retention.

Your rights

Depending on where you live, you have rights of access, correction, deletion, portability, and objection — under the EU/UK GDPR, and under the California CCPA (which includes the right to know, delete, and opt out of any sale of personal information). Two honest notes:

• We do not sell or share personal information with anyone, for money or otherwise.
• Because we store almost nothing, most of these rights are effectively satisfied by the design: your data is already on your device, and erasing it takes one click. For anything else, write to the address below and we will answer.

Children

This site is not directed at children under 13 (or under 16 in the EU/UK), and we do not knowingly collect data from them. There is no registration to age-check against, so if a minor uses the site, the data never leaves their own browser.

Changes to this policy

If what we collect ever changes, this page changes with it, and the date at the top moves. Material changes will be flagged on the home page for a reasonable period.