Privacy Policy

Kanmin is operated under the KanminLabs business name. The privacy contact is support@kanminlabs.ai. This policy describes how we handle personal information across our website, mobile applications, support, and subscriptions.

Account information: name, email address, account identifier, sign-in method, profile image, login-security information, and your separate AI-data permission choice, including its version, named provider, acceptance or withdrawal time and Web or mobile source.

Reading information: birth date and time, gender selection, birth or current location, coordinates, relationship type, another person’s details that you are authorized to submit, questions, the time of each saved question or cast, calculated chart data, chat history, previews, separately requested Personality, Career, Relationship, and Annual reports, and saved results. For signed-in users, explicit first-person statements may be saved as unconfirmed Memory candidates for your review.

Billing and usage information: subscription and payment status, transaction references, purchased-credit balance and activity, and free-use counters. We also collect limited device, request, security, error, and—only with your permission—aggregate product-usage information. Card details are handled by Stripe; we do not receive or store full card numbers.

Cookies and device storage: we use strictly necessary cookies and local storage to keep you signed in, remember your language, theme, and analytics choice, and let guests keep their latest cast on their own device. Optional analytics cookies are set only after you allow analytics. We do not use advertising cookies.

Native workspace storage: the app also keeps birth profiles (including names, birth times and places), divination chart sessions and manual casts, professional-chart caches, and Timing briefs containing questions and birth details as plain text on this device. Signed-in data is scoped to an account; other accounts cannot open it through the app. These workspace copies are not removed on sign-out and have no general automatic expiry. They remain until overwritten, cleared through the relevant workspace where available, or removed by clearing the app's storage. Guest birth profiles and Timing briefs share one guest area on this installation: they have no automatic expiry, are not cleared by signing in, and may reappear for the next signed-out user. These guest copies are not isolated between people sharing a device. Account deletion does not remove these workspace copies. Clear app storage in Android settings, or delete the app on iOS (offloading retains its data), to remove remaining copies. This local persistence is separate from saved server history.

Native tool-chat cache: questions, answers and original retry identifiers are cached as plain text for the signed-in account and chart context. Entries expire 30 days after the transcript changes; opening a transcript does not extend that period. Expired entries are removed when the local cache next activates or the entry is read. Signing out or changing accounts removes the previous account's tool-chat cache. If storage cleanup fails, the app disables cache access until cleanup succeeds; device-level clearing can remove remaining copies. This does not delete saved server history.

Psychic opening cache: when personal openings are enabled, we keep the opening text, language, profile identifier and revision, local date, time zone, participating systems, issue and expiry times, and a signed provenance token on this device so the same welcome can be restored. An account identifier scopes the cache. The token contains readable encoded metadata, including account and content hashes, profile information, and policy and rule versions; its signature protects integrity, not confidentiality. This cache is plain text protected by your device and browser, separate from saved server conversations. Expired openings are not reused and old entries are replaced when a new opening is cached; signing out or switching accounts clears the previous account's opening cache. Verified opening text may become conversation context when you send the first question.

Psychic request recovery on your device: before sending a question, we store its text, original answer language, time zone, conversation and request identifiers, and any included opening text and token in this browser's local storage or the app's device storage. This lets you check or retry the same unconfirmed request after a connection loss. These local records are stored as plain text, are not encrypted by the app, and depend on your device and browser's access protections. They are separate from saved conversation history on our servers.

Compatibility request recovery: before generating an analysis, we keep one unresolved request in this browser or app, scoped to your account or guest session and service address. It contains both people's submitted birth profiles (including names, birth dates/times, places, coordinates and time zones), relationship and participant roles, answer language and systems, request identifier, creation and replay limits, whether the answer request was sent, and the exact submitted question, calculated chart context and verification token. It is stored as plain text so the original request can be recovered rather than silently creating another paid request. Signed-in records can survive reloads and restarts; guest records have the shorter session lifetime described below.

AI quality and safety reports: if you report an output, we collect the selected reason and an optional short note after automated contact-detail redaction. We retain only limited references and generation information needed to review the report—not the question, birth data, chart context, or complete AI output.

We use information to authenticate accounts, calculate and generate readings, answer questions, save history, synchronize subscriptions, provide support, prevent fraud and abuse, troubleshoot, maintain security, meet legal and accounting duties, and enforce our terms.

If required information is not provided, the relevant chart, account, saved-history, location, or payment feature may not work. Optional fields can be left blank where the interface allows.

Long-term Memory is consent-based and is available only when that feature is enabled. AI predictions and prior assistant answers are not treated as user facts. A candidate is excluded from AI context until you explicitly confirm it. Where Memory controls are available, you can deny, correct, or withdraw facts there; otherwise contact support@kanminlabs.ai for help. Withdrawn and superseded records are retained only for integrity and are not supplied to AI.

When we improve the service, we use only aggregate product analytics that you have allowed and minimized reliability, security, abuse-prevention, and safety records. We do not use private birth details, precise locations, questions, chats, readings, or saved reports to train general-purpose AI models. With your separate AI-data permission, information needed to answer an AI request is sent to OpenAI to provide that request, as described below.

We use service providers for hosting and data storage, sign-in and account functions, location search, payments, AI processing, mobile-app delivery, reliability and security monitoring, and email or customer support. The providers you see or choose are named: sign-in is offered by email and password or through Apple and Google, web payments are processed by Stripe, and optional analytics, only if you allow it, is sent to Google Analytics 4 and PostHog. Each provider receives only the information reasonably needed to perform its function and is subject to contractual and privacy obligations.

OpenAI processes the information needed for AI reports, conversations and personalized Psychic openings: your question, relevant conversation and confirmed Memory context, submitted birth details and locations, and calculated chart or timing data. Before your first new AI request, we ask you separately to allow this sharing and name OpenAI. Accepting terms, signing in or allowing analytics does not grant this permission. If you decline, no new AI request is sent and no allowance or Credits are used for it; technical charts and casts remain available. You can withdraw permission in Account to stop future AI requests across your devices. Withdrawal cannot recall data already sent or cancel a request already underway; saved answers and existing-request recovery remain available. Provider information is available at https://openai.com/policies/privacy-policy/.

Optional product analytics is off by default: no analytics event is collected or sent to Google Analytics 4 or PostHog unless you choose Allow analytics. You may later change or withdraw that choice through Anonymous analytics settings on the Account page. We do not include birth details, precise locations, names, email addresses, account or payment identifiers, questions, chats, readings, report text, or URL query strings in analytics events. We do not record your screen or session. Error and reliability monitoring is provided separately by Sentry, which receives only minimized diagnostic information.

Because these providers and their subprocessors operate internationally, information may be processed outside Australia, including in the United States and other locations used by our providers and their subprocessors. Those locations can change. We assess available provider safeguards and take reasonable steps required by applicable law for overseas disclosures.

We may also disclose information where required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards. We do not sell personal information.

Account profiles, saved charts, saved questions and casts, chat history, and Memory records are retained while the account remains active or until deletion is requested. Guests may keep their latest cast and one unresolved Compatibility recovery record on their device; temporary server result copies are described below. Providers may retain limited security logs under their policies.

For a signed-in natal reading, we may keep a temporary copy of the completed result for up to 31 days so that it can be recovered after a connection failure, saved if you choose, and not charged twice. The copy expires automatically, is separate from results you choose to save, and is deleted sooner when account deletion completes.

For Divination, Compatibility and Psychic, completed answers may also be kept in a temporary server copy with a seven-day recovery period, including guest requests where available. This prevents duplicate charges when a response is lost. Expired copies are eligible for automatic cleanup in the scheduled daily sweep; cleanup delays can extend physical retention beyond seven days. Deleting the associated saved Case or Psychic conversation clears its recoverable answer copy; account deletion clears linked private content. Minimal billing and anti-duplication records may remain without the answer text.

Device recovery records remain until the app confirms the request's answer or settled failure, confirms deletion of its conversation, or clears the previous account's records on sign-out, account switching or account recreation. After six days, the app stops resending that record but keeps it available for checking a saved answer. Stopping the wait or starting a new conversation does not erase the unresolved record. You can explicitly discard unreadable local records while keeping readable recovery records, or remove local copies by clearing the site's or app's storage. Removing a local copy does not cancel server work, delete server history or confirm restored allowance. If device storage cannot be read or written, sending is paused while saved server conversations remain available.

Compatibility recovery is removed after a confirmed answer or settled failure, or when signing out or switching accounts. Signed-in records remain locked for review after six days rather than being silently resent. Guest records are limited to the current Web browser tab session or the current running app process, are cleared on sign-in, and stop being recoverable after six days even if that session stays open; expired entries are removed on the next recovery read. Closing that session can remove the only local recovery copy and does not cancel or refund server work. You may explicitly confirm removal of an expired, unreadable or unavailable-result record to prepare a new analysis; removal does not cancel server work or refund a prior charge, and a new analysis may be charged. A record changed in another tab must be reread before removal.

Operational and security logs are kept only as long as reasonably needed for reliability, fraud prevention, and incident response. Payment, tax, dispute, and fraud-prevention records may be retained for the period required by law, commonly up to seven years for Australian business records.

Minimized AI quality events and content reports expire after no more than 365 and 180 days respectively. Deleting a signed-in account also deletes the quality and report records linked to that account.

After account deletion, we keep a protective record used only to recognize the deleted account and stop delayed requests or payment notifications from recreating deleted data. It contains no original account number or profile information and is not used for personalization. It is kept for 45 days after cleanup completes, or until cleanup finishes if still pending.

Welcome-Credit eligibility is a separate abuse-prevention record. We derive pseudonymous identifiers from a verified email address or verified Apple/Google sign-in identity using a secret-keyed, one-way transformation, and keep them with a hashed reference to the original gift. The eligibility record contains no raw email address, provider identifier, birth details or chat content. We retain it throughout the welcome-offer program, including after account deletion, only to prevent the same recorded identity claiming the gift again; it is not used for personalization or AI processing. This is longer than the separate 45-day deletion-protection period. When the program and this purpose end, the eligibility record is deleted; required financial records follow their own retention rules. These identifiers are pseudonymous, not anonymous, and do not identify every account belonging to one person.

Use the Account page to initiate account deletion. We delete or de-identify associated app data except for the limited legal, accounting, dispute and abuse-prevention retention described above, and remove reusable website payment profiles and payment methods after billing is clear while retaining only required transaction records. A website subscription billed by Stripe blocks deletion while it is still set to renew; cancel it and wait for Stripe to confirm that it will not renew. An App Store or Google Play subscription does not block deletion. Cancel it in the corresponding store before deleting: deleting your Kanmin account does not cancel that store subscription, and the store may continue charging until you cancel there. Deletion ends remaining paid access, removes unused Credits, and does not automatically issue a refund; statutory rights remain unaffected.

We use encrypted connections, access controls, authentication safeguards, monitoring, and restricted administrative access to protect information. No system is completely secure; contact us immediately if you suspect misuse.

You may request access to or correction of personal information, delete saved charts or your account, or object to a use that is not necessary to provide the service. Email support@kanminlabs.ai. We may verify identity. We will respond within any period required by applicable law and otherwise as soon as reasonably practicable.

For a privacy complaint, describe the issue and desired resolution. We will investigate and explain our response. If unresolved and the Australian Privacy Act applies, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Accounts are not intended for children under 13. Users aged 13 to 17 self-confirm during account creation or use that they already have parent or legal guardian permission. A parent or guardian may contact us about access, correction, or deletion. We apply age-oriented output restrictions, but do not rely on readings to make legal or similarly significant decisions about a person.

Software and AI automatically calculate charts, enforce access limits, detect abuse patterns, and generate entertainment content. These processes affect service content or access but are not intended to determine legal rights, eligibility for essential services, employment, credit, health treatment, or similar high-impact interests.

We may update this policy when practices, providers, or laws change. Material changes will be notified in the service or by email where practicable. Questions: support@kanminlabs.ai.