Gratum LLC

Privacy policy

Effective October 16, 2026

Fengshui Forever is built to keep your circle’s details on your device. There is no account. Your details stay on your device except for the paid reports described below. This policy explains what stays on your device, what leaves it and when, and the choices you have.

What stays on your device

Names, birth dates, optional birth times and cities of birth, optional stated sex and ABO blood type, relationship labels, groups, current-city settings and every compatibility reading are stored on your device, except for the paid reports described below. Free readings are calculated on your device. ABO type is used only for the optional Japanese cultural lens and is never interpreted as medical compatibility. Paid reports you have bought are also saved on your device.

Many people keep their birth time and city of birth private. The app never needs them, and it never sends them anywhere unless you choose to include them in a share. A paid report sends the chart derived from your birth date and time and, for the rising sign, your city of birth, never the time or city itself.

Your anonymous app identifier

The app creates a random identifier on your device. It is not tied to your name, email, phone number or Apple Account. The features below send it so our server can limit abuse, tell you when a share you sent has been opened, and count how features are used.

What leaves your device, and when

Weather.Location access is optional and requested only after you tap “Use this phone.” The app reduces your location to city-level coordinates before saving it, and sends those coordinates to Open-Meteo to fetch a seven-day forecast, which is cached on your device for up to three hours. You can choose a city from the built-in list instead and never grant location access. Open-Meteo may keep API logs, including IP addresses and coordinates, under its own privacy terms.

Sharing a report with a code. When you share a report, your device encrypts it before it leaves, using a key made from the share code. Our server stores only the encrypted result, looked up by a scrambled form of the code, so it cannot read what you shared. The code travels in the part of the link that browsers never send to a server. Your own birth time and city of birth are included only if you switch them on, and both switches start off. The person you send it to receives what you shared. Shared reports expire after 30 days, and you can revoke one sooner from the app.

Add Me cards. An Add Me card works the same way: encrypted on your device, unreadable by our server, expiring after 30 days, and carrying your birth time, city of birth or stated sex only if you switch each one on.

Anonymous match cards.If you post an anonymous match, our server stores a card anyone with the link can view. It contains no names and no birth dates, times or places. It shows each person’s age, stated sex as a single letter if you have recorded one, and current city (or city of birth when no current city is set), along with the zodiac pairing, the score and the kind of relationship. Cards are not listed in search engines, expire after 7 days, and can be revoked from the app at any time.

Encrypted backup. Backup is optional. When you turn it on, your circle is encrypted on your device before it leaves, and our server stores only the encrypted result alongside your anonymous identifier. We never have the key and cannot read your backup.

Usage events.To understand whether sharing works, the app sends small events such as “a share was created,” with the kind of relationship involved, the time, and your anonymous identifier. Events never contain names, birth details, share codes or anything that could connect them to a particular share.

Website action counts.The marketing site sends an event when its home page is shown, when you start the browser reader, when you tap a guide’s browser-reading link, and when you tap an iPhone link. Each event contains the action, a fixed label for the page, the time, and a fresh random value used to check the request. That value changes for every event; we do not use it to recognize your browser across visits. The event body contains no names, birth details, share codes, full page or referring URLs, campaign tags, or cookies. A daily cleanup deletes these website action records once they are more than 90 days old. These counts show which pages and links people use; they do not show who installed the iPhone app.

Paid reports

To write a paid report, the app sends our server your chart, which reflects your birth date and time, so we treat it as birth data. The chart is the derived pillars, Zi Wei Dou Shu placements, signs (including a rising sign worked out from your city of birth, when you have added one), picks and, if you recorded a stated sex, a direction from the Eight Mansions (Kua) system, and a pronoun (she, he or they) taken from your stated sex, or “they” when none is recorded. For a love report it also carries the relationship label and the compatibility tier. Names, birth dates, birth times, time zones, cities of birth and the stated sex itself never leave your phone.

Our server sends the chart through Vercel AI Gateway, using our own Anthropic account, to an AI model, Anthropic’s Claude, which writes the report. Vercel’s AI Gateway keeps no copy. Anthropic doesn’t use the chart to train its models and deletes it within 30 days, unless the law requires otherwise or its automated safety systems flag the request, in which case it may keep it for up to two years.

Our server never logs or stores the chart. It stores two things. The first is the report text, filed under a one-way keyed code made from the chart; names are added on your phone, so the stored text contains none. The second is an order record: Apple’s transaction id, your anonymous app identifier, an owner key (a one-way code that changes when a birth date or time changes), the report kind, the product, the environment, the order status, whether a birth time was included, and the date. “Restore purchases” and reinstalls use the order record together with your encrypted backup.

While a report is being written, our server also keeps a short-lived job record: a random job id, your anonymous app identifier, the order and the report’s one-way code, and the sections written so far, so your phone can show them as they appear and pick up where it left off if you close the app. Like the report text, these sections contain no names. A finished job’s record is deleted after 7 days, because the report text is kept separately; a job that failed or was abandoned is deleted after 24 hours. The job record never holds your chart.

We keep report text and order records until you delete them. Deleting your backup (“Delete server copy” in the app’s backup settings) also deletes the order records and any job records for your anonymous identifier and any report text no other order uses. Reports already on your phone stay.

Purchases

The app offers two one-time paid reports at $9.99 each. Purchases are processed by Apple, which never sends us your payment details.

The web reader

On the web, your circle is kept in your browser’s storage on that device. The optional subscribable calendar feed is the one exception to local-first: when you turn it on, names and dates from your circle (birthdays, reminders and auspicious days, but never birth times or places) are sent to our server and delivered to the calendar service you subscribe with, which keeps them under its own privacy terms. You can switch to generic titles so no one is named.

Advertising, tracking and selling

Fengshui Forever has no advertising, does not track you across other companies’ apps or websites, and does not sell or rent your data or your circle’s. We will update this policy, and the App Store privacy details, before any of that changes.

Deleting your data

Deleting the app deletes everything it stored on your device. Shared reports and Add Me cards expire after 30 days, anonymous match cards after 7 days, and you can revoke any of them sooner from the app. If you turned on backup or the calendar feed, you can delete that data from the app’s settings without deleting the app. Deleting the server copy of your backup also deletes your paid-report order records and any report text no other order uses, as described under Paid reports. To ask us to remove anything else, email us at the address below.

Children

Fengshui Forever is not directed to children under 13.

Contact

Gratum LLC is based in San Francisco, California. For questions about this policy or your data, email support@gratum.co.