Privacy Policy

Last updated: October 20, 2026

株式会社Omluc (“we,” “us,” or “our”) handles information in Uraneko as described below. This English policy applies to the English-language Service. The Service is operated from Japan; local law may give you additional rights.

1. Information we process

• Profile: nickname (which may be your name if you choose to enter it), birth date, optional birth time, selected birth city, optional gender, and current relationship status. We use the selected city's display name, timezone, longitude, and precision to calculate and present readings. Do not enter a street address as your birthplace.
• Birth-city search: to select the city and timezone used by the chart, the city name you enter (up to 100 characters; not a street address) is processed by our server using place data from GeoNames. We do not send the query to GeoNames or another external geocoding service, and we do not save the query in our database.
• Questions: text you submit to the AI oracle.
• Text-reading recovery data: while a Text reading is being generated, we temporarily store the question, profile, selected continuation context, recent Chat history, Chat memory summary, and partial generated text so a completed reading can be recovered after an interrupted connection. The completed reading remains stored as the record of that paid reading so it can be recovered after an interruption. Saving a copy on your device does not erase the server copy.
• Voice-reading data: when you use a voice reading, microphone audio, the profile, chart, and conversation context needed for the reading, and call metadata including usage time, AI provider, and end reason. We do not store the call’s audio recording. User-side speech-to-text is used temporarily in processing memory to produce answers during the call and is not persisted to our databases or other durable storage. A limited transcript of Uraneko’s spoken reading is held temporarily in encrypted application storage for crash recovery, to create a short post-call note, and to derive whether Uraneko named a calculated date and focus for continuity memory. It is deleted after the note is delivered or the attempt is abandoned. Only the short note, not the verbatim transcript, is kept long term in your consultation history. The derived date and focus, and a separate short continuity-memory summary, may be stored for later readings.
• Reading memory: a short summary of themes and developments may be stored on our server so later readings can continue the conversation. You can delete it together with your other server data using “Delete my data” in Settings.
• Reading history across devices: so another phone on which you sign in as the same person can open the same continuation, your profile (including your concern and relationship status), chat history (kept until you delete it, and also used as material for the continuing reading’s memory), saved readings, today’s reading, and compatibility partners (up to 10) are stored on our server under a pseudonymous customer ID. Only the phone currently authorized for your account can access and update it, and it is not used for advertising or additional AI training. Restoring purchases returns purchase entitlements and eligible previously purchased top-up points, but does not move this continuation. You can delete the continuation with “Delete my data” in Settings.
• Compatibility invitations: if you create an invite link, your nickname and birth date are stored only while the link is valid. A recipient’s birth date is used for the calculation and is not stored.
• Account identifiers: the identifier issued by Apple or Google when you sign in, and an identifier we issue for support enquiries. We do not request access to your name or email address from Apple. If Google includes these in its sign-in response, Uraneko does not save them in your profile or our server database or use them. Google’s sign-in service or your operating system may retain sign-in state on the device. A nickname entered inside Uraneko is handled separately as Profile data above.
• Sign-in authorization removal information: Encrypted credentials for removing Apple’s authorization and short-lived information for securely verifying the requester and correlating deletion results. We do not request Apple name or email data, or store Google name, email or ongoing-access credentials. One-use verification codes are sent to Apple or Google for exchange but are not stored by Uraneko
• Device identifiers: a randomly generated device identifier and separate security information used to authenticate the app. The server stores the authentication information in a form that cannot be reversed to recover the original secret.
• Abuse-prevention data: hashed values derived from device and network identifiers are used to prevent excessive API use and recreation of deleted identities.
• Purchase status: subscription and entitlement status, product and transaction identifiers, and evidence used to verify pending purchases. To reconcile a pending Android purchase, we send its purchase token and product identifier to Google through our server. Apple, Google, and our purchase infrastructure process payment credentials; we do not receive card numbers.
• Push token and preferences: only if you enable notifications.
• Technical events: allowlisted product events and privacy-filtered crash diagnostics, such as app version, operating system, and language. We do not send question text, birth dates, generated readings, names, or audio to product analytics or crash reporting.

2. Why we process it

• To calculate BaZi charts and generate and display readings
• To generate real-time voice readings, meter call time, and diagnose connection failures
• To issue compatibility links and calculate compatibility results
• To provide paid features and enforce usage limits
• To deliver notifications you have enabled
• To prevent abuse, protect the Service, diagnose faults, and improve product quality

3. AI processing and service providers

Only after you consent in the app, Uraneko sends the data needed for the requested feature to the AI provider OpenAI. Providers process API input and output under their agreements and data-handling terms and may retain it for a limited period for abuse monitoring. Where available, we use settings that disable provider-side application storage. Depending on our operational settings, requests that generate readings, memory summaries, or post-call notes may be sent directly to OpenAI or routed through Cloudflare AI Gateway. When we use AI Gateway, we do not store consultation or response bodies in Gateway logs or use content classification. For troubleshooting and usage and cost monitoring, we record only technical usage information, such as token counts, model and provider names, response status, estimated cost, and duration.

A Text reading may include your question, selected recent and older consultation excerpts, nickname, birth details, selected concerns, your concern text and relationship status, and calculated chart facts. To create a short continuity-memory summary, the current question and Uraneko’s completed reading may also be sent. A compatibility reading may send the partner name you entered and the relationship calculated by Uraneko, but not the partner’s raw birth date. For Text readings, Uraneko also sends a one-way device-derived safety identifier for abuse prevention.

For Voice, Uraneko sends microphone audio, the name needed for the conversation, language, speech-delivery instructions, and reading answers to be spoken to OpenAI in real time. To produce reading answers, Uraneko sends limited transcripts of what you and Uraneko say and reading context, including your profile (nickname, birth details, selected concerns, concern text and relationship status), calculated chart, and continuity memory, to OpenAI. User-side speech-to-text is handled temporarily in processing memory, not persisted to Uraneko databases or other durable storage. Uraneko does not store the audio recording. The limited transcript of Uraneko’s speech described above may also be sent to OpenAI to create a short post-call note or relationship-memory summary. Short memory summaries derived from Voice may also be sent to OpenAI when they are consolidated into background memory for later readings. Live microphone audio does not pass through AI Gateway; our server relays it directly to OpenAI. Text generation for answers during a call, short memory summaries, and post-call notes may use the text-generation transport described above. Before treating a reading as delivered or starting chargeable usage time, Uraneko checks that it was spoken in full and finished playing on your device. For this check, Uraneko temporarily holds the audio generated by OpenAI in processing memory and sends it back to OpenAI for a separate transcription, directly or through AI Gateway. Uraneko also sends the resulting transcript and the reading used for comparison to the same OpenAI service to check that the complete reading was conveyed, including through paraphrasing, without changing its meaning, dates, or quantities. The reference reading is not supplied to the transcription request. This does not resend your microphone audio. The temporary audio, transcript, and comparison text used for this check remain in processing memory, are not saved to recordings, databases, or logs, and are discarded when the check finishes or stops. Reading content confirmed as spoken may be used for the limited post-call transcript and note described above.

We do not sell personal information, use it for cross-app advertising, or disclose it to other third parties except as described here or where required by law.

If you report a problematic answer, our Cloudflare-hosted server processes the reason, optional explanation, identifiers referring to the reading or answer, a one-way comparison value, and submission and review records, and stores them in Neon databases. We do not make a separate copy of reading content or call recordings for a report. An optional explanation may include consultation information that you choose to write. Our operator accesses the records for safety and quality review and response. Report contents are not sent to an AI provider or PostHog.

4. Storage, retention, and deletion

AI Gateway usage metadata without request or response bodies, and technical logs, traces, and failure records, are retained under our Cloudflare agreement and active retention settings. “Delete my data” in the app does not automatically erase these external service records.

To recover from service failures, we encrypt database snapshots and store them in Cloudflare R2. A snapshot contains the profile, consultation and reading, purchase, and authentication-related data held in the database when the snapshot is taken. The snapshot retention threshold is 7 days from creation. Deleting data in the app does not selectively rewrite existing snapshots. We delete each snapshot as a whole under its expiry procedure, so information captured before your deletion may remain until that procedure is complete.

To reapply deletion and invalidation of authentication information after a restore, and to reconcile purchased balances, we separately encrypt recovery records in Cloudflare R2. These contain minimal facts about deletion, sign-in authorization removal, paid purchases, and point grants and use. Their retention threshold is 8 days. They do not contain consultation or reading text, profiles, or secrets that can be restored and used to authenticate. Retention can exceed the threshold if we cannot safely complete expiry, for example because the continuous records needed for recovery would be lost. We investigate expiry failures and reconcile recovery requirements with our deletion obligations to correct the problem.

We keep a restored database closed to users while we reapply deletion and invalidated authentication information and reconcile purchases, balances, and unfinished operations. Expiry of recovery copies held in R2 is separate from retention of the operational database's purchase ledger, balances, and minimal deletion-verification and security records. Those operational records follow the purposes and retention conditions described elsewhere in this policy; expiry of the recovery copies does not by itself delete them.

Your profile, full chat, and reading history have a Uraneko-managed copy on your device. Deleting the app removes that local app copy, but does not delete Uraneko server data, cancel a subscription, or guarantee removal of provider or operating-system sign-in state. Server data—such as device authentication information, purchase entitlement state, notification settings, usage records, reading-memory summaries, your saved account data (profile, chat history, saved readings, today’s reading, and compatibility partners), short post-call notes, and voice-call usage time, provider, and end reason—is kept while needed to provide and protect the Service. Uraneko does not store voice-call recordings. Text transcribed from your speech is handled only temporarily in processing memory, without lasting storage. Verbatim call transcripts are not kept long term. The limited transcript of Uraneko’s speech is temporary and is deleted after the short note is delivered or its creation or delivery is abandoned; the derived calculated date and focus and a separate short continuity-memory summary may remain for later readings.

The single “Delete my data” action in Settings deletes the Uraneko-managed local profile and history and the server profile, chat and readings, memory, notification settings, and usage data for the signed-in person. It does not sign you out of Apple or Google or guarantee removal of provider or operating-system sign-in state. Uraneko replaces the device’s identifiers and authentication information. Deletion or transfer to another phone invalidates the previous phone’s access.

To prevent invalidated identities from being reused and to retry and verify deletion across previously used devices, we retain minimal security and deletion records indefinitely. These include irreversibly transformed identifiers, account references that do not directly identify you, and deletion progress and completion times. They contain no profile, consultation, or reading content. For deletion, a non-reversible record of the old authentication information also allows a request to be retried if its response is lost. After a phone transfer or account merge, we also retain a non-reversible record of the old authentication information and request identifiers to verify whether an earlier deletion request was accepted or completed. After a phone transfer, this record also allows us to check a pending Android purchase against its original purchase and customer. This information cannot restore normal account access or authorize deletion of a different current account.

To process refunds, prevent duplicate grants, restore purchases, and meet legal recordkeeping requirements, we retain verified purchase records, purchase entitlements, the paid point balance shared by Text and Voice, and used amounts for as long as needed for those purposes. These are held under an identifier separated from the deleted profile. Separate recovery information in protected device storage helps reconnect your account to that balance; our server stores only a non-reversible form of that information. If the recovery information is lost when the app or device storage is removed, consumed Android one-time purchases may require purchase support instead of automatic restoration.

Compatibility invites expire within 30 days. To limit excessive requests, a non-reversible network identifier is used by Cloudflare for a 60-second rate counter; we do not store IP-derived values in Uraneko’s application databases or key-value storage. Cloudflare’s own network logs are handled under its applicable terms and our settings.

The question, profile, selected continuation context, recent Chat history, Chat memory summary, and partial generated text for a Text reading are deleted when a reading is successfully finalized. If generation fails, partial text is deleted while the question and reading conditions remain in the processing record for up to 24 hours so you can explicitly retry the same reading, then are deleted when the operation expires. The completed reading remains on the server as the record of that paid reading until you delete server data in the app. Saving a copy on your device does not erase the server copy. If you delete server data in the app, Uraneko deletes this temporary data, the completed reading, and the original processing record. To prevent a deleted reading request from being recreated, Uraneko retains indefinitely only a non-reversible identifier for that request and its deletion time. This security record contains no device or customer link, question, profile, or reading result. Processing already sent to an external AI before deletion may still finish, and deletion does not automatically erase data held by that provider.

Deletion inside Uraneko does not automatically erase those Uraneko purchase records, purchase and transaction records held by Apple, Google, or RevenueCat, or data already sent to an AI provider or PostHog. Those records remain subject to Uraneko’s or each provider’s agreement, project configuration, retention policy, and applicable law. Contact us with your Purchase support ID if you want help making a request concerning identifiable external data.

Apple authorization credentials are held encrypted and used to request removal of Apple’s authorization when you delete account data. Uraneko data deletion and removal of Apple’s authorization proceed separately, with each state shown on the receipt. While authorization removal can still be retried, we retain the encrypted retry information until removal is confirmed. If Apple permanently rejects the removal credentials, we delete those unusable credentials and explain how to remove authorization in Apple account settings. Minimal processing and comparison records remain to follow up and verify the separate authorization result. If no removal credentials were stored for an earlier authorization, we likewise provide manual removal guidance without blocking Uraneko data deletion. This is separate from signing out of a provider or operating system, cancelling a store subscription, or deleting external providers’ transaction records.

Reports and review records are kept for up to 30 days after submission, then deleted. Account data deletion removes them together without waiting for this period to end.

5. Security and international processing

We use encrypted network connections and access controls to protect information. The providers listed above may process information outside Japan or your country of residence. Where applicable law requires information or consent before a transfer, we provide that information and obtain the required consent before the transfer. Please contact us to request information about international processing and the applicable protective measures.

OpenAI is a US provider and may also process data in other countries where its subprocessors operate. Its processing terms and subprocessor list explain processing and locations. Where applicable law requires information or consent before a transfer, we provide that information and obtain the required consent before the transfer. These links alone do not constitute consent to an international transfer.

Other services may also process information outside Japan. For the providers’ published processing terms and locations, see Cloudflare’s processing terms, Neon’s processing terms, PostHog’s processing terms, RevenueCat’s processing terms, and Expo’s subprocessor list.

6. Children

Uraneko is not directed to children under 13, and we do not knowingly collect information from a child under 13. If local law requires a higher age or parental permission, that rule also applies.

7. Your choices and rights

You may decline external-AI consent, disable notifications, edit your profile, and use “Delete my data” in Settings to delete the Uraneko local copy and the server data described above. Depending on where you live, you may also have rights to access, correct, delete, restrict, or object to processing. Contact us to make a request. We may need information sufficient to verify that the request concerns your data.

If you cannot use the app, follow the account deletion link on Support and verify with the same Apple or Google account to request deletion. You do not need to reinstall the app.

8. Changes

We will give notice of material changes in the app or by another reasonable method.

9. Contact

info@omluc.com