Your information supports the features you choose to use. Signing in does not subscribe you to marketing. Our connected-device app and first hardware product are still in development.
1. Who we are and what this policy covers
VIFAYA Ltd, registered in Hong Kong ("VIFAYA", "we", "us"), operates vifaya.app, the shared VIFAYA account, and Wenyi. We are responsible for the personal information we handle through these services. Contact vifayalabs@gmail.com with privacy or account questions.
This policy covers our websites and apps that link to it. The VIFAYA connected-device app and hardware products are in development. Before launching a feature with additional data collection, we will explain that collection here and in the relevant product, and request permission or consent where required.
Third-party websites, sign-in providers, payment services and app stores also have their own privacy notices. This policy describes our handling of information; it does not replace those notices.
2. Information we collect
- Account information: email address, display name, profile image if supplied by a sign-in provider, a stable VIFAYA user ID, linked provider identifiers, email-verification status, account creation dates and authentication records.
- Sessions and security: session credentials and expiry, recent sign-in activity, short-lived verification or authentication challenges, and records used to limit abuse. Technical requests can include an IP address, browser or device details, requested URLs and error information.
- Information you provide: support correspondence and any information you voluntarily include in a request.
- Wenyi content, when enabled: your question, coin photos you submit for recognition, recognized coin sides and confidence, toss results, generated hexagrams and interpretations, reading status and history.
- Credits and transactions, when enabled: credit balances and changes, purchase status, amounts, currency, and Stripe customer, checkout and transaction identifiers. Stripe handles payment details on its checkout; we do not store full card numbers in our account database.
Availability varies by feature. Authentication email delivery is currently deferred. Credit checkout is a sandbox integration: test purchases and test credits have no monetary value. We do not collect a payment merely because you create an account.
3. Google and Apple sign-in data
When Google sign-in is enabled and you choose it, we request openid, email and profile. Google may provide a unique account identifier, email and verification status, name, and profile image. We use this information to authenticate you, create or link your VIFAYA account, display your profile and maintain access to the services you choose.
Our current Google integration does not request Gmail messages, Google Drive files, calendar entries or contacts. We do not receive your Google password. Provider credentials needed by the account service are stored server-side; stored OAuth tokens are encrypted.
We store Google profile and linked-account data with our hosting provider to operate your account. Where you choose a checkout feature, your account name and email may be provided to Stripe to associate the transaction with your account. We do not sell Google account data, use it for advertising, use it to train AI models, or automatically include it in Wenyi AI interpretation requests. Your own submitted question or photo may contain personal information; review it before sending.
Our handling of Google data follows the Google API Services User Data Policy, including applicable Limited Use requirements. Access is limited to providing the disclosed service, authorized support, security and legal needs.
When Apple sign-in is enabled, Apple may provide an account identifier, name and email, including a private relay email if you choose to hide your address. We use those details for the same account purposes. Different email addresses are not automatically merged into one account.
You can manage provider access through your Google account connections or Apple account settings. Revoking provider access prevents future use of that authorization; it does not by itself delete your existing VIFAYA account or its records. To request deletion, use the controls or contact described below.
4. How we use information
We use information to provide requested features, authenticate users, maintain shared account access, display profiles and history, administer credits and transactions, answer support requests, protect the service, investigate errors or abuse, and meet applicable legal obligations.
VIFAYA and Wenyi use the same VIFAYA user ID and, where available, credit wallet. Wenyi checks your shared account session rather than asking you to create a separate identity. Future device and subscription features will be described before they become available.
We do not enroll you in marketing through sign-in. Any future optional marketing requires a separate choice. We do not currently use advertising trackers or personalized advertising on these services.
5. AI features and permissions
Wenyi is an optional cultural reflection service. When its recognition feature is enabled and you submit a coin photo, the image is processed through Cloudflare Workers AI to identify coin sides. The current reading database stores recognition results, not the original image file. Processing providers may maintain their own service or security records.
When interpretation is enabled, Wenyi sends your submitted question, hexagram and reading timing to DeepSeek to generate a response. The application does not automatically send your VIFAYA profile, Google tokens or account email as part of that interpretation request. We retain the question and generated result in your reading history.
The camera is used when you grant permission and choose to capture a photo. You can refuse or revoke permission through your browser or device settings; photo-based recognition will then be unavailable. Take photos of the coins only, avoiding people, documents and other private details.
Our current services do not operate home-monitoring cameras, record household audio or video, create facial recognition profiles, or collect precise location for connected devices. A future device feature will have its own clear disclosures and controls before use.
8. Storage, retention and security
We retain account information while your account exists and as needed to provide the service. Sign-in activity is kept for up to 90 days. Verification codes expire after 5 minutes. Expired verification, session, challenge and rate-limit records are cleared by an hourly cleanup job.
Wenyi questions, results and credit history remain associated with your account until removed through the applicable deletion or support process. A reading session expiring does not automatically erase its historical record. Transaction and ledger records may need to be retained for reconciliation, fraud prevention, disputes and applicable legal obligations.
Deleting an eligible account through the account controls removes its profile, linked identities, sessions, private messages and sign-in activity from the live account database. Accounts with credit-ledger or purchase records require a support-assisted process to resolve balances and determine which records can be deleted or must be retained. Contact us to request removal of reading history or closure of such an account. Recovery backups and processors' security records can persist temporarily under their retention arrangements.
We use HTTPS, protected session cookies, server-side access checks, encrypted stored OAuth tokens and rate limits to protect information. Access is restricted to operational needs. No service can guarantee absolute security; contact us if you believe your account has been compromised.
9. Your choices and privacy rights
You can edit your display name, manage available sign-in connections, sign out, revoke sessions and use account-deletion controls at your account page. Contact vifayalabs@gmail.com to request access, a copy, correction or deletion of personal information, including Wenyi history.
Depending on your location and applicable law, you may also have rights to portability, restriction, objection, withdrawal of consent and review of a denied request. We will verify your identity proportionately before disclosing or changing account information and respond within applicable time limits. Do not send passwords, sign-in codes, card numbers or identity documents unless we have explained a necessary, secure verification process.
For Hong Kong users, this includes applicable access and correction rights. For users in the EEA, UK or Switzerland, processing may rely on providing a requested service, legitimate interests in security and service operation, legal obligations, or consent where required. You may object where applicable and complain to your local data-protection authority. For US users, we honor applicable state privacy rights, including the right to appeal where required. We do not discriminate against you for exercising a privacy right.
10. International processing
VIFAYA Ltd is based in Hong Kong. Our service providers operate globally, so information may be processed outside your country, including through Cloudflare's network and the locations used by sign-in, payment and AI providers. Data-protection rules can differ between countries.
Where applicable law requires safeguards for international transfers, those requirements apply to our transfers and provider arrangements. You can contact us for information about the safeguards applicable to your request. We do not promise that all data stays within Hong Kong or any single country.
11. Children and future products
The current account and Wenyi services are intended for adults aged 18 and over. We do not knowingly create child profiles or collect children's personal information through these services. If you believe a child has provided information, contact us so we can investigate and address it.
AI toys are a product direction under evaluation. This policy does not authorize collection of children's information for future toys. Any child-facing product will require specific age-appropriate disclosures, permissions and parental controls before launch.
12. Changes and contact
We will update the effective date when this policy changes. For material changes, we will provide additional notice through the website or affected service and seek fresh consent when required before using data in a new way.
Operator: VIFAYA Ltd · Hong Kong
Privacy and account contact: vifayalabs@gmail.com
Related document: Application Terms of Service