Privacy policy
By DailyAstro · Last updated 2026-09-06
In one sentence: DailyAstro has no accounts, no tracking pixels, no analytics and no database. Your birth data and settings are written only to your own browser's localStorage, and all date scoring runs on your machine. Apart from the Google Fonts files every page loads (section 3 below), an outbound request only happens when you press a button that starts one. One of those — “AI explanation” — has, since September 2026, been forwarded through a server function of ours; what it sends is the already-computed scores and rules, with no name and no birth date. Item by item in section 2.
This English page is a translation provided for convenience. If it differs in any way from the Chinese original at 私隱政策, the Chinese text prevails.
What we collect
Nothing. We have no database and no place where your data is kept. This site is a pile of static files on Cloudflare Pages; the date engine, the chart and the scores are all JavaScript running inside your browser. No sign-up, no login, and no cookie-consent banner — because we use no cookies to track you.
One exception, stated plainly: since September 2026 we have run one server-side component — a Cloudflare Pages Function (/api/explain) whose only job is forwarding the “AI explanation” request, see section 2. It writes to no database, and it records the content of no request in any log. The only thing it remembers is the number “how many times this IP has used it today”, purely to stop abuse: no request content, no chart, no scores.
What is stored on your device
The following is kept in your browser's localStorage and stays on this machine, in this browser:
| Key | Contents |
|---|---|
da_profiles | The names you gave yourself, family members, friends and candidates, their birth dates, and an optional birth time |
da_active_profile | Which profile you currently have selected — a profile ID, or the marker meaning “everyone”, and nothing else |
da_settings | A DeepSeek / Gemini API key you typed in yourself (optional, see section 2), a Google Client ID, and your AI model choice |
da_explain_cache | The “AI explanation” texts you have already seen, up to 60 of them. Purely a cache: pressing the same result again need not ask the AI. Clearing it only means they are generated again. |
da_history | Records migrated from the old version (v1). This version adds no new records: what you see on the profiles page is what the old version left behind, and you can delete them one by one. If you never used the old version, this key never appears. |
calendarEventIds | The IDs of events added to Google Calendar through the app, kept only so it knows which ones you added; deleting them means deleting them in Google Calendar yourself (the app has no delete button) |
Two more are left over from the old version: baziHistory and baziSettings. If you used the old version, the new one reads them once, the first time it reads records or settings, and moves the contents into da_history / da_settings above. Once moved, we do not delete the original two keys — they stay on your machine until you clear this site's data in your browser yourself.
The chart (the four pillars) is never stored; it is derived from the birth date each time. localStorage does not sync anywhere and does not follow you to a second machine.
Outbound connections
In normal use, only the following requests leave your machine:
1. Google Calendar (optional, started by you)
You first have to enter your own Google Client ID and press “connect Google Calendar”. Only then is Google Identity Services (accounts.google.com) loaded for authorisation, with a scope limited to calendar.events. When you press “add to calendar”, what is sent is the date you picked: the date, the hour range, the day master, and the event title and description. The birth date itself is not sent. You can revoke the authorisation in your Google account at any time.
2. AI explanation: forwarded through our server (optional, you press the button)
When you press “AI explanation” or “AI deep analysis”, your browser sends the already-computed result to a server function of ours (dailyastro.ai/api/explain), which forwards it to Gemini or DeepSeek using our own API key and passes the answer back to you. You do not need to bring an API key.
What is sent: your day master's heavenly stem and its element, the earthly branches of your chart, and for the chosen day its date, day pillar, score, band and golden hour, each scoring rule with its points, and that day's almanac 宜／忌 terms. A compatibility request also sends the other person's day master and branches. It does not include your name or a family member's name, and it does not include the raw birth date. This is filtered twice — once before sending (in the browser) and once after receiving (on the server) — and both layers copy only the fields on an allow-list, discarding everything else.
Our server function writes these requests to no database and to no log file. Cloudflare, as the underlying infrastructure, keeps its ordinary edge connection records (IP, timestamp); their retention and purpose are governed by Cloudflare's own privacy policy, not by a choice of ours. We also use your IP for rate limiting: approximately 8 requests per IP per 10 minutes, 30 per IP per day, and roughly 1,000 per day site-wide (the day is counted in UTC, so the reset falls at 08:00 Hong Kong time). “Approximately” because that counter lives in Cloudflare KV, and KV is not immediately consistent: requests arriving at the same moment each read the old number and each write back the same one, so how far over the limit a short burst can go is, strictly speaking, unbounded. The genuinely hard limits are not in this code — they are the rate-limiting rule at the Cloudflare edge and the daily usage caps we set with the AI providers. KV holds one count keyed by your IP, deleted automatically after about a day, with no request content — anything else and one script could burn our whole API quota for us.
Once data reaches Google or DeepSeek it is governed by their privacy policies, which are outside our control.
Do not want it going through us? You can enter your own API key under Profiles → Settings. To be exact about when it is used: only when our built-in AI is unavailable (for example a preview deployment with no key configured, where the server answers no_key) does the request instead go directly from your machine to api.deepseek.com or generativelanguage.googleapis.com, bypassing us. While the built-in AI is working, pressing the button takes the built-in path.
3. Fonts
Pages load the Noto Serif TC / Noto Sans TC font files from fonts.googleapis.com and fonts.gstatic.com. The browser makes this request automatically; it carries no personal data, but it does let Google see your IP address — the same as on any other site that uses Google Fonts.
And that is all: no Google Analytics, no Meta Pixel, no A/B testing tool, no ad network, no error-reporting service, no session recording.
.ics export
“Export .ics” assembles the file inside your browser and downloads it. Nothing goes over the network.
How to delete your data
- Delete individual profiles or records on the app's Profiles page.
- Or clear this site's data in your browser settings, which removes all of it at once.
- Once cleared it really is gone — we have no backup to restore for you, because we never had a copy in the first place.
- Events already added to Google Calendar live in your own Google account; delete them in Google Calendar.
Children
DailyAstro is not designed for children, and it does not go out collecting anybody's data. You can create a profile for a child in your household (for a whole-family compatibility view, say); that data likewise stays on your machine.
Policy updates
If a future feature changes where data flows (adding accounts or sync, for instance), we will write it out on this page and update the date at the top. September 2026 is exactly such a case: “AI explanation” gained a server function that forwards the request, so the previous version's line saying “nothing is ever relayed through us” is no longer true and has been replaced by section 2 above. Every sentence above can be checked yourself in your browser's developer tools: look at the Network tab to see which requests exist (pressing “AI explanation” shows a POST to /api/explain containing neither your name nor your birth date), and at the Application tab to see what is in localStorage. We would rather you trusted your own eyes than this page.