隐私政策
Privacy Policy

How we handle your information

Pluto calculates and renders locally by default. Privacy mode, cloud chart saving, and anonymous product analytics are off by default. Local history is on by default and stored only on this device. With privacy mode off, generated images show the entered name, date, time, and location. Enabling local history never uploads data to the cloud.

On an ordinary HTTP page outside the Capacitor native app, Pluto enforces temporary local-only mode: cloud saving, analytics, cloud deletion, and Supabase anonymous identity are disabled. Remote data features require a secure context or the native runtime. The pure JavaScript SHA-256 fallback only preserves compatible local hashing; it does not encrypt transport and is not a substitute for HTTPS.

Only after you separately and explicitly enable Cloud Save may new names, birth details, time zones, snapshots, and versions be uploaded. Anonymous analytics also require separately enabling Help Us Improve Pluto, which sends only allowlisted action events and rejects names, birth details, locations, complete charts, free text, and raw stacks.

To convert a place you enter into coordinates and a time zone, the app sends only your place-search text to Photon and may use ArcGIS Geocoding as a fallback. We do not send your name, birth date, or generated result with that query. The text is a manually entered birth place, not the current location of you or your device. These providers may process or retain requests under their own policies; their retention behavior must still be confirmed before the final App Store privacy classification.

Device permissions

• Photos: requested only when you choose Save Image, solely to add the generated image to your library.
• System sharing: opened only when you choose Share; recipients are controlled by Apple's share sheet.

Retention and deletion

Local history is on by default, so generated Life Manuals are saved on this device. Turning it off offers three choices: cancel, stop future saves while keeping existing records, or stop and delete all records. Kept records remain available to open or delete individually, while new results are not added. Uninstalling also removes local history. Delete Cloud Charts and Personal Data atomically removes the current anonymous identity's saved name, birth details, charts, consent records, and cloud profile, but not local history. Previously recorded usage events are deidentified and retained for no more than 180 days for aggregate statistics. Birth-data-free deletion receipts are retained for no more than 365 days. Local and cloud deletion are independent.

Children and wellness disclaimer

The app is intended for ages 13 and older. It is for personal reflection and entertainment and does not provide medical, psychological, legal, or financial diagnosis or advice.