Saju Letter

Privacy Policy

Effective date: July 29, 2026 (last updated: October 14, 2026)

Saju Letter ("we", "us", or "the Service") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect and how we use it when you use the Saju Letter app and saju-letter.com (our marketing site, the compatibility-sharing and Lunar New Year public pages, and email sign-up).

1. Information We Collect

  • Provided by you: name (or nickname), birth date, gender (optional), device timezone
  • Optional: birth time (you may choose "unknown"), email address (required if you sign up with email; if you sign in with a Google account, we receive that account's email address. If you sign in with Apple on iPhone, we receive the email address Apple shares with us (a relay address created by Apple if you choose Hide My Email) and the name Apple shares, which we use only to pre-fill the name field during onboarding. Used for sign-in and account management, account recovery and verification, checking eligibility for referral rewards, issuing marketing coupons if you sign up for our emails, preventing free-trial abuse, and responding to support requests), a note you enter in compatibility-sharing or deep compatibility to help you tell people apart (never shown to the other person)
  • Referral program: a referral code automatically assigned to your account, and — if you entered another member's referral code when signing up — a record linking your account to that referrer
  • Deep compatibility: the names of the two people you enter and their calculated saju information (including the other person's), stored so we can show you the result. The names are stored encrypted, are never sent to the AI provider, and are deleted when you delete your account
  • Collected automatically: Firebase authentication identifier (UID), device push token (FCM), app-usage analytics events collected only in production builds (Google Analytics for Firebase — including the sign-in method on the sign-up event, and screen- and button-level usage steps such as viewing the sign-in screen, choosing a sign-in method, submitting onboarding, opening your first letter, viewing the subscription screen, and whether you allowed notifications; these events never include identifying data such as your email, name, birth date, or the content of your letters or journal; we do not use the advertising ID for advertising), web-usage analytics events collected when you visit this marketing site (Google Analytics — app-download button clicks, lead sign-up submissions, viewing a compatibility result, using the free preview; we do not include identifying data such as email, name, birth date, or compatibility-link tokens in these events. When you tap the app-download button, only the channel that brought you to this site (for example "tiktok") is passed along to Google Play; that channel tag is kept in your browser for up to 30 days only if you accept analytics cookies. Analytics cookies are used only with your consent, which you can change or withdraw at any time via "Cookie settings" at the bottom of every page), a functional cookie stored only in the browser that created a Lunar New Year reading (a random value that lets only the reading's creator sign up for its email series; kept for up to 90 days, never used for ads or analytics, and you can delete it in your browser settings at any time), subscription/purchase status (via RevenueCat), Google Play Integrity device-integrity signals used to prevent free-trial abuse, crash/error diagnostic data, your IP address when you use public pages and other parts of the service (used only for abuse-prevention rate limiting; we never store the IP address itself in our database — only a keyed, one-way hash that cannot be turned back into the address, kept for up to 1 day), request logs that our web servers keep when you use the service (including IP address, time, and the address requested; kept for up to 30 days), and browser information and your IP address sent to Cloudflare while the Cloudflare Turnstile bot-protection widget is active on our marketing site's public submission forms (home demo, compatibility-sharing, lead sign-up, and Lunar New Year)
  • Personalization calculations: your full four-pillar saju chart (year, month, day, and hour pillars), calculated from the birth date and time you provide during onboarding — used to personalize weekly and monthly letters
  • Content you write: free text you enter in the "Today's Story" feature, which is sent to an AI provider to generate a personalized reply; and the subject and message you enter when contacting Support
  • Collected when you use our marketing site (saju-letter.com): the email address you provide when signing up, along with whether and when you consented to marketing emails; and, if you submit the home demo, compatibility-sharing, or Lunar New Year public pages, the name (where applicable), calculated saju information, and free text you enter. We send your Gregorian date of birth (year, month, day) only to confirm you are 16 or older and do not store it; the chart itself is calculated on your device

2. How We Use Your Information

  • To identify your account and provide the service (calculating your saju information and generating/delivering daily, weekly, and monthly letters)
  • To send push notifications
  • To process subscription payments, grant free-trial and referral rewards, and prevent their abuse
  • To generate a personalized reply in the "Today's Story" feature
  • To respond to customer support inquiries
  • To send marketing emails (only to users who have explicitly opted in) and to generate Lunar New Year readings
  • To analyze usage, improve the service, respond to errors, and prevent abuse (bots/spam)

3. Retention Period

We delete your information immediately when you close your account or when we receive a deletion request — there is no additional grace period or delay. Database backups are kept for at most 7 days and then deleted, so information erased when you delete your account also disappears from our backups within that period.

Other information is deleted once the periods below have passed:

  • Email addresses unsubscribed from our marketing emails (the home-page email sign-up and the Lunar New Year email series): 30 days after you unsubscribe
  • Lunar New Year reading data (name, the text you wrote, and email subscription details): 1 year after that year's campaign ends (an email address you unsubscribed is deleted sooner, under the rule above)
  • Names entered by friends (guests) in compatibility sharing: 1 year after the compatibility result was completed
  • Records of what administrators viewed and changed: 1 year
  • Operational alert records: 180 days after they are resolved (open items are kept until they are handled)
  • Drafts written by our AI operations assistant (support reply drafts and reports): 180 days after they are accepted, rejected, or otherwise decided (drafts awaiting a decision are kept until then)
  • Web server request logs (including IP addresses, kept in Google Cloud logging): up to 30 days
  • Rate-limiting records (a keyed, one-way hash of your IP address): up to 1 day (up to 7 days in database backups)
  • Hashes of email addresses (a keyed, one-way hash that cannot be turned back into the address): kept even after account deletion to prevent repeated free trials and referral-reward abuse

Your birth date and birth time; the text you write in the "Today's Story" feature and its reply; the notes you enter in compatibility-sharing or deep compatibility to tell people apart; the names you enter for deep compatibility; the free text you submit for a Lunar New Year reading; and the message bodies of your Support conversations (both your messages and our replies) are all stored encrypted (AES-256). The subject line of a Support inquiry is stored without encryption so it can be shown in inquiry lists. Calculated results (day master, month branch, hour branch) are not personally identifying on their own, so we store them without encryption.

Where law requires longer retention (e.g., payment records), we retain that data only for the legally required period before deletion.

4. Third Parties We Share Data With

We share data with the following third parties only as needed to provide the service:

  • Firebase / Google Analytics (Google): authentication, push notifications, and usage analytics for both the app (Google Analytics for Firebase, production builds only) and this marketing site (a separate web stream in the same GA4 property). Push notifications are delivered through FCM and may appear on your lock screen. Notifications for "Today's Story" replies, support replies, and crisis-support guidance, the morning notification on days you receive a letter personalized from the previous day's "Today's Story", and notices that a weekly or month-end letter is ready contain only fixed, generic text. A notification for an ordinary (non-personalized) daily letter may show the letter's first sentence as a preview, a milestone letter notification may show the letter's title, and a compatibility-result notification may show the names the two people entered
  • Google Cloud: hosting our servers, databases, encryption key management, and server logs
  • RevenueCat: subscription status management (actual payment is processed by Google Play Billing or the Apple App Store; we do not store your card or payment details ourselves)
  • Apple: Sign in with Apple in the iPhone app (if you choose it), App Store payments, and delivery of iPhone push notifications (APNs, via FCM). When you delete your account, we also revoke the Sign in with Apple connection
  • Our AI content provider (currently OpenAI; may be Anthropic or Google depending on configuration): generates the wording of your letters, "Today's Story" replies, and deep compatibility results, as well as Lunar New Year readings on our marketing site (saju-letter.com). This may include your calculated saju values, the text you write in the "Today's Story" feature, and the name and free text you submit for a Lunar New Year reading. For deep compatibility, only the two people's calculated saju values are shared — not their names. The home mini demo does not call an AI when you submit it: it shows a letter we generated in advance, so what you enter there is not sent to the AI provider.
  • Anthropic: helps us draft replies to your support inquiries and compile weekly topic statistics from recent support inquiries to improve the service. For reply drafts, the subject, messages and conversation of an inquiry awaiting a reply may be shared, and a staff member always reviews and sends each reply personally. For topic statistics, only the subject lines of recent inquiries (including ones already answered) are shared. The email address and name on your account, the birth date and time registered to your account, and your "Today's Story" entries are not shared for these tasks (anything written directly in an inquiry conversation — by you or our staff — is shared as written).
  • Cloudflare Turnstile: bot and spam prevention on our marketing site's public submission forms (your browser information and IP address are sent to Cloudflare for verification while the widget is active)
  • Resend: sending marketing emails and Lunar New Year result emails
  • Sentry: crash and error monitoring (it receives error diagnostics only, not the contents of your requests such as the text you enter)
  • Slack: internal operational alerts (these contain only operational information such as member identifiers — never what you write or the content of your inquiries)

5. The Compatibility-Sharing Feature and Non-Member (Guest) Data

A friend who opens a compatibility link you share does not need to create an account — they only enter their name and birth date. The saju chart is calculated entirely on their own device or browser. We store the resulting heavenly stems and earthly branches (year, month, and day pillars) together with the name they enter. We also receive their Gregorian date of birth (year, month, day) only to confirm they are 16 or older, and we do not store that date. The name is used only to display it on the result screen and is not used for any other purpose; it is deleted 1 year after the compatibility result was completed.

6. Your Rights

You can delete your account yourself at any time from the app's Settings screen. Deleting your account immediately replaces identifying information (name, email, gender, birth date and time) with anonymized values and signs you out for good, and cancels auto-renewal if you have an active subscription — but any remaining paid time is not refunded. If you just want to stop future charges while continuing to use the app, you can cancel only your subscription from the app's Settings screen instead of deleting your account. If you no longer want to receive marketing emails, you can opt out anytime using the unsubscribe link at the bottom of each email. After a cancelled subscription reaches the end of its paid period, your account reverts to the free tier and subscription-only features are locked again. For any other requests — such as accessing or correcting your information — please contact us using the information below.

If you subscribed through the App Store on iPhone, we cannot turn off auto-renewal for you. To stop it — whether you delete your account or just cancel — please cancel it yourself in iPhone Settings > your name > Subscriptions (the app's Settings screen can take you there).

7. Security Measures

  • Sensitive information — including birth date, birth time, "Today's Story" text and replies, compatibility/deep-compatibility notes, deep-compatibility names, Lunar New Year free text, and Support message bodies — is stored using AES-256 encryption (Support inquiry subject lines are not encrypted, so they can be shown in lists)
  • Encryption keys are managed through a dedicated key management service (KMS) and are never hardcoded
  • Access to the admin panel requires separate authentication

8. Children's Privacy

This service is intended for users aged 16 and older. We verify this using the Gregorian birth date you provide during app onboarding and when submitting public pages (compatibility sharing, the home demo, and Lunar New Year). Birth dates sent only for that age check on public pages are not stored. We do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has used the service, we will take appropriate steps to delete the relevant information promptly.

9. Contact Us

For privacy-related questions or requests to access, correct, or delete your information, please contact us at:

Email: contact@mikomaru.com

10. Changes to This Policy

This policy is effective as of July 29, 2026, and may be updated as our practices, applicable laws, or the service itself change (most recently updated: October 14, 2026). We will notify you of material changes through the app or this page.