Fortune Chat · Privacy policy

Updated November 5, 2026

Operator and contact

The Fortune Chat developer provides this app. Contact bixiaopeng2007@gmail.com about privacy, account deletion or data rights.

Services you request

Google sign-in uses standard Firebase Authentication. We identify accounts by the verified UID and may receive a display name and email. Fortune Chat never receives your Google password. Authentication, requested readings and necessary billing support the service contract. Security, abuse prevention and legal obligations have their applicable legal bases; these do not substitute for consent to optional analytics.

Birth details and preferences

Your chosen name, birth date, time, place, coordinates and optional Bazi calculation sex support your profile and local chart calculations. You can correct them in Profile. Language, cultural preferences, preferred methods and methods to avoid guide readings. Religious beliefs are optional: only after explicit consent do we send the belief preference to the reading service and its model processor. Uncheck and save to clear the current belief preference. Previously sent information can be covered by a data request. We do not infer religion from location.

Place search and readings

When you tap Search, the app sends your place query, which may be a city or street address, directly to the public Photon service operated by komoot and powered by OpenStreetMap data. Photon may keep request logs for service operation. If you choose Find in Google Maps, only the entered place query is passed to Google Maps or its website; your name, birth date, birth time and other form entries are not included in that link. You can return and paste coordinates manually. Timezones are resolved locally. We do not request device location, contacts, camera or microphone permissions. When you request a reading, the configured Fortune Chat service and model processor receive your question, relevant history, birth details, chart summaries and authorized preferences. Avoid unrelated sensitive information and private information about others. When the service is unavailable, no demonstration response is presented as a real reading.

Personal memory

Personal memory is on by default. The service can organize information you explicitly share in conversations into memories, storing their content, sources and update history locally by account. To support later conversations, important profile details and preferences, recent memories, and relevant memories or past-message excerpts found by a local search may accompany requests to Fortune Chat and its model processors. Selected memories can also inform daily recommendations. Please review and correct the results where needed. You can turn memory off, edit it or remove entries on the personal memory page. Turning it off stops new questions from using or updating personal memory; requests already sent keep their original context. Removing an entry stops its use for later questions, but the entry and its update history remain locally as an edit record. It does not erase existing conversations or content already sent. Birth details already added to your profile must be changed separately there. Local cleanup following account deletion includes personal memory.

Data used for daily recommendations

Daily recommendations are on by default. With an active subscription and the generation conditions met, opening Home can automatically generate two suggested questions without another send action. The app sends your profile, saved reading preferences, selected memories when memory is enabled, language and device time zone to Fortune Chat and its model processors to personalize suggestions and determine the recommendation day. Generation uses subscription allowance or points as explained in the terms. You can turn this off in Settings → Daily recommendations. With memory off, recommendations can still use your profile and preferences. Analytics and crash-diagnostics switches do not replace this separate switch. Results are stored locally and on the server; expiry from display does not mean the records have been erased. Account-linked recommendation records are included in the account deletion process.

Local records and account separation

Profiles, drafts, chats and readings are private and separated by UID and environment. Ordinary sign-out and switching hide the former account. Automatic erasure requires explicit confirmation through its independent deletion credential. A new UID starts empty without merging old account data. Guest records migrate only to their established owner; language and consent are device settings. Android cloud backup and device transfer are disabled. Uninstalling or clearing app data removes all local records; signing in does not download history. You manage copies exported, copied or sent to other apps.

What deleting a conversation removes

Deleting a conversation irreversibly removes that conversation from this account on this device. It does not also delete separately saved personal memories, profile details, server summaries, diagnostics, transaction records or security records. You can manage memory separately or request account and data deletion as described below. Copies you share or export remain subject to the recipient’s handling.

Reading processing and service records

When you request a reading, relevant questions, conversation history, profile details, chart or draw results, permitted preferences and selected memories are sent to Fortune Chat and model processors to generate a reply. The server keeps account, entitlement, usage, transaction, request-identifier, status and security records needed to provide the service. Public service connections use HTTPS. Local storage, encrypted transport or local deletion does not mean the server and processors have not received the relevant content.

Content diagnostics and retention

For troubleshooting, the service may retain request and response content, including model inputs and outputs, in encrypted storage. The production retention period is 3 days. If you use a test build connected to the test service, that period is 7 days. Access ends at expiry and scheduled jobs remove the copies. Backlogs or failed jobs may delay physical removal. These diagnostic copies are separate from conversation history and are governed by the service even if Firebase Analytics and Crashlytics are off. Third-party processing follows the applicable provider terms.

Service statistics and analytics exports

We use account and request identifiers, timestamps, stages, results, error codes, timings, model usage and costs for billing checks, troubleshooting and service reliability. These records can be linked to an account and exclude the text of questions, readings, birth details and beliefs. The service keeps short-term daily counters on a 7-day retention schedule and keeps daily summaries in service reporting for up to 90 days. Account-linked service statistics are included in account deletion. If you allow analytics, Google Analytics receives events that may be exported to Google Cloud BigQuery. BigQuery aggregate reports are kept for up to 90 days. Raw analytics events follow the applicable Analytics and export retention settings. When handling an account deletion, we request deletion from Google Analytics and remove identifiable export records we can locate. After the account is deleted, we check for late-arriving records. These optional analytics transfers are separate from service operation statistics.

Long-conversation summaries and reading recovery

If a reading exceeds the model context window, earlier messages may be sent to the server and model processors for a separately charged summary so the reading can continue. The full local conversation is not replaced by the summary. Temporary server copies of source text used for summarization and recovery expire 24 hours after creation and are cleaned up by a daily task. An active summarization may delay cleanup until it ends, and failed tasks can be retried. Completed summaries, recovery checkpoints and necessary billing records are retained separately and included in account deletion; the source-text limit of 24 hours does not apply to them. Summaries do not restore conversation history after a new sign-in. To recover an interrupted reading, the service may keep a completed response in memory for up to 24 hours. It may become unavailable sooner. This temporary copy is for delivering that response and is separate from your conversation history.

Purchases and subscription verification

Google Play handles payment. Fortune Chat does not receive your complete card details or Google password. The app sends the product identifier and purchase token to our service; an account-linked identifier connects the purchase to your Fortune Chat account. The service verifies purchases with Google and processes order status, subscription validity, renewals, cancellations, refunds, usage and balances to grant or restore the correct entitlement. Necessary transaction and security records may be retained for legal obligations, reconciliation and dispute handling; any records retained after a deletion request are explained with their basis and period.

Refund and dispute handling notices

For refunds, chargebacks or order-reconciliation errors, the server may send administrators a case identifier, order number, store outcome, refund amount and handling deadline through Alibaba Cloud email services. These messages do not contain questions or reading content. They are operational notices, not marketing emails to you. Copies in the email service and recipient mailbox are not automatically erased when an app account is deleted. You can make a data-rights request for us to review and handle copies under our control. If legal obligations or dispute handling require retention, we explain the basis and period.

Answer feedback and uploaded content

Answer feedback is optional. Before sending, you can read the upload notice, choose the conversation scope and preview its contents. The default scope includes the visible user and assistant messages in that conversation up to the selected answer; you can choose only the current exchange instead. The feedback you write and selected messages may contain personal information. Messages after that answer, hidden profile fields, internal instructions, reasoning and tool data are not automatically attached. When you tap Send, the app uploads your feedback and selected conversation snapshot over HTTPS to the Fortune Chat service, linked to your signed-in account ID. The submission also includes conversation, message and available request identifiers, message status and times, app and operating system versions, language and the upload notice version. Only authorized staff can view it in the administration system to review, investigate and handle your feedback. It is not shown to other users. Feedback is not anonymous; its body is stored separately from ordinary technical logs and is not sent to Firebase Analytics or Crashlytics. Feedback text, conversation snapshots, search copies and processing notes are retained for 180 days from submission, regardless of processing status. At expiry they become unreadable through the service and scheduled cleanup removes them; backlogs or retries may delay physical cleanup. Account deletion also removes these account-linked records without waiting for the 180-day expiry, retaining only a minimal content-free record to prevent later writes. Deleting a local conversation or disabling Firebase collection does not delete feedback already submitted. You can use readings without sending feedback.

Technical reports and email feedback

When you view logs or compose email feedback, the app prepares a limited technical report with app/Android version, service environment, operation and network status, error codes, timing and request/call identifiers. These identifiers can help correlate a failure with service records; the report is not anonymous. The report excludes profile and conversation bodies, account identity and payment proofs. You may review or copy it. Composing email feedback attaches the report, or includes it in the message if attachment sharing is unavailable. Your own message may contain personal information you choose to include. For this email workflow, an email or share app opens for you to review and send; Fortune Chat does not send the message automatically. Clipboard and external email copies follow the destination’s storage rules. Firebase switches do not disable feedback you choose to send.

Optional analytics and diagnostics

When enabled, Analytics may process app interactions, purchase events, approximate location derived from IP addresses and app-instance identifiers. Crashlytics may process stack traces, app and device information, and installation identifiers. These purposes have separate consent. After analytics consent and confirmation of both sign-in identity and server account status, the original Firebase UID is set as Analytics userId before collection starts. Guest analytics are not collected; names, emails, birth details, questions and beliefs are not event parameters. Sign-out, switching, freezes, unconfirmed identity and withdrawal pause account collection. Sign-out or current-account deletion clears the old identity and local analytics data. The server submits and retries Analytics deletion for the old UID in the configured analytics property. Submission is not proof of physical erasure, and does not retrospectively link anonymous events. Crashlytics handles technical errors only according to the diagnostics choice. No advertising purposes. With analytics allowed, the app can also provide the server with app-instance and request-correlation identifiers and consent status to connect client and server metrics and send them to Google Analytics according to that consent. This optional forwarding is separate from the service operation archive described above.

Change or withdraw consent

Settings → Privacy and data has separate switches for Firebase analytics and crash diagnostics. Choices are saved on this device. Turning a purpose off stops its subsequent collection or uploads. Analytics withdrawal resets local analytics data and identifiers; diagnostic withdrawal discards unsent reports. You can still sign in, calculate charts and request readings. These switches do not stop the processing needed for readings, personal memory or daily recommendations you continue to use, or the server operation records, content diagnostics and archives described above. Personal memory and daily recommendations have their own switches. Withdrawal does not affect prior lawful processing or erase existing data.

Account data deletion

In the app, go to the account page and choose Delete account. On the web, use the same Google account you use in the app to verify your identity and request deletion or check its status. Access is suspended after you submit the request. After approval, deletion starts automatically. Review and cleanup of the data we control are handled within 30 working days of successful submission. Requests cannot be withdrawn. If a request is rejected, access is restored. After this device confirms deletion, it signs out that account and erases its local profile, drafts, chats, readings, pending purchase records and associated caches. Interrupted cleanup resumes. Offline devices clean up after reconnecting and confirming. Other accounts are unaffected.

Open the account deletion page

Account business data, submitted feedback and its conversation snapshots, search copies and processing notes, point balances, diagnostic copies under our control and the Firebase sign-in identity are deleted irreversibly. Your Google/Gmail account is not deleted. Store subscriptions are not automatically cancelled or refunded. Erased top-up balances are not restored. Only minimum records for first-use recognition, subscription ownership, deletion status and credential verification, duplicate prevention and write barriers are kept permanently. Old content, profiles, billing periods and usage summaries are not kept. Re-registration does not renew a used trial. Only an active subscription whose former account has finished deletion can move to this account. Its initial allowance is 0%. A new seven-day allowance window starts when the server first restores it; it resets only if still active then. Repeated restoration does not restart the clock. Store billing dates and expiry do not change. Old profiles, history and erased top-ups are not restored. Another active subscription on this account will not be overwritten.

Data rights and requests outside the app

For access, export, correction, restriction or objection, use Settings → Privacy and data → Account deletion and data rights. If you cannot use the app, you can request deletion or other data rights at bixiaopeng2007@gmail.com without reinstalling it. Send from the sign-in email where possible; we verify ownership without asking for passwords or sign-in codes and explain the next steps, scope and necessary retention. We respond within one month and explain any necessary extension. Opening a draft email does not submit a request; review and send it yourself.

Service providers and international processing

Google/Firebase provides sign-in, optional analytics and crash diagnostics. Google Cloud BigQuery processes the analytics exports and aggregate reports described above. Google Play processes purchases. Cloudflare hosts the Fortune Chat service. OpenRouter and the selected inference providers process the information needed for readings, memory, recommendations and summaries. Routing is limited to endpoints classified as denying data collection and eligible for zero data retention. The provider may change between eligible endpoints. Provider terms govern metadata and any handling needed for safety or legal obligations. Photon, operated by komoot, handles place searches using OpenStreetMap data. Google Maps receives the place query when you choose to open it. Alibaba Cloud OSS/CDN hosts the public legal pages, and Alibaba Cloud email handles the operational notices described above. Network providers may process connection details such as IP addresses to deliver and protect the service. This web page loads no analytics or advertising scripts.

Providers may process data outside your country under their policies and service arrangements. Local and server records follow the deletion process and limited retention above. Contact support about applicable transfer safeguards. You may complain to your local data-protection authority. Refusing optional analytics does not restrict core features.