Privacy Policy

We process your email, password for authentication, and a stored password hash; verification and recovery records; account settings; wallet and transaction records; and service-security information such as IP addresses and request timing. API-key records include the owner, label, scopes, expiry, revocation, and last use. Raw API secrets are displayed once; the server stores their SHA-256 hashes.

Optional account information may include birth details and an ascendant. Account settings and reading-history records are separate from Vault storage. If you use account reading-history features, submitted questions, responses, reflections, location, cast details, and signal summaries may be stored in readable records. Choosing encrypted Vault custody protects the Vault record; it does not encrypt these separate service records.

Support requests contain the name, email, subject, message, and IP address you submit or transmit. When payments are available, Stripe processes payment information. We retain payment references and transaction records, not your full card number. Stripe’s privacy policy applies to its processing.

A saved observation, photograph hash, fresh monitor signal, completed session, or Set Context can anchor a cast. Coordinates are included only when you set context. Selected pulse data or heartbeat intervals and completed-session timing may contribute. The record distinguishes device-reported opening and input-commit times from the node’s observation when it accepts the event. These inputs are processed for the session; a server journey cache expires after two hours or on service restart.

Photograph frames are reduced to a hash in the browser; the image itself is not uploaded. Prompt text is held in the tab, and Save produces a salted hash for device storage and casting. If you request an AI response, the text is included in that request. If you choose encrypted Vault custody, the text can be stored inside that encrypted record.

A hash or commitment is a reference to input, not a guarantee of anonymity. It may still be personal information when linked to you. Avoid putting secrets or unnecessary identifying details in prompts, API nonces, or support messages.

An external AI request includes a canonical event token, saved prompt, selected reading preferences, any requested verified receipt, and messages needed for the conversation. Optional signal measurements are not included in that external request. A managed request can include relevant summaries. A managed request, when available, passes through Qualion to its configured provider. With your own OpenAI or Anthropic API account, the request and provider key go directly from the browser to that provider. The key stays in the tab rather than being saved by Qualion. Requests are encrypted in transit over HTTPS. The provider receives readable request contents to generate a response; this is not end-to-end encryption that hides the contents from the provider.

Provider privacy policies and account terms govern their processing and retention: OpenAI and Anthropic. We do not use your content to train our own AI models. Do not include information you do not want the selected provider to receive.

Vault records are encrypted in the browser with AES-GCM and a password-derived PBKDF2 key before upload. We do not hold that decryption key and cannot recover those records without it. Resetting an account password does not decrypt an older Vault. New Vault envelopes include the derivation salt needed to unlock them on another device. Older envelopes must first be unlocked and saved from their original device.

Your browser stores authentication tokens, selected coordinates, preferences, input hashes, active cast state, and device-kept cast records. A canonical event token may be kept for the current tab so retries and export use the same event. Vault information may also be cached in encrypted form. An HTTP-only refresh cookie supports account sign-in. Signing out ends existing account sessions; a password reset also revokes existing API keys. Two-factor recovery codes are stored as hashes and may be used once. Clearing browser data removes local copies and preferences.

Unkept prompt text and AI conversation remain in tab memory. Device-only Keep Private preserves the cast and commitment, not the plaintext prompt or conversation. With an unlocked Vault, Keep Private retains an encrypted device copy including selected text. Request Sync requests encrypted account storage and policy review. Discard deletes the current cast’s kept copy and clears context; other casts are preserved. Account deletion requires the matching unlocked Vault and a confirmed server response. It cannot recall issued receipts or erase records held by an external provider.

Event receipts store the commitment digest, nonce, optional claimed time, observed node time, signature proof, and idempotency record. Policy requests store the commitment, submitted purpose and namespace, parent commitments, owner, status, and human decision. Only submit information needed for these requests.

A receipt does not require event content. Human approval and durable activation are separate; activation is currently disabled. Revoking or expiring a key stops its authority but does not delete past receipts or decisions. The test console holds an entered key only for that page.

We use information to authenticate accounts, provide requested casts and AI interfaces, store records you choose to keep, verify requests, manage credit, answer support inquiries, and protect the service.

Where applicable data-protection law requires a legal basis, we rely on contract for requested services, legitimate interests for proportionate security and abuse prevention, legal obligations for required records, and consent where required for optional or sensitive processing. Heartbeat intervals may be health-related data; their processing must meet applicable explicit-consent requirements.

You can stop optional collection by disconnecting a monitor, declining camera or location access, clearing an input, or refraining from an AI request. Casting still requires coordinates, which you may enter manually. Withdrawing consent does not undo lawful earlier processing; contact us about stored information.

Hosting, email, AI, and payment providers process the information needed for their services. The website also loads fonts from Google Fonts, which may receive network information such as your IP address. We may disclose information when law requires it, to protect rights or security, or in a business transfer subject to applicable protections.

We do not sell or rent your personal information, provide it to advertisers or data brokers, or use advertising pixels or behavioral analytics. Provider activity requested by you is separate from these practices.

Tao, LLC is based in the United States. Qualion and its providers may process information in the United States or other countries where they operate. Data-protection rules may differ. Where applicable law requires a transfer safeguard, it must be in place; contact us for information about the safeguards relevant to your data. Choosing a provider under your own account also engages that provider’s international-processing terms.

The mock exchange stores signed token state, quotes, explicit consent, policy decisions and commitment links on the Ash node. These records contain pseudonymous session identifiers and demo amounts; they do not contain the raw personal inputs used for a Cast.

If you authorize linking a session, we store its association with your authenticated account and a signed account journal projection. Linking does not establish legal identity or physical presence. Subsequent access to that session requires the linked account. The account journal remains accessible after session expiry. Journal evidence is retained within bounded capacity rather than deleted automatically with temporary session access. Export your records and contact us about access, correction or deletion requests.

Accounts, encrypted Vault records, settings, and saved history are retained to provide those features. SYNC receipts and decision records support verification and repeat-request handling. Payment, support, and security records are retained as needed for their purposes or legal obligations. The transient journey cache expires after two hours; browser copies remain until you clear them or use the relevant removal control.

You can request access, correction, export, or deletion through Contact. We verify the request and respond within applicable legal time limits. Deletion may be limited by legal obligations, dispute handling, or necessary security records. A receipt copied by another party or data held by a provider under your own account is outside our direct control. Export anything you wish to retain before account closure.

Depending on applicable law, you may have rights to access, correct, delete, or port your information; restrict or object to processing; withdraw consent; and complain to a supervisory authority. EEA and UK data-protection rights and comparable rights in other jurisdictions apply where their requirements are met.

California residents may have rights to know, access, correct, delete, and opt out of sale or sharing for cross-context behavioral advertising, and to limit certain uses of sensitive information, where the CCPA/CPRA applies. We do not sell information or share it for that advertising purpose. We do not discriminate against you for exercising applicable rights.

We cannot decrypt your Vault to inspect or supply its plaintext. You can use your own unlocked Vault and available export controls to access those records.

We use HTTPS, access controls, hashed credentials, and Vault encryption to protect information. No service can promise absolute security. Keep credentials and exports secure and revoke a compromised API key promptly.

The service is intended for adults 18 and older and is not directed to children. If we learn that we have collected personal information from a child, we take appropriate steps to remove it and close the account. Contact us if you believe this has occurred.

We update the effective date when this policy changes and provide notice of material changes as required. A privacy notice is an explanation of processing, not a substitute for consent where consent is required. For questions, contact us.