Privacy

The short version

You pay, you upload photos, we analyze them, you get a written reading by email. Your original uploaded photos are automatically deleted within 3 days after your reading is successfully delivered. Your finished reading intentionally keeps a small, optimized copy of your photo inside it — that copy is part of what you purchased, and it belongs to your report, not to a photo library.

Your photos

Uploaded photos are used for exactly one purpose: producing the reading you purchased. They are stored in a private bucket, are never made public, never used to train AI models by us, and never reused for any other customer or purpose.

Deletion schedule, enforced automatically:

• Delivered readings — every original uploaded photo is deleted within 3 days after your report is successfully delivered.
• Unfinished orders — if you pay but never finish uploading, anything you did upload is deleted within 30 days.

Deletion covers the original uploaded photo files. What remains afterwards: the reduced, display-optimized copy embedded in your delivered reading (with camera metadata such as location stripped), and the non-image records described below. Nothing else contains or can reconstruct your original images.

What we keep, and why

• Your reading (the delivered report, including its embedded optimized photo copy) — kept so you can re-access it and we can re-send a lost link. Download links expire after 30 days; a fresh link can be issued on request.
• The written analysis behind your reading (non-image data: categorical observations, scores, and the reasoning trail) — kept so your reading stays consistent if it is ever re-generated, and for quality assurance. It contains no images.
• Transaction records (what was purchased, when, payment status) — processed by Stripe and kept as required for accounting and law. We never see or store your card number.
• Contact details you provide (email, name, and date of birth for numerology readings) — kept to deliver the service and handle support.
• Quality/audit metadata (which processing steps ran, when, and technical quality indicators) — kept to keep the product honest and debuggable. No images, no image URLs.

Who processes your data for us

We use a small set of service providers, each only for what their name suggests:

• Stripe — payment processing.
• Supabase — database and private file storage.
• Anthropic — the AI that analyzes your photos and writes your reading. Photos are sent for analysis only.
• Resend — sending our emails to you.
• Netlify — hosting this website.

We do not sell or rent personal information to anyone.

Email

Operational email (your report delivery, and a reminder if you paid but haven't finished uploading) is part of the service you purchased.

Promotional email is strictly opt-in: we send it only if you ticked the optional box at upload time, and every promotional email contains a one-click unsubscribe that works immediately and permanently. Unsubscribing never affects delivery of a reading you've purchased.

Analytics and advertising

We advertise on Meta (Facebook and Instagram), and this site loads the Meta advertising pixel so we can measure which ads lead to a purchase.

What it records: that a browser visited a page here, and — after a completed checkout — that a purchase happened and its value. We do not send Meta your name, your email, your date of birth, your answers, your reading, or your photos. Advanced Matching is off, and we do not build custom audiences from customer data.

Meta sets its own cookies through that pixel and its use of them is governed by Meta's own policies. Blocking third-party cookies or using a tracker blocker does not affect your reading in any way.

If you arrive from one of our ads, we also keep one small first-party cookie holding the ad-campaign labels from that link (nothing else, and never anything about you), so we can tell which ad led to a purchase. It expires after 30 days and is not set on ordinary visits.

Your choices and rights

Email hello@youdecoded.ca to access, correct, or delete the personal information we hold about you, or to ask anything about this policy. Deletion requests are honored except where a record must be kept by law (for example, transaction records). We respond from Canada under PIPEDA.