Privacy Notice

1. Who controls the data

The Destiny Experiment project operates this service and determines why participant data is processed. Privacy and data-rights requests can be submitted through the private request ledger. Paid public registration remains disabled until the operator’s final legal identity and payment terms are published.

2. What we collect

• Account data: display name, email, email-verification state, password-derived credential, sessions and security metadata.
• Birth data: date, time or time accuracy, city/region, country and optional gender convention.
• Self-reported life data: relationship, education, career, migration, wealth ranges, decisions and timeline events.
• Sensitive health responses only after separate explicit consent.
• Service records: consent versions, consistency checks, contribution history, non-cash Pangu Coin index choices, resident-to-resident gift history and support requests.

Do not submit another person’s data or exact financial account numbers, identity documents, medical records or passwords.

3. Why we process it

We use account data to authenticate residents; birth and life-event data to create private readings, anonymous cohorts, matched comparisons and exploratory indexes; and technical data to prevent abuse, secure the service and diagnose failures. Health information is used only for consented, aggregate self-report observations—not diagnosis or individual disease prediction.

4. Public and private boundaries

Public boards use anonymous Resident Numbers, samples and aggregates. They do not intentionally publish email addresses, names, precise birth records, health rows, wealth rows, gift history or free-text support messages. Gift history is visible only to its sender, recipient and authenticated administrators. Small samples are suppressed.

5. Storage and processors

Production account and research records are stored with Cloudflare infrastructure, including D1 and Workers. Browser storage keeps a local session presentation cache. Account verification and password-reset messages may be delivered by Resend after that service is activated. When you ask us to identify a birthplace, the city- or district-level text is sent from our server to the OpenStreetMap Nominatim geocoding service without your email, Resident Number or account identifier. We cache only a one-way query hash and the resulting public place coordinates. Do not enter a street address. Service providers may process data in multiple countries under their infrastructure and contractual safeguards.

AI report synthesis is optional and requires a separate confirmation. When enabled, the configured model provider receives only program-derived chart facts, matched rule records and uncertainty markers. Version 0.1 excludes your raw birth date, clock time, birthplace, email and self-reported life events from the model prompt. The provider request uses its non-persistent response option, while limited security or abuse-monitoring retention may still follow that provider’s published policy. A rules-based report remains available when you do not consent.

6. Retention and deletion

Account and source research rows remain until the resident deletes the account or a legal or security reason requires limited retention. “Delete my cloud account and data” removes the account, profile, modules, wallet and index choices. A community gift row may remain with the deleted resident reference removed, because deleting it would incorrectly change another resident’s balance. Previously generated non-identifying aggregate snapshots may remain because they no longer identify a resident. Security and support records are retained only as needed for abuse prevention, legal requests and operational follow-up.

7. Your choices and rights

A signed-in resident can download a machine-readable export and delete the cloud account. You may also request access, correction, restriction, withdrawal of consent or clarification through the request form. Rights vary by jurisdiction. Withdrawal does not make earlier lawful processing unlawful.

8. Security

We use encrypted HTTPS transport, password hashing, signed sessions, server-side authorization, rate limiting, purpose-separated tables and restricted APIs. No internet service can promise absolute security. Report suspected exposure through the safety category in the request form.

9. Children

The service is for adults aged 18 or older. We do not knowingly accept profiles from children. A birth date indicating a participant is under 18 is rejected.

10. Research limitations and changes

Records are self-reported and subject to selection, recall and measurement bias. Correlation is not causation. We may update this notice as the product, operator or law changes; a new version and effective date will be displayed and material changes may require renewed consent.