Privacy

Nine Numbers · ninenumbers.com

This page says what we hold, why, and how to get rid of it. It is written to be read, not to be survived.

The short version

You can use Nine Numbers without giving us anything. Nothing you type is sent anywhere until you either buy a reading, join the mailing list, or sign in.

If you buy a reading, we hold your email address, the birth details that reading was built from, and Stripe's record of the payment. We do not hold your card number. We have never sold anything to anyone and we are not going to start.

What stays on your device

Your saved people — names and birth dates — live in your browser's own storage. That is on your computer or phone, not on our server. Clearing your browser data deletes them, and we cannot get them back for you, because we never had them.

The one exception is a purchase. To sell you a reading we have to know which reading, and a reading is built from a birth date, so those details are sent to us at the moment you pay and kept with the order.

What we hold, and why

If you buy a reading. Your email address, the birth details the reading covers, the amount, the currency, the language you bought in, and Stripe's identifiers for the payment. We need these to deliver the reading, to send it to you again if you lose it, to handle a refund, and to keep the accounting records the law requires.

If you ask us to send your link again. Nothing new. We look up orders already attached to that address. We record that a request came from your network address, and only so that the form cannot be used to send mail at strangers.

If you join the mailing list. Your email address, the date, and the language you were reading in. Nothing else. Every message has a one-click way out and the link never expires.

If you sign in. Your email address and a record of when you last signed in. Sign-in links are stored hashed, never in a form that could be used to sign in as you, and each one works once and expires in fifteen minutes.

If you turn on syncing. The people you have saved, so the same charts open on your other devices. You can delete them from the Profiles screen, and deleting them deletes them from our side too.

What we do not do

We do not run analytics. There is no Google Analytics, no advertising pixel, no advertising network, no session recorder, and no third-party script watching you read. Nothing on the site is loaded from anywhere except our own domain and Stripe's payment page.

We do not sell, rent, or share personal information with anyone for their own purposes. We do not build profiles of you for advertising.

We do not use cookies to track you. Signing in sets one cookie, which exists only to keep you signed in, and it goes away when you sign out.

Cookies

We use one cookie, and only if you sign in. It holds your session so that you stay signed in between pages. It is marked HttpOnly and Secure, which means no script can read it and it is never sent over an unencrypted connection. It expires on its own, and signing out deletes it.

That is the entire list. There is no advertising cookie, no analytics cookie, no third-party cookie, and nothing that follows you to another site. We do not use local storage or any similar technology for tracking either — the saved people in your browser are there so the app works offline, they are not an identifier and they are never sent to us unless you buy a reading or turn on syncing.

Why there is no cookie banner. Under both the GDPR and Singapore's PDPA, a cookie that is strictly necessary to provide something you asked for does not require consent. Our one cookie is exactly that: it exists because you asked to sign in. We would rather say this plainly than show you a consent box for a choice that does not exist, and we will add one the day we introduce a cookie that genuinely needs it.

Who else sees anything

Stripe processes the payment. Your card details go to Stripe and never reach us — we never see, hold, or store a card number. Stripe is the merchant of record for your purchase, which means Stripe also handles the tax on it and sends you its own receipt. Stripe has its own privacy policy at stripe.com/privacy.

Our email provider transmits the messages we send you: your purchase link, your sign-in link, and the mailing list if you joined it. They see the address and the message, because that is what sending an email is.

Cloudflare hosts the site and the database. They see the ordinary traffic records any host sees.

That is the complete list. There is nobody else.

Marketing email

We will only send you marketing if you have asked for it. Ticking the box on the mailing-list form is that ask, and we record the moment you did it and where — because if you ever tell us you did not, we should be the ones who have to prove otherwise, not you.

Buying a reading does not put you on the mailing list. The email that carries your reading is part of what you paid for, and we do not treat a receipt address as a marketing one. You would have to join separately.

What we would send, if you join: occasional notes when something new is published, and sometimes an offer. Not more than a few times a year. Never your birth details, never your readings, and never anything about you to anybody else.

Every message has a one-click unsubscribe that needs no sign-in and no reply, and the link does not expire. One click is the whole process. If you unsubscribe we keep only your address and the fact that you opted out, because that is the only way to be sure we do not mail you again by accident — and we hold it for nothing else.

You can withdraw consent at any time and it takes effect immediately. It does not affect anything we sent before you withdrew it, and it does not affect a reading you have already bought.

Where your information goes

Nine Numbers is operated from Singapore, and the services we use to run it are outside Singapore. That means your information crosses a border, so here is exactly where and to whom:

• Cloudflare — hosts the site and the database. Data is held at the

edge location nearest you and in Cloudflare's network.

• Stripe — takes the payment. Stripe receives your email address and

the amount. We never see or hold your card number; it goes straight to Stripe and never touches our server.

• Resend — delivers our email. It receives your address and the

message we are sending you.

That is the complete list. Nobody else receives anything, and none of the three may use your information for their own purposes — only to do the job we engaged them for.

For transfers out of Singapore we rely on those providers' contractual commitments to protect your information to a standard comparable to the PDPA, as section 26 requires. For transfers out of the UK or the EU we rely on the Standard Contractual Clauses, which all three have in place.

How long we keep it

An order and its email address are kept for seven years, because tax and accounting rules require the record of a sale to be kept and we are not free to delete it sooner.

The reading itself stays with your order for as long as that record is kept. The PDF you downloaded is a file on your own device, and deleting anything here does not reach it.

Sign-in links are deleted after fifteen minutes. Rate-limiting records are deleted within a day. Mailing list entries stay until you unsubscribe. Synced profiles stay until you delete them or close your account.

Your say over it

Write to privacy@ninenumbers.com and you can:

• ask what we hold about you, and get a copy of it
• have anything wrong corrected
• have your account, your synced profiles and your mailing-list entry deleted
• take your data elsewhere, in a machine-readable file
• withdraw consent for marketing, at any time
• object to our holding it at all, or ask us to restrict what we do with it

We will answer within thirty days, and we will not charge you for asking. Where a sales record has to be kept for tax purposes we will say so plainly rather than quietly keeping it — Singapore requires those records to be held for five years, and that obligation survives a deletion request. We will delete everything else and tell you what remains and why.

If you are in Singapore. We handle personal data under the Personal Data Protection Act 2012. You may ask for access and correction under sections 21 and 22, and you may withdraw consent under section 16. If you are not satisfied with how we have handled a request, you may complain to the Personal Data Protection Commission at pdpc.gov.sg. Our data protection officer can be reached at the address above.

If you are in the UK or the EU. The lawful bases we rely on are: performing our contract with you, when you buy a reading; consent, for marketing email and for syncing; our legitimate interest in keeping the site secure and working; and a legal obligation, for the accounting records. You have the rights listed above under Articles 15 to 21 of the UK GDPR and the EU GDPR, and you may complain to your national data protection authority — in the UK, the Information Commissioner's Office.

We do not make any automated decision that has a legal or similarly significant effect on you. A numerology reading is generated by software, but it decides nothing about you: it is a piece of writing you asked us to produce, and nothing in it is used to judge you, price anything, or restrict what you can do.

Children

Nine Numbers is not for under-16s and we do not knowingly hold anything about one. If you believe we do, write to the address above and it will be deleted.

Changes

If this page changes in a way that matters, the change will be announced on the site and by email to anyone whose purchase or subscription it affects. We will not quietly widen it.

Who we are

Nine Numbers is operated from Singapore. For anything at all, including anything in this page: privacy@ninenumbers.com.