Privacy Policy

1. Information and purposes

Sign-in: the account identifier supplied by your chosen sign-in provider (Kakao member number; LINE, Google or Apple user ID), your provider profile name, the email the provider has verified (where supplied), your Tiki nickname and language/region preferences are used to create and authenticate your account and deliver the service. Available fields depend on the provider and your permissions. When you sign up or agree again, we keep a consent record of the documents and versions you agreed to, with the time and language.

Content: test responses, introductory age, gender and MBTI answers, questions and relationship details you enter, results, images and sharing choices support tests, storage, AI generation and sharing. Chats use messages, input drafts stored on our server before payment, replies, images and your latest record for that character. For palm reading content, the palm and hand-edge photos you take or choose and the line positions you match on them are used to read your palm and write your reading, and the photos are kept so we can show them again before and after payment and in your reading. Hand photos are never used to verify or identify you. Avoid unnecessary real names, contact details and sensitive health or sexual information.

Transactions and operation: order IDs, products, amounts, currencies, payment/refund status, payment identifiers, ticket ledgers, acceptance records, access/error records and essential cookies support payments, fraud prevention and troubleshooting. Payment providers directly handle card information. Support messages are used to verify accounts/orders, answer questions and resolve disputes.

Reviews: the star rating and text you leave in a chat, the content reviewed and the time are used to improve the service and content and to give the thank-you benefit, and as anonymous reviews that do not identify you to introduce and promote content (Terms section 5).

Original Series: for members we keep the playback position and completion of each episode to offer continue watching (guest positions are not stored). Fate Key wallet entries (top-ups, spending, refunds, expiry) and episode unlock records are kept with your order records.

Report-ready email (overseas payments): for reports bought through Dodo Payments (Japan, Taiwan, Hong Kong and other overseas markets), we receive the email address you entered at checkout from the payment service and use it to send one email telling you the report is ready (members and guests alike) and, in hashed form only, for the purchase ad measurement described in section 7. The address is stored encrypted and deleted 7 days after sending, and in any case within 30 days of payment; it is deleted at once if the report is deleted or refunded.

Fox Drawer: collectibles you receive or use through draws, crafting or gifts and their times, daily free draw records and the draw ticket ledger (purchase, use and refund) are used to provide the drawer, operate the published odds and prevent misuse. Guests also create free draw records, which move to the member account when you sign in on the same browser.

Today's Fortune (members only): the name you want to be called, gender, date of birth (solar or lunar) and time of birth (optional) that a member enters are saved as member information and used to calculate and write each day's fortune. Daily fortune results (score, grade, recommended content and text) are used to show the same result again that day and to avoid repeating the same recommendation. To write the text, the name and the saju calculation results (sexagenary characters and scores) are sent to an AI service provider (OpenAI); the date and time of birth are not sent.

App notifications: when you allow notifications in the app, we receive your device's push token, the operating system's notification permission status, the app version, your language and market, and your time zone, and use them to send service notifications such as report-ready alerts. We do not send advertising notifications without separate consent. Declining notifications does not limit your use of the service, and you can turn them off at any time in your phone settings.

2. Grounds and retention

We process information needed to enter into and perform the service contract, meet legal duties and honor your choices and consent. Account and content information is kept for service delivery and deleted without undue delay upon deletion, withdrawal or completion of its purpose. Guest tests normally remain accessible in the same browser for seven days from starting; expired records are removed through cleanup jobs. Hand photos attached to a reading are deleted when you delete that reading or your account. A hand photo not followed by payment is replaced when you take a new one, and is deleted when a member deletes their account or, for guests, by a cleanup job after seven days.

Records subject to Korean legal retention requirements include contracts, withdrawal, payment and supply records for five years, consumer complaints/disputes for three years and advertising records for six months. Such records are used only for the required purposes. Electronic files are deleted in a manner designed to prevent recovery; paper is shredded. Email contact@tiki.boo for confirmation of the scope and removal timing of residual external copies or provider backups after deletion.

Reviews are kept when you delete a report or your account. When you delete your account we remove the link between the review and your account and keep it as text that does not identify you, for the purposes in section 1. Email contact@tiki.boo before deleting your account to delete a review or stop its promotional use.

Sign-in sessions last 30 days on the web and 90 days in the app and end when you sign out or they expire. For each session we keep only a hash of a random token, the device type (web, iOS or Android) and its creation, last-use and expiry times. When you delete your account we remove your sign-in provider links and end all sessions. Account consent records are kept after deletion to show that consent was given.

Fox Drawer records are deleted when a member deletes their account, and guest records are removed by a cleanup job after seven days without sign-in. Draw ticket payment and refund records are kept for the statutory retention periods above.

Today's Fortune birth information is destroyed without delay, together with the daily results, when the member deletes it on the fortune screen or deletes their account. Daily fortune results are deleted after 90 days.

App notification device information (such as the push token) is deleted when you sign out or delete your account, or after 90 days without use. Notification delivery records are kept for 90 days and then deleted.

3. Providers and overseas processing

We use Supabase for databases and files, Vercel for web hosting and OpenAI for AI text and image generation. Your chosen sign-in provider handles authentication. Toss Payments processes Korean payments; Dodo Payments handles international payments where offered. Our email service receives support inquiries sent to contact@tiki.boo. Each provider receives information needed for its function. Report-ready emails are sent through Resend (United States), which receives the email address and the report link for delivery.

AI requests may send your questions, original test responses, hand photos, relevant results and conversation context to OpenAI. Generation and service operations may involve processing by overseas providers, including in the United States. Email contact@tiki.boo about overseas processing or to request discontinuation. You may choose not to use AI content generation or chats; without this processing we cannot provide the requested AI feature.

Original Series videos are stored and delivered through Amazon Web Services (Seoul region); access IPs and request logs may be recorded by AWS while streaming.

App notifications are delivered through Apple (Apple Push Notification service, United States) and Google (Firebase Cloud Messaging, United States), which receive the device push token and the notification content. Notification text shown on the lock screen does not include content names or report links.

4. Public results and derived records

Each content report (tarot, saju, palm reading and similar) has one link. Anyone with the link can see the whole report, including what was entered for it such as a name, birth date and time, palm photo or concern. The link can spread when it is shared with the share button. A report bought without signing in stays unassigned to any account; once you sign in and assign it to your Library, deleting it also ends access through the link.

Issuing a share link is optional. It exposes your result and Tiki nickname to link holders. Account details, email, orders and lists of other records are not public.

Deleting the result ends access through its share link. Copies outside Tiki are not all withdrawn automatically. Email contact@tiki.boo about rights concerns or deletion requests.

5. Your rights and deletion

Settings lets you change your nickname and delete your account; saved records also have deletion controls. Requests for access, correction, deletion, restriction, consent withdrawal or action through a representative go to contact@tiki.boo with minimal necessary identity verification. We explain restrictions such as legal retention duties.

6. Cookies and safeguards

Essential cookies maintain sign-in, prove ownership of guest tests and remember language/region. A sign-in session cookie (30 days) keeps you signed in, and short-lived cookies that expire after 10 to 15 minutes protect the sign-in flow against forgery and hold a pending sign-up consent. Scripts on the page cannot read these cookies. We keep where you came from for ads and campaigns (utm values, ad click identifiers, the referring site's domain, the first page you opened and the visit time) in a cookie for 30 days and record it with your orders to measure ad performance and send payment notices. Browsers that send Do Not Track or Global Privacy Control do not get this cookie. Analytics and ad measurement cookies are described in section 7. Browser settings let you block or delete cookies, which may prevent sign-in or access to guest results. Responses, results, chats and images are not stored in browser localStorage, IndexedDB or offline caches.

We apply access restrictions, encrypted communication and private-file access controls. We do not sell personal information for advertising.

7. Analytics and ad measurement

We use Google Analytics (linked to Google Ads), Google Tag Manager, the Meta Pixel, the TikTok Pixel, the X Pixel and the Naver ad conversion tracking script for usage statistics and ad performance measurement. These tools automatically collect the addresses of pages you visit, usage events such as page views and content start button clicks, IP address, browser and device information, cookie identifiers and ad click identifiers, and send them to Google, Meta, TikTok, X and Naver, where they may be processed on servers in the United States, Singapore and other countries. When a purchase is completed, we also send Meta and TikTok, with the purchase event, hashed forms of your account identifier and of the buyer's email address and phone number (whichever we have: the email confirmed by your login provider, the email received at checkout, or a phone number you gave us for notifications or sign-up), which cannot be turned back into the originals, so that ad results can be linked to Meta and TikTok users and ad delivery can be optimized. The original email address and phone number, names, test responses, results, chat content and payment method details are not sent.

The Android app uses the Meta SDK to measure ad performance. It automatically collects app installs and launches, in-app purchase records (product and amount), your device's advertising ID, device and operating system information and IP address, and sends them to Meta. Names, email addresses, phone numbers, test responses, results, chat content and payment method details are not sent. You can opt out by resetting or deleting the advertising ID in your phone settings.

When first launched, the Android app reads the Google Play install referrer once and uses only the classified install route (Meta ads, Google ads, organic or other) and the campaign name for app usage analytics (Mixpanel, United States) and for recording the order's referral source. The original referrer, ad click identifiers and encrypted ad information are not collected or stored.

Google may use this information to provide usage statistics, measure ad performance, optimize ad delivery and show personalized ads (including ads shown again to Tiki visitors), and Meta, TikTok, X and Naver may use it to measure ad performance and optimize ad delivery. For users signed in to a Google Account with personalized ads turned on, Google may link this information to that account for cross-device usage statistics and personalized ads (Google signals). Collected information is kept according to each provider's policies and the retention periods we configure, then deleted.

You can refuse collection by blocking or deleting cookies in your browser or using tracking protection, and refusing does not limit your use of the service. You can also opt out or adjust collection with the Google Analytics opt-out browser add-on, My Ad Center in your Google Account (turn off personalized ads), the ad preferences in your Meta account, the ad personalization settings in the TikTok app, the personalized ads setting in your X account, Naver's personalized ad settings, or your phone's advertising ID reset and tracking limits. Questions and opt-out requests go to the email address below.

8. Contact and updates

Mindful Labs Inc. handles privacy matters and rights requests by email at contact@tiki.boo. We announce changes and effective dates in the service, and obtain consent for changes that require it, including relevant changes to processing or disclosure purposes.