Privacy Policy
Effective 2026-09-10 · version v2 · CELESTRY
This English version is provided for reference. The Korean version is the binding text; if the two differ, the Korean version governs.
Lama Works (the "Operator") handles personal data in the CELESTRY service as set out below. This policy is written under Article 30 of the Personal Information Protection Act of Korea.
1. Purposes and data collected
| Purpose | Data | Required or optional | Use | Retention |
|---|---|---|---|---|
| Reading generation and anonymized research | Birth date, birth time, birthplace, sex used for the calculation, reactions to the reading | Required | Generating your reading; anonymized validation research and product improvement | Until the validation research ends or you ask for deletion |
| Launch updates | Email address (typed in, or provided by a Google account) | Optional | Sending launch and development updates | Until you unsubscribe or ask for deletion |
| Account (Google sign-in) | Email address, profile name, profile picture, Google account identifier | Required | Identifying you and signing you in; saving and reopening readings | Until you delete the account |
| Account (Kakao sign-in) | Kakao account email with its verified and valid flags, nickname, profile picture, Kakao member number | Required | As above | Until you delete the account |
| Account (Naver sign-in) | Email address, nickname, profile picture, Naver user identifier | Required | As above | Until you delete the account |
| Account, all providers | Time of the age-14 confirmation, preferred language, consent records | Required | Legal confirmation, screen language, evidence of consent | Consent records are kept de-identified for the statutory period after deletion |
| Profile | Nationality, place of residence | Optional | Tailoring content | Until you delete the account or ask for deletion |
| Marketing | Email address, time of marketing consent | Optional | News and new-product announcements (may include advertising) | Until you unsubscribe or delete the account |
| Access logs | Time of access, device and browser type, country-level location, session identifier | Collected automatically | Operating the service, finding errors, usage statistics | 3 months |
Reading data is never linked to a name or contact details. Email addresses are stored separately from reading and research data and are not joined to them. Birth information is never placed in public results or analytics properties. When you create an account, reading data and account data live in separate tables, and the account side holds only a reference number pointing to a reading.
When paid purchases begin, order and payment records will be added to this table and announced in advance.
2. Transfer of personal data abroad
To run the service, the Operator entrusts data processing to the companies below, which store or process data outside Korea.
The data transferred, the recipient, the country, the purpose and the retention period are listed in the table below. Transfers take place over the internet while you use the service. You may refuse the transfer abroad, but the service cannot then be provided.
| Recipient | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Vercel Inc. | United States | 접속 기록, 요청에 담긴 입력값 | 웹 서비스 호스팅과 서버 실행 | 서비스 제공 기간 |
3. Outsourced processing
The Operator entrusts hosting and data storage to the companies below. The database sits on servers in Seoul, Korea; the company operating it, Supabase Inc., is a US company. When payments begin, a payment gateway will be added; when email sending begins, a sending provider will be added, and this policy will be updated. Processors are bound by contract to handle personal data safely and are supervised.
| Processor | Company country | Data location | Work entrusted |
|---|---|---|---|
| Vercel Inc. | United States | United States | Web hosting and server execution |
| Supabase Inc. | United States | Seoul, Korea (AWS ap-northeast-2) | Database and sign-in session storage |
4. Provision to third parties
The Operator does not provide personal data to third parties, except where required by law.
5. Deletion procedure and method
Data is deleted without delay when its retention period ends or its purpose is fulfilled. Electronic files are erased in a way that cannot be recovered.
When you delete your account, this is the order: the Kakao or Naver connection is unlinked, sign-in information is deleted, the account's personal data is cleared, the list of saved readings and the profile are deleted, and the Supabase authentication account is deleted. The Kakao member number and the Naver user identifier are also deleted. Consent records and, once payments begin, order records are kept in a form that cannot identify you for the period the law requires.
6. Rights of data subjects and legal guardians
Anyone may view, correct, delete and download their personal data. With an account, you do this yourself on the My Info screen. Without an account, or to delete reading data, send a request to the contact below. Requests are handled without delay.
Each consent may be refused. Refusing the reading consent means a reading cannot be generated. Refusing any other consent only disables that feature and carries no other disadvantage.
7. Children under 14
The Operator does not collect personal data from children under 14. Age is confirmed when an account is created. If data from a child under 14 is found to have been collected, it is deleted without delay.
8. Cookies
A session cookie keeps you signed in and a language cookie remembers your screen language. No advertising cookies are used. You can refuse cookies in your browser settings, but you will then not stay signed in.
9. Security measures
All communication is encrypted. The sign-in session is kept only in a cookie that browser scripts cannot read. The database cannot be reached from the browser; only the server accesses it. Access rights are kept to the minimum needed for operation.
10. Privacy officer
Send questions, complaints and requests to exercise your rights to the privacy officer below. You may also report a privacy violation to the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118).
11. Changes to this policy
Changes are announced on this page at least 7 days before they take effect. This is version 2, effective 10 September 2026. Version 1, effective 24 August 2026, had no sections on accounts, transfers abroad, outsourced processing, deletion, rights or the privacy officer.