This Privacy Policy explains how 今日宜 Today Yi (TodayYi.com, the "Service", "we", "us") collects, uses, shares and protects your personal information, and the rights you have.

1. Who we are

The Service is operated by Yamavista 株式会社, a corporation organized under the laws of Japan (Corporate Number 8011701027785; Representative Director: 劉峙瑛), which is the controller of your personal information and a business operator handling personal information under Japan's Act on the Protection of Personal Information (APPI).
Email: info@todayyi.com
Address: Suite 511, 9-1-7 Akasaka, Minato-ku, Tokyo 107-0052, Japan

2. What we collect and why

• Account data: your email address. Sign-in uses one-time codes sent to your email only; there are no passwords and no phone-number or third-party (social) sign-in. Used to create and secure your account and send sign-in codes and service notices.
• Birth and preference data: nickname (optional), gender, date of birth (Gregorian or lunar), birth time/时辰 (optional), birthplace, current time zone, preferred delivery time, and your Simplified/Traditional Chinese preference. Used only to generate your personal almanac content and deliver it at the right time in your preferred script.
• Delivery channel data: the delivery method you choose, a record of your opt-in to daily messages and your opt-out status. For Telegram: the chat ID Telegram provides when you link your account; for phone notifications (web push): the push subscription endpoint and keys generated by your browser, and your device/browser type. Used to send daily almanac messages and honor opt-outs. If we add other messaging channels in the future, we will process the data a channel needs only after you choose and link it.
• Check-ins: the dates of your daily check-ins (打卡), the system-generated suggested task for that day, and your streaks/badges. Used to show your progress on the website. There is currently no free-text notes field.
• Subscription data: Stripe customer and subscription IDs, plan (monthly/yearly), trial and subscription status and period dates. Used to determine access and manage trials and renewals.
• Payment data: collected and processed directly by Stripe as merchant of record (Stripe Managed Payments). Card details are entered only on Stripe's checkout page; we never see or store full card numbers.
• Technical data: our providers automatically process IP addresses, browser/device type, request times and error logs to operate, secure and troubleshoot the Service.
• Anonymous page-view statistics: when you open a page on this website, our own first-party counter records an anonymous page view: the page visited, the referring website's domain only (e.g. t.me, not the full link), the campaign source tag in the link (the ?from= parameter), Simplified/Traditional display, device type (mobile/tablet/desktop), the country/region estimated from your browser's time zone plus the time-zone name, and a random anonymous ID stored in your browser's local storage (used to count unique visitors; not linked to your account). We do not store IP addresses, read cookies or use device fingerprinting. This data is kept in our own Supabase database, is not sold or shared, and is used only in aggregate to understand which pages are viewed and to improve the website. Nothing is recorded if your browser sends Do Not Track or Global Privacy Control; you can also reset the anonymous ID by clearing your browser's local storage.

We do not use advertising trackers or third-party analytics (such as Google Analytics or Meta Pixel) and do not set advertising cookies; the anonymous page-view statistics above are our own. The website stores only what it needs in your browser's local storage: your sign-in session, script/language preferences, cached profile and check-in data, and the random ID used for anonymous page-view statistics. You can clear this in your browser at any time (you will need to sign in again).

3. Legal bases (EU/UK GDPR)

• Contract: providing your account, generating your almanac, delivering the daily content you subscribe to, and managing your subscription;
• Consent: sending daily messages on the channel you choose (withdraw any time by sending 退订 / /stop on Telegram, turning off notifications on the website or your device, or contacting us; withdrawal does not affect prior lawful processing);
• Legitimate interests: security, fraud and abuse prevention, troubleshooting, and improving the Service in aggregate;
• Legal obligation: keeping records required by law, tax and accounting rules.

4. Sharing and service providers

We share personal information only with providers that power the Service, acting on our instructions or under their own privacy policies:

• Supabase (database and authentication; data stored in the United States);
• Resend (email delivery, e.g. sign-in codes);
• Stripe (including Link) (payments, subscription billing, tax calculation and remittance, fraud and dispute handling; as merchant of record, Stripe also processes payment data as an independent controller under the Stripe Privacy Policy);
• Telegram (daily message delivery to your linked Telegram account);
• Browser / operating-system push services (such as Apple, Google and Mozilla push services, which deliver phone notifications to devices where you turned them on);
• Hostinger (website hosting and CDN).

We may also disclose information where required by law, to protect rights and safety, or in connection with a business transfer (we will notify you). We do not sell your personal information and do not "share" it for cross-context behavioral advertising, and have not done so in the past 12 months.

5. Birth information

Date and time of birth, gender and birthplace are used solely to generate almanac content under the traditional Chinese calendar. We do not use them to infer your health, personality, creditworthiness or other characteristics, do not use them for advertising profiles, and do not make automated decisions with legal or similarly significant effects.

6. International transfers

Our providers process data mainly in the United States and may process it in other countries. Where required, we rely on appropriate safeguards offered by our providers (such as the EU Standard Contractual Clauses or equivalent mechanisms). By using the Service you understand that your information will be processed outside your country, including in the United States, where data protection laws may differ.

7. Retention

• Account, birth, preference, delivery channel and check-in data: kept while your account exists; deleted or anonymized within 30 days after you ask us to delete your account (residual backup copies are overwritten in the normal backup cycle);
• Message consent and opt-out records: may be kept for a reasonable period after opt-out to demonstrate compliance;
• Subscription and payment records: kept as long as required by law, tax and accounting rules; Stripe retains payment records under its own obligations;
• Technical logs: kept briefly by our providers for security and troubleshooting;
• Anonymous page-view records: kept for up to 24 months, then deleted automatically.

8. Your rights

Subject to applicable law, you may: access your personal information and obtain a copy; correct inaccurate data (most profile data can be edited on the "我的 / My" page); delete your data and account; receive your data in a structured, commonly used format (portability); object to or restrict certain processing; withdraw consent at any time (including by sending 退订 / /stop on Telegram or turning off phone notifications); and complain to a data protection authority. We will not discriminate against you for exercising your rights.

• EU / UK: all GDPR / UK GDPR rights above; you may complain to your local supervisory authority (in the UK, the ICO).
• California (CCPA/CPRA): rights to know, access, correct and delete, and to opt out of sale or sharing — we do not sell or share, so no action is needed; we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent (we may verify your identity and the agent's authority).
• Canada (PIPEDA): rights to access and correct and to withdraw consent; you may complain to the Office of the Privacy Commissioner of Canada.
• Japan (APPI): rights to request disclosure, correction, suspension of use or deletion of retained personal data and disclosure of third-party provision records. Your data is provided to the providers listed above located in the United States and other countries, which maintain reasonable security measures.
• Singapore / Malaysia (PDPA): rights to access and correct personal data and withdraw consent; you may complain to the local personal data protection authority.
• Hong Kong (PDPO): rights to make data access and data correction requests; you may complain to the Privacy Commissioner for Personal Data. We do not use your personal data for direct marketing.
• Taiwan (Personal Data Protection Act): rights to inquire, review, obtain copies, supplement or correct, request cessation of collection/processing/use, and request deletion.
• Australia (Privacy Act / APPs): rights to access and correct personal information; you may complain to the Office of the Australian Information Commissioner (OAIC).

9. How to exercise your rights

Email info@todayyi.com from your account email with your request. We may ask you to verify your email to protect your account. We usually respond within 30 days and in all cases within the period required by applicable law (e.g. 45 days under the CCPA, extendable as permitted). Requests are generally free of charge.

10. Children

The Service is intended only for users aged 18 or older (or the age of majority where you live), as stated in our Terms of Service. We do not knowingly collect personal information from children under 16; if we learn that we have, we will delete it promptly. Parents who believe their child has provided us information may contact us.

11. Security

We use reasonable technical and organizational measures, including HTTPS encryption in transit, database access controls (row-level security), keeping secret keys off the client, passwordless email-code sign-in, and access limited to what is necessary. No method of transmission or storage is completely secure.

12. Changes

We may update this policy from time to time. The updated version will be posted on this page with a new "Last updated" date; for material changes we will notify you in advance by email or on the website.

13. Contact

Yamavista 株式会社, a Japanese corporation (kabushiki kaisha) operating 今日宜 Today Yi / TodayYi.com; Representative Director: 劉峙瑛
Email: info@todayyi.com
Address: Suite 511, 9-1-7 Akasaka, Minato-ku, Tokyo 107-0052, Japan
Disclosure under the Specified Commercial Transactions Act: tokushoho.html