Privacy Policy

Palm images. When you use the scan feature, you upload a photo of your hand. We process it on our servers to detect hand landmarks and major lines.

Email address. When you subscribe to the 7-day letter series or buy a reading, we store your email so we can send you the letters and your receipt.

Account and payment data. If you purchase a paid reading, our payment processor (Creem) handles your card details directly. We receive only a transaction reference and the last four digits of the card.

Usage data. Standard analytics — pages viewed, device type, approximate region. We use this to improve the product and to spot bugs. We do not build advertising profiles from it.

Palm images are deleted automatically seven days after upload by default. The reading itself (text, line annotations, summary) is kept in your account so you can revisit it; the underlying photograph is not.

You can shorten this window or delete a specific image at any time from your account page. You can also opt to keep an image longer if you want to compare scans over time — but that is opt-in, never the default.

If you delete your account, all palm images are removed within 24 hours, even if their seven-day window had not yet expired.

Inside your account settings there is a button labeled Delete all my data. Pressing it permanently removes your profile, all palm images, all reading history, and your subscription record. We send a confirmation email and keep no shadow copy.

If you don't have an account (you only subscribed to the letter series), every email we send has a one-click Unsubscribe link at the bottom. Clicking it removes your address from our list immediately.

You can also email hello@destiny.example and ask us to delete your data. We will respond within 7 days.

GDPR (European Economic Area, UK)

• Right to access — request a copy of your data.
• Right to rectification — fix anything that is wrong.
• Right to erasure — be forgotten.
• Right to data portability — export your readings in JSON.
• Right to object — opt out of processing for marketing.
• Right to lodge a complaint with your data protection authority.

CCPA / CPRA (California)

• Right to know what we collect and why.
• Right to delete personal information.
• Right to correct inaccurate information.
• Right to opt out of the sale or sharing of personal information.
• Right to non-discrimination for exercising any of these rights.

To exercise any of these rights, email hello@destiny.example. We do not sell personal information, full stop.

We use a small set of cookies. Here is the whole list.

• Session cookie — keeps you logged in. Strictly necessary. Expires when you close the browser or log out.
• Preference cookie — remembers your language and theme choice. Optional. Expires after 6 months.
• Analytics cookie — anonymous page-view tracking via PostHog. You can opt out from the cookie banner. Expires after 12 months.

We do not use third-party advertising cookies. We do not run Facebook Pixel, Google Ads tags, or TikTok pixels on this site.

Palm images and account data are stored encrypted at rest. Connections to the site are encrypted in transit (TLS 1.2+). Access to production data is limited to a small number of engineers and audited.

No system is perfectly secure. If we ever suffer a breach affecting your data, we will notify you within 72 hours of becoming aware of it, with a clear explanation of what was exposed and what we are doing about it.

Destiny is intended for users 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, please email us and we will remove the account.

Our servers are based in the United States. If you are accessing the service from outside the US, your data may be transferred to and processed in the US under standard contractual clauses or equivalent safeguards.

If we materially change how we handle your data, we will email you and update the Last updated date at the top of this page. Minor edits — typos, clarifications — we will quietly fix.