What does Basic send?
Basic has no free-text question field. When you cast, the browser sends the fixed Decision × Any time scope, reading language, and necessary feature state to the server in a POST request. The server forms the hexagram randomly and returns classical data and pre-written aligned Chinese and English readings. A Basic cast does not make a live language-model call.
The current code has no product analytics and no free-text question that could be placed in a URL or dedicated access-log field. Production is hosted in Render’s Singapore region. Connections pass through the Cloudflare protection layer used by Render before reaching the site’s FastAPI/Uvicorn service. Application access logs may record the IP address received by the service, time, path, HTTP method, and status. They are available only to the Render account holder, with no third-party log stream connected. The current Render Hobby workspace retains dashboard logs for seven days.
What stays in the browser?
After a successful cast, the journal stores the latest five entries in this browser’s localStorage, including time, selected scope, display language, hexagram, classical passages, and the complete reading. A successful Plus preview entry also includes the custom question. These journal records are not automatically uploaded, backed up to an account, or synchronised across devices, and they are not represented as encrypted.
Language choices and local development preferences also remain in localStorage. Clearing site data, using private browsing, changing browsers, or moving to another device may erase or strand the records. Copy all can make a personal backup, but the interface does not yet provide per-entry deletion or a clear-all journal control. To remove the records immediately, use the browser’s clear-site-data controls.
The allowance cookie and site database are different
After each successful Basic use, the server sets a cookie named iching_quota. It contains the Hong Kong calendar date, this browser profile’s use count, and a tamper-detection signature—not a journal or question. A signature verifies that the value was not changed; it does not mean the value is encrypted. The cookie is HttpOnly, SameSite=Lax, and has a two-day maximum age; production also adds Secure.
A separate SQLite database stores the total number of successful site-wide casts for each date, for operational observation and to support a shared cost cap if one is needed later. Public Basic serves prepared content without incurring a live AI-provider cost, so the site-wide total does not currently reject casts; the three-per-browser-profile daily limit remains in place. While a cast is processed, the database still briefly stores a random reservation token, date, and creation time so the quota mechanism remains verifiable. The token contains and links to no browser identity, IP address, journal, hexagram, or question. A successful reservation becomes part of the total; a failed or degraded one is released. An interrupted reservation expires after ten minutes and is removed during later quota activity. The database sits on Render’s encrypted persistent disk. Render creates an encrypted snapshot each day and keeps snapshots for at least seven days. Daily totals have no automatic deletion job today and remain until the operator removes them manually or a future cleanup rule is added.
Where does a Plus preview question go?
Plus remains a local preview and planned feature. Production has no public Plus entitlement, custom-question entry point, or AI-provider credential; the server-side gate rejects Plus even if a request is modified. The public Basic service therefore accepts no custom question and sends no casting data to an AI provider.
Local development preview has a separate personalisation path under test. A custom question first reaches the local server for format and crisis-signal screening, then may use the Anthropic API or a local-only CLI path to produce a reading. This is not part of the current public service. If Plus launches later, the actual provider, region, logging, training use, retention, and deletion settings must be published before it is enabled.
What can you control now, and what is still missing?
Basic has no free-text input and does not ask for names, contact details, identity documents, account information, or health records. You can copy your journal for your own backup or clear the browser’s site data to remove the local journal and cookie.
Because there are no accounts or server journals, there is no account-data download, correction, or deletion process. For privacy or data-handling questions, email hello@ichinginspire.com; do not include a private question, journal content, identity document, or other unnecessary sensitive information. The site still needs an accountable identity. If Plus, sign-in, payment, or a server-side journal is added later, purposes, retention and deletion, providers and cross-border arrangements, access control, incident handling, and user rights must be settled before those features are enabled.