← Back to Nyxlet

Privacy Policy

Last updated: 29 October 2026

Nyxlet is an entertainment app at nyxlet.com that offers AI-generated tarot, astrology, BaZi and relationship readings, featuring our original characters. This policy explains what personal data Nyxlet collects when you use nyxlet.com, why we use it, who we share it with, how long we keep it, and the rights you have. Nyxlet is aimed mainly at users in the United States. Wherever you live, you can ask to see, correct, export or delete your data. If you’re in the UK or EU, you also have rights under the UK General Data Protection Regulation (UK GDPR) or the EU GDPR.

• Who we are
• What we collect and why
• Google User Data
• How we use your data
• Someone else’s details in a match
• Sensitive information
• How AI readings use your data
• Who we share data with
• International transfers
• How long we keep data
• Deleting and exporting your data
• Cookies and local storage
• Your rights
• Your US state privacy rights
• Age limit
• Changes and complaints

1. Who we are

Nyxlet is operated by Harumi, a sole trader trading as Zolynex Studio (“Nyxlet”, “we”, “us”). Our business address is 1 Queen’s Road Central, Hongkong and Shanghai Banking Corporation Headquarters, Central, Hong Kong. Harumi operates Nyxlet as an individual sole trader. We are the data controller for the personal data described in this policy, which means we decide how and why it is used.

Contact us about privacy or anything in this policy at contact@zolynexstudio.com.

2. What we collect and why

We collect two kinds of data: what we receive from Google when you sign in (summarised here and explained fully in Google User Data), and what you give us while using the site: your questions, birth date, time and place, your readings, and payment records.

Your Google account

You can use some of Nyxlet without an account. If you sign in, you do so with Google. Through our authentication provider, Supabase, we receive your Google account ID, name, email address and profile picture. We use them to create and identify your account and to show your name and picture in your account menu. Your profile picture is loaded directly from Google’s servers.

Lawful basis: performing our contract with you (providing your account).

Your nickname and birth details

• Nickname and birthday: after you first sign in, we ask what to call you and for your date and time of birth. These are saved to your account.
• Birth details for charts: for astrology and BaZi (Chinese astrology) readings you enter a date, time and place of birth. We use them to calculate your chart and write the reading.
• Birth profiles: saved only when you choose to save one. You can edit or delete them at any time under Birth profiles in your account menu. How many you can save depends on your plan.

Lawful basis: performing our contract with you.

Your chats and questions

• When you’re signed in, your conversations are saved to your account automatically. They include your messages, the questions you ask, the cards you draw and your readings (the replies we generate). This means you can see them on any device. You can delete any conversation from the history list. Deleted conversations go to Trash, where you can restore them or delete them forever. Anything left in Trash is deleted forever automatically after 30 days.
• When you’re not signed in, your conversations are not saved on our servers. They stay on the page and are cleared when you refresh. If you start signing in from the middle of a chat, the chat is kept temporarily in your browser’s session storage so it isn’t lost during the Google sign-in. It is moved into your account once you’re signed in.
• To write each reply, the content of the current conversation is sent to our AI provider (see section 7).

Lawful basis: performing our contract with you.

Usage, payments and subscriptions

• Usage counts: account balances, purchases and message reservations are stored in our database. A signed functional browser cookie identifies visitors; keyed one-way hashes enforce their two-reply trial and IP rate limits. Raw IP addresses are not written to these database counters.
• Reliable retries: a completed reply and its model context may be cached privately for approximately 24 hours so a retry can recover the same reply without a second charge. This also applies to guest replies and is separate from saved conversation history.
• Payments: subscriptions are paid through Stripe. Stripe collects your payment details and billing email on its own checkout page. We never see or store your card details.
• Payment records we store: from Stripe we store your Stripe customer ID, subscription ID, plan, subscription status, billing-period dates and whether the subscription is set to cancel.

Lawful basis: performing our contract with you; complying with our legal obligations (for example accounting and tax records).

Share links and invitations

• Share links: when you open “Share this reading”, we create a public share link. It contains the reading’s headline quote, the cards and their orientation, the general topic (such as “About love”), and your nickname (or, if you haven’t set one, the first name on your Google account). If you switch on “Show my question”, it also contains your question.
  • Anyone with the link can see this page.
  • We count how often a share page is viewed, downloaded, shared and clicked through.
• Invitations: if you arrive through someone’s share link, your browser stores the share code and a random device ID. If you then create an account, we record the reward with three things: your account, the sharer’s account, and a hashed (one-way, salted SHA-256) version of your device ID and IP address. We do this so each device and network can only claim the free-reading reward once. We do not store your IP address itself.

Lawful basis: performing our contract with you (share links you ask us to create); our legitimate interest in preventing abuse of the invitation reward.

First-visit statistics

On your first visit, your browser creates a random ID stored on your device. We use it to measure whether new visitors draw their first card and how long that takes. We record this ID, the date and time, your interface language, the page you arrived on, and when and how you drew your first card. This is not linked to your account, and we don’t record your IP address or anything you type. Clearing your browser data removes the ID.

Lawful basis: our legitimate interest in understanding and improving the first-time experience. You can object at any time by emailing us; see also section 12.

Support requests

When you use the feedback form or email us, we keep your email address, the topic you chose, your message, the page you sent it from and your interface language, plus your account ID if you’re signed in. We use them only to reply to you and to fix the problem you reported. Replies are sent by email from contact@zolynexstudio.com.

Lawful basis: our legitimate interest in answering your request; performing our contract with you where it concerns your account or subscription.

Security and technical logs

Cloudflare processes IP addresses and basic request information to deliver the site and protect it from attacks. Shared rate counters use keyed hashes and normally expire within two days; short-lived memory checks also apply. Cloudflare request logs have URL query parameters redacted.

If we switch on a human check (Cloudflare Turnstile), visitors who aren’t signed in may be asked to complete it before chatting. Turnstile looks at signals from your browser and device to tell people from bots. We then store a short-lived pass in your browser’s session storage (nyx-human), valid for 12 hours and tied to your IP address.

If we switch on error monitoring (Sentry), unexpected errors on the site or our server are reported to Sentry. Each report contains only the type of error, a technical description with anything resembling a key or token removed, where in the code it happened, and the page path. Reports never include your messages, questions, readings, account details or IP address.

Our server writes short technical logs: time, an internal request ID, the AI model used, token counts and error codes. These logs do not include your messages, questions or readings.

Lawful basis: our legitimate interest in running a secure, reliable service.

3. Google User Data

This section explains exactly what Nyxlet does with data it receives from your Google account when you choose to sign in with Google. Signing in is optional: you can browse Nyxlet and try readings without an account.

What we receive from Google

We only request Google’s basic sign-in permissions (OpenID, email address and profile). We receive:

• your name as shown on your Google account;
• your email address;
• your profile picture (a link to the image hosted by Google);
• your Google account ID, which identifies your account when you sign in again.

We don’t request access to your Gmail, Google Drive, Calendar, contacts or any other Google service, and we never receive your Google password.

How we use it

• to create your Nyxlet account and sign you in;
• to save your readings, chat history and birth profiles to your account so you can see them on any device;
• to link your subscription to your account and manage it;
• to show your name and profile picture in your account menu;
• to contact you about your account or subscription, or to reply when you write to us.

If you create a share link and haven’t set a nickname, the share page shows the first name from your Google account (see section 2). You can set a nickname at any time to use instead.

We don’t use Google user data for advertising, we don’t sell it, and we don’t use it to train AI models. Your name, email address and profile picture are not sent to our AI provider. Nyxlet’s use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Where it is stored

Your Google account details are stored in our authentication and database provider, Supabase, in the United States. Access is restricted to Nyxlet’s server and our own administration; other users can’t see your email address. Your profile picture is not copied to our servers: it is loaded directly from Google when shown.

Who we share it with

We don’t share Google user data with third parties, except the service providers that run Nyxlet for us and only as needed to do so: Supabase (sign-in and database hosting) and Cloudflare (hosting, which passes requests between your browser and our server). They process it on our instructions. We may also disclose data where the law requires it. We don’t pass your Google name, email address or profile picture to Stripe; Stripe collects your billing email itself on its checkout page.

How long we keep it

We keep your Google account details for as long as your Nyxlet account exists. When you delete your account, we delete them along with your other account data, within one month of your request.

How to delete it

• Email contact@zolynexstudio.com from the email address on your account and ask us to delete your account. We’ll delete your Google account details and all data linked to your account, and confirm once it’s done, within one month.
• You can also remove Nyxlet’s access to your Google account at any time at myaccount.google.com/connections. This stops future sign-ins through Google but doesn’t delete data we already hold, so email us as well if you want it deleted.

4. How we use your data

We use personal data only to run Nyxlet for you:

• to provide readings: sending your question, cards and chart calculations to our AI provider and showing you the reply;
• to run your account: signing you in, saving your readings, chat history and birth profiles, and showing them on any device;
• to handle payments: linking your subscription to your account, applying your plan’s allowance (your credits) and keeping records we must keep for tax and accounting;
• to keep Nyxlet safe and working: preventing abuse with usage limits, fixing errors, and showing support resources when a message suggests you may be at risk;
• to understand first visits: anonymous first-visit statistics, described in section 2;
• to talk to you: replying when you contact us and telling you about important changes to your account, subscription or this policy.

5. Someone else’s details in a match

6. Sensitive information

You don’t have to tell us anything sensitive to use Nyxlet. However, people sometimes write about their health, relationships, sex life or beliefs when asking a question. If you include information like this, we use it only to write the reply you asked for, and to show support resources if your message suggests you may be at risk. We treat your choice to send it as your explicit consent to this use. You can withdraw that consent by deleting the conversation.

Nyxlet is not a crisis or medical service. If you are in danger, call or text 988 (the Suicide & Crisis Lifeline) in the US, call 911 in an emergency, or contact your local emergency services.

7. How AI readings use your data

Readings and replies are generated by Google’s Gemini API, acting as our data processor. For each reply we send the following:

• your current conversation (your messages and earlier replies);
• the cards you drew;
• any chart or match calculations;
• your interface language.

We do not send your email address or Google account details. Our API keys stay on our server and never reach your browser. Under the terms we use the Gemini API on, Google does not use the prompts we send or the replies it returns to train its models.

Replies are produced automatically. They don’t make decisions that have legal or similarly significant effects on you.

8. Who we share data with

We don’t sell your personal data or use it for advertising. We share it only with these service providers, who process it on our behalf:

Stripe sends payment receipts and subscription emails itself. Stripe and Google also act as independent controllers for some of their own processing (for example Stripe’s fraud prevention and legal obligations, and your Google account itself), under their own privacy policies.

We may also disclose data where the law requires it, or to protect the rights, property or safety of our users or others.

9. International transfers

Our database is hosted by Supabase in the United States, and our other providers operate globally. Nyxlet itself is run from Hong Kong. Your data is therefore stored and processed in the United States and may be accessed from Hong Kong or processed in other countries where our providers operate. These countries may have different data protection laws from yours.

If you’re in the UK or EU, then where your data leaves the UK or EU, we rely on one of these safeguards:

• UK adequacy regulations;
• the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, included in our providers’ data processing terms;
• the UK Extension to the EU–US Data Privacy Framework, where a provider is certified.

You can ask us for more information about these safeguards.

10. How long we keep data

11. Deleting and exporting your data

• Delete a conversation: use the delete button in your history list. It moves to Trash, where you can restore it or delete it forever; anything left in Trash is deleted automatically after 30 days.
• Delete a birth profile: open Birth profiles in your account menu and delete it. This takes effect immediately.
• Delete your account and all your data: email contact@zolynexstudio.com from the email address on your account. We delete your account, Google account details, conversations, birth profiles, usage and subscription records, and confirm when it’s done, within one month. Please cancel any active subscription first. Stripe keeps its own payment records where the law requires it.
• Export your data: email us from your account’s email address and ask for a copy. We’ll send your account details, nickname and birthday, saved conversations and readings, birth profiles and subscription records in a machine-readable format (JSON), within one month.
• Remove Nyxlet’s access to Google: at any time at myaccount.google.com/connections.

12. Cookies and local storage

Nyxlet doesn’t use advertising or third-party analytics cookies, and we don’t set cookies ourselves. Instead, the site stores a few items in your browser’s local storage and session storage:

Other services may set their own cookies on their own pages. For example, Google sets cookies during sign-in, Stripe on its checkout and billing pages, and Cloudflare may set strictly necessary security cookies.

You can clear all of these at any time in your browser settings. Clearing them signs you out and resets your preferences. To opt out of first-visit statistics, clear your site data or email us.

13. Your rights

Wherever you live, and in addition to any rights your local law gives you (for example under US state privacy laws, or the UK GDPR and EU GDPR), you can ask us to:

• access the personal data we hold about you and get a copy;
• correct data that is inaccurate or incomplete. You can edit your nickname, birthday and birth profiles yourself in your account menu;
• delete your data. You can delete conversations and birth profiles yourself; to delete your account, email us;
• export the data you gave us in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interests, including first-visit statistics;
• restrict our processing in certain circumstances;
• withdraw consent where we rely on it, at any time.

We won’t treat you differently for exercising your rights. If you live in the US, see also Your US state privacy rights.

To exercise any of these rights, email contact@zolynexstudio.com. We may need to confirm your identity, usually by asking you to write from the email address on your account. We’ll reply within one month. There’s no charge in most cases.

14. Your US state privacy rights

If you live in a US state with a consumer privacy law, such as California (CCPA, as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas or Oregon, you have the rights below, as they apply under your state’s law. We offer them to all US users.

• Right to know and access: the categories and specific pieces of personal information we hold about you, where it came from, why we use it and who we share it with.
• Right to delete personal information we collected from you.
• Right to correct inaccurate personal information.
• Right to data portability: a copy in a portable, machine-readable format.
• Right to opt out of sale, sharing and targeted advertising: we don’t sell or share personal information, or use it for targeted advertising or profiling with legal or similarly significant effects, so there is nothing to opt out of.
• Right to limit use of sensitive personal information: we use sensitive information you choose to give us (for example, health or relationship details in a question) only to provide the reading you asked for, which is a permitted use.
• Right to non-discrimination: we won’t deny you service, charge you a different price or give you a lower quality of service for exercising your rights.

Categories of personal information (notice at collection)

How long we keep each category is set out in the retention section above.

How to make a request

Email contact@zolynexstudio.com with the subject “Privacy request” and tell us which right you want to use. We’ll confirm we received it within 10 days and respond within 45 days (we may extend this once by another 45 days if needed, and we’ll tell you why). To protect your account, we verify requests by asking you to write from the email address on your account. You may use an authorised agent; we’ll ask for proof that they are authorised and may ask you to confirm your identity directly.

If we decline your request, you can appeal by replying with the subject “Privacy appeal”. We’ll respond to your appeal within 45 days (60 days in Colorado). If you’re not satisfied, you can contact your state attorney general.

We don’t knowingly sell or share the personal information of anyone, including consumers under 16.

15. Age limit

Nyxlet is only for people aged 18 or over. We don’t knowingly collect data from anyone under 18. If you believe a child has used Nyxlet, contact us and we’ll delete their data.

16. Changes and complaints

We may update this policy as Nyxlet changes. We’ll change the “last updated” date above. If the changes are significant, we’ll tell you on the site or by email before they take effect.

If you’re unhappy with how we’ve handled your data, please contact us first. You may also have the right to complain to your local data protection or consumer authority. In the UK, that’s the Information Commissioner’s Office (ICO) at ico.org.uk. In the EU, it’s the data protection authority in your country.

NyxletTerms of ServiceRefund Policycontact@zolynexstudio.com