What she keeps

Kajo asks for no name, no email address and no password. There is no account to make in order to ask.

What you type. To cast a reading she needs your question and, if you have them, your birth date, time and place. Two of the four readers ask for one more fact each, because their old methods do: the Chinese reader asks whether to count you as male or female, and the I Ching asks for a number you tap out. Your device also tells her the timezone its clock is set to, so the sky is cast where you are. That is a clock setting, not your location, and nothing asks your device where it is.

Where a reading lives while it is being made. The reading is written on our casting server and sent to your device. As soon as your device has the whole letter, it tells the server, and the server erases the question, the birth details, the chart and the letter together in one stroke. A reading nobody collects is erased on its own after two days. You can remove a reading from your shelf at any time; that erases it from your device and, if the server's copy is still standing, from the server too. Erasing is never blocked or counted. It works whether or not you are signed in, and whether or not you have any questions left.

What stays on your device and nowhere else. Your shelf of past readings, the readings themselves, and the birth moment you asked Kajo to remember all live in your own browser. They are never sent to us. Settings has a Forget from this device button for the birth moment.

The sky is computed here. The planets, the pillars, the hexagram and the houses are worked out on our own server from published ephemeris data. No language model calculates or alters any of it.

What leaves this house. We keep no record of your reading. The sky is computed here and never leaves. Your question, your birth moment and the chart cast from them go, without your name, to the company whose servers run the four readers. It holds that exchange for up to thirty days to watch for abuse, never uses it to train anything, and could be made to hold it longer only by law.

Asking about someone else. If you ask about someone else, a child, a partner, a friend, and type in their birth moment, it is handled exactly like your own: cast here, sent without a name, erased when the letter lands. Whether to ask for someone is your judgment. We hold a birth moment for minutes, not a life.

No cookies, no analytics, no tracking. Kajo sets no cookies. There is no analytics script, no tracking pixel and no third-party code on the page unless you tap to sign in. Our own server writes down only the method and the path of each request: never your address, never your browser, never anything you typed, and never the identifier of a reading. The web server in front of it keeps no access log at all. The site is served over HTTPS, and the reading server itself is not reachable from the internet; it answers only to the web server standing in front of it.

When you sign in. Signing in with Apple or Google lets Kajo keep your questions for you. Here is everything we learn from it, and it is the same for both. The one you choose sends us a signed token. We check its signature against their own public keys, on our server, and then throw the token away; we never send it back and we never ask them anything about you. The only thing we take out of it is the account number they use for our app, and we do not store even that: we store a one-way keyed hash of it, so the number itself is not in our database. Your name, your email address and your profile picture are never read. With Apple we don't ask for your name or your email at all, so Apple never sends them. Your account with us is a random string we invent, attached to a balance of questions and a dated list of movements (granted, held, spent, returned) so that your balance is honest and answerable. It is never attached to a question, a birth detail or a reading. Being signed in stores one thing in your browser: a session token and its expiry. Sessions last thirty days. Signing out revokes the session on our side too. The sign-in buttons are loaded from Apple and Google only when you open the sign-in page; if you never open it, your browser never contacts either of them. What we receive is used to sign you in and for nothing else, and it is never shared.

Deleting your account. Settings has a Delete my account control. It removes your account, its link to your Apple or Google sign-in, its sessions and its balance of questions, and it cannot be undone. One thing stays behind for a year: a scrambled mark that your free reading was used, so the same sign-in doesn't get a second one. It can't be turned back into you, and nothing else is kept. The readings on your device stay where they are, yours. If you signed in with Apple, Kajo stays listed under Sign in with Apple in your Apple Account settings until you remove it there. We hold no key that could remove it for you.

Your first reading, and paying for more. Every sign-in gets one full reading on us, one per identity. When you buy a question, the payment is taken by Stripe on Stripe's own pages. We never see or hold your card. Stripe sees the payment and a reference to your account; it never sees your question, your birth details or your reading.

Asking us. Anything about this page: write@dearkajo.com. Changes here are dated, never silent.