Privacy Policy

Last updated 22 September 2026

Who is responsible for your data

Saha Synergy Group Ltd, Suite 1108, Ocean Centre, Harbour City, Hong Kong, is responsible for your personal data. You can reach us about anything in this policy at saha.synergy@proton.me.

What we collect

• Account details: your email, username and whether you have a membership.
• Birth details and your map: name on the chart, date, time and place of birth, and the chart we calculate from them.
• Whether your map reads you as a woman or a man, which we use to choose your cycle module, pronouns and archetype cards.
• Cycle details, only if you switch cycle tracking on: the start date of your last cycle and your usual cycle length.
• Journal entries, daily check-ins (mood and energy scores and any note) and friend connections.
• Payment records from Stripe: what you bought, when, the amount and the email used. We never see your card number.
• Marketing choices: whether you agreed to emails, the wording you saw and when.
• Audience details: your country, worked out from your internet connection at sign-up; your age, worked out from your birth date; your sex; how you told us you heard about us; your confirmation that you are 18 or older; and the affiliate code of anyone who referred you.
• Your Anthropic API key, stored encrypted, if you add one.
• Basic technical data such as pages viewed and page speed, collected by Vercel Analytics without cookies and without identifying you.

Your cycle, mood and journal data

Information about your menstrual cycle, and the mood and energy scores in your check-ins, can reveal things about your health. Many privacy laws treat this as sensitive or special category data, so we handle it with extra care.

We only collect cycle details if you choose to switch cycle tracking on and tick a separate box giving your explicit consent. Everything else in Soul Path Map works without it. We use this data for one purpose only, to show you where you are in your cycle and what that phase may mean for you. We never sell it, never use it for advertising, never share it with affiliates and never send it to our email provider. It is never included in the audience figures we look at.

You can withdraw consent at any time by switching cycle tracking off in Settings. When you do, we delete your saved cycle details straight away. Withdrawing consent does not affect anything we did before.

If you are in the European Economic Area or the United Kingdom, cycle tracking and mood check-ins are not offered to you, so we hold no health-related data about you at all. The cycle fields do not appear, and if cycle details are ever sent to us from one of those countries we do not keep them. We work out which country you are in from your internet connection.

Journal entries and check-ins are private to your account and are never sent to the AI.

Readings, the AI and your key

When you use the chat or a reading, your question, anything you attach and the relevant parts of your map pass through our server, which adds our interpretive method and sends the request to Anthropic. For members this runs on our own Anthropic account; on a free trial or the sample map it uses a key you provide. We keep a count of how many companion messages you send each month, not the messages themselves, and we do not keep the answers. Anthropic states that API inputs and outputs are not used to train its models by default.

Nothing is sent to Anthropic until you agree to it. Before your first reading we tell you what is shared (your chart, your cycle phase if cycle tracking is on, a short summary of friends you have connected, and what you type or attach) and ask for a clear yes, which we keep with the wording you saw. You can withdraw it in Settings at any time, and your readings and companion then stay off until you agree again.

Your conversations with the companion are saved to your account as text so you can return to them, and they can be placed in a constellation (Business, Personal, Love, Family or Other) to keep. A conversation that is not kept is deleted 30 days after its last message, and you can delete any conversation at once. Attachments are never saved; only the file name is kept in the conversation.

If you add your own Anthropic API key, it is saved to your account sealed with AES-256-GCM, so it works on every device you sign in on. We decrypt it only for the moment a reading is generated, we never log it, and you can replace or remove it any time in Settings. On the public sample map, a key you enter stays in your browser only.

Files you attach in the chat (images, PDFs, text) travel over HTTPS with TLS 1.3, are passed once to Anthropic to answer that question, and are never stored or logged by us. Your chart, journal, check-ins and cycle data are held in a database encrypted at rest with AES-256, behind row-level security, so only your own session can read your rows. In Settings you can turn on email verification for sensitive changes: saving or removing your key, changing your username and deleting your account then each need a fresh one-time code from your email.

Why we use your data and our legal reasons

• To create your account, calculate your map, give you readings and run your membership, because it is necessary to provide what you asked for (contract).
• To process cycle data, because you gave explicit consent.
• To send marketing emails, because you agreed, or in the United States because the law allows it with notice and an easy unsubscribe.
• To keep payment and tax records, because the law requires it (legal obligation).
• To understand our audience in aggregate (which countries, age ranges and referral sources our members come from), to prevent fraud and abuse of free codes, and to pay affiliates correctly, because we have a legitimate interest in running and improving a small business. These figures are looked at as totals. Only Sophia and people she authorises can see individual records, and only when needed to help you or fix a problem.

Who we share data with

We use a small number of trusted companies to run Soul Path Map. They process data only on our instructions and under data protection agreements.

• Supabase (database and sign-in), servers in Singapore.
• Vercel (hosting and cookieless analytics), United States and global edge network.
• Stripe (payments), United States and Ireland.
• Anthropic (the AI that writes readings), United States.
• MailerLite (marketing emails, only if you agreed), European Union.
• Google (sending sign-in emails), United States.
• Calendly (booking expert readings), United States.

If someone referred you, they see only that a sale happened and the commission amount, never your name, email, birth details or map. When you run a synergy reading with a friend, you both see the shared result, and neither of you sees the other's full chart. We will share data with authorities only when the law requires it.

Sending data across borders

We are based in Hong Kong and our providers store data in Singapore, the United States and the European Union, so your data will travel outside your country. Where the law requires it, we rely on the European Commission's standard contractual clauses or equivalent safeguards offered by these providers. If you live in Indonesia, by using Soul Path Map you consent to your personal data being transferred to and stored in these countries for the purposes in this policy, and you can withdraw that consent by deleting your account.

How long we keep things

• Your account, maps, journal and check-ins: until you delete them or your account.
• Cycle details: until you switch cycle tracking off or delete your account.
• Accounts with no sign-in for 24 months: we may delete them, after emailing you first.
• Card draws from people who never bought or signed up: deleted 24 months after the draw.
• Payment records: 7 years, because Hong Kong tax law requires it.
• Proof of your marketing choice: for as long as we email you, then 2 years after you unsubscribe, so we can show we respected your choice.
• Affiliate referral records: 7 years for commission and tax purposes, without your birth or map details.
• Audience details (country, age, sex, how you heard about us): as long as your account exists, then only as anonymous totals.
• The referral cookie: 60 days.

Deleting your account

You can delete your account from the app at any time. This permanently removes your profile, maps, journal, check-ins, cycle details, saved API key, friends, synergy results, card draws and sign-up answers, and it cannot be undone. We also remove your email from our Soul Path mailing lists. We keep only what the law requires us to keep, which is the payment and tax record of what you bought and, if you agreed to marketing, a record that you did and later left. Deleting your account does not cancel a membership, so cancel it first from Manage subscription.

Your rights

Depending on where you live, you have the right to ask us for a copy of your data, to correct it, to delete it, to limit or object to how we use it, to take it with you in a portable format, and to withdraw any consent you gave. If you live in California you can also ask what we collect and share, and we do not sell or share personal information for cross-context advertising. If you live in Washington State or another US state with consumer health data laws, you have the same rights over your cycle data, and we will never sell it.

To use any of these rights, email saha.synergy@proton.me from the email on your account. We reply within 30 days and there is no charge. If you are unhappy with our answer, you can complain to your local data protection authority, such as the Privacy Commissioner for Personal Data in Hong Kong, your national authority in the EU, the ICO in the UK, the Office of the Australian Information Commissioner, or the Ministry of Communication and Digital Affairs in Indonesia.

Children

Soul Path Map is only for adults aged 18 and over, and everyone confirms their age when they sign up or draw cards. We do not knowingly collect data from anyone under 18. If you think a child has used Soul Path Map, email us and we will delete their account and data. If you enter a child's birth details as their parent or guardian, that chart stays private to your account and is never used for marketing or audience figures.

Cookies and storage on your device

Cookies here come in three groups. Essential ones keep you signed in, keep the site safe and remember your cookie choices, and they cannot be switched off. Analytics counts pages and page speed through Vercel so we can see what is worth building. The referral cookie remembers, for up to 60 days, that an affiliate link sent you, so the right person is paid. We use no advertising cookies and we sell nothing on.

If you are in the EU, the UK or the rest of the EEA, nothing outside the essential group is set until you say yes on the cookie banner, and no box starts ticked. Everywhere else analytics and the referral cookie start on and you can switch either off. Either way you can change your mind whenever you like from the cookie settings link at the bottom of the home page, and we keep a dated record of the choice you made and the exact wording you were shown. We also remember small preferences like your theme on your own device.

Changes to this policy

If we change how we use your data in a way that matters, we will tell you by email or in the app before the change takes effect, and ask for your consent again where the law requires it.

Questions: saha.synergy@proton.me