Legal
Privacy Policy
One Sky protects your personal information under the Korean Personal Information Protection Act. This policy explains what we process and why, how long we keep it, and where it goes.
1. Why we process personal information
One Sky (the “Service”) processes personal information only for the purposes below. It is not used for advertising or marketing. If a purpose changes, we will tell you in advance and ask for consent where required.
- Accounts: registration and sign-in, confirming the account holder, preventing misuse
- Reports: calculating charts from birth details, producing reports, and keeping them in your account
- Answering inquiries and handling errors
- Security: limiting excessive requests, responding to outages and attacks
- Improvement: measuring page-load performance and visit counts
2. What we process
| Category | Items | Collected when |
|---|---|---|
| Account (required) | Email address, display name (a nickname is fine), password (stored only as an irreversible hash), creation and update times | Registration |
| Analysis subject (required) | Name or nickname, date of birth, birth time and how accurate it is, birthplace (city name, country code, latitude and longitude, time zone), sex option used for calculation | Requesting an analysis |
| Personalized analysis (optional) | Occupation, current focus or concern, question | Choosing the “Personalized” mode and filling it in |
| Analysis results | Calculated charts and interpretation text, processing status and error records | Creating an analysis |
| Generated automatically | IP address, access time, requested address (may include search terms), request method and response status, browser information (user agent), approximate country-level location that Cloudflare derives from the IP address | While using the Service |
Birth details entered on the “Calculation details” screen are used for that calculation only and are not stored.
Please do not enter sensitive matters such as health, religion, or political views, or anything that identifies another person, in the optional personalized fields.
3. Legal basis
- Account, analysis subject, personalized input, analysis results: necessary to perform the service contract you request (Personal Information Protection Act, Article 15(1)4).
- IP address and access records: processed to the extent needed to run the Service securely (same Act, Article 15(1)6).
Because this information is processed only as far as the Service requires, there is no separate consent step.
4. Retention and destruction
| Information | Kept for |
|---|---|
| Account information | Until you close your account |
| Analysis subjects, birth details, personalized input, analysis results | Until you delete that analysis subject or close your account |
| Access records (Cloudflare Workers Logs) | Up to 7 days |
| IP address used for request limits | For request limits it is held only in server memory and never written to the database or to the API's own logs; gone when the server instance stops or another address's entry replaces it. It stays in the access records for the period in the row above |
| Form input saved temporarily in the browser | 30 minutes after the last input; after that it is not loaded again and is removed the next time the form opens. Removed at once when you create the analysis, sign out, or close the browser tab |
When a retention period ends or its purpose is fulfilled, the information is destroyed without delay. Electronic records are deleted from the database so the Service cannot load them again; nothing is kept on paper.
Deleted information remains in the history Neon keeps for database recovery until that retention window passes, and is then removed automatically. That history is used only to recover from failures.
No information is currently kept under any other law.
5. Processors and transfers abroad
The Service runs on the facilities of the companies below, so personal information is transferred and stored outside Korea. This is processing and storage entrusted to them as necessary to perform our contract with you (Personal Information Protection Act, Article 28-8(1)3).
| Recipient and contact | Country | Information | Purpose (entrusted work) | When and how | Kept for |
|---|---|---|---|---|---|
| Cloudflare, Inc. (privacyquestions@cloudflare.com) | United States and Cloudflare data centers worldwide | Everything exchanged with the Service (account, birth details, reports, access records) | Hosting the website and API, content delivery, security, keeping access records, visit statistics and network error reports | Sent over an encrypted network each time you use the Service | While a request is processed; access records up to 7 days |
| Neon, LLC (a Databricks company, privacy@databricks.com) | Singapore (Amazon Web Services data center) | Account information, analysis subjects and birth details, personalized input, analysis results | Database storage | Sent over an encrypted network each time you use the Service | Until account closure or deletion; recovery history is removed automatically when its retention window passes |
If you do not want your information transferred abroad, you can stop using the Service or close your account. The Service runs only on these facilities, so refusing the transfer means the Service cannot be used.
6. Disclosure to third parties
We do not provide or sell your personal information to third parties, except where the law allows it, such as a specific statutory provision or a request from investigators through a lawful procedure.
7. Entering someone else's information
An analysis subject can be another person, such as a family member or friend. In that case you must have the right to enter their name and birth details, for example by telling them and getting their agreement.
Information entered this way is protected under this policy in the same way. If the person it describes asks for deletion through the contact email, we delete it after verification. The contact email has not been published yet, so until then the user who entered the information can remove it at once with “Delete this subject and reports” on the report screen.
8. Children under 14
Children under 14 cannot register. The registration screen states this limit, but age is not checked at sign-up. Birth details of a child under 14 may be entered only by that child's legal guardian. If we learn that an account belongs to a child under 14, we delete the account and its information without delay.
A legal guardian can ask for a child's account to be deleted through the contact email. Until that email is published, the guardian can sign in to the child's account and delete it at once with “Delete account permanently” on the “Account” screen.
9. Your rights and how to exercise them
You may at any time view and download your personal information, or ask for it to be corrected, deleted, or no longer processed.
- View: “My analyses” and each report screen show what is stored. Everything stored for a subject, including personalized input, is in the downloaded file, and the account's email and display name are shown on the “Account” screen.
- Download: “Export this subject's data” on a report screen downloads the birth details, personalized input, analysis records, and reports as a JSON file.
- Delete: “Delete this subject and reports” on a report screen removes everything linked to that subject. Your whole account can be removed with “Delete account permanently” on the “Account” screen (/en/account).
- Correct: finished reports are not edited, so their calculation basis is preserved. If birth details were wrong, create a new analysis and delete the old subject. Email and display name cannot be changed on screen, so they need a request through the contact email; until that email is published, the only way is to delete the account and create a new one.
- Requests the screens cannot handle, such as stopping processing, are taken through the contact email. The contact email has not been published yet; once it is, it will appear under “Privacy officer and contact” below. For requests received after that, we will verify your identity and reply without delay and within 10 days at the latest. Even before then, a subject or account you delete yourself is no longer processed.
- You may also exercise these rights through a legal guardian or an authorized representative.
10. Cookies and similar technologies
The Service uses the cookies and browser storage below. No advertising or tracking cookies are used.
| Name | Type | Purpose | Kept for |
|---|---|---|---|
| fortune_access | Cookie (not readable by scripts) | Keeping you signed in | 7 days or until you sign out |
| fortune_locale | Cookie | Remembering the interface language | 1 year |
| fortune-theme | Browser storage | Remembering the light or dark theme | Until you switch back to “System” |
| fortune-birth-draft | Browser session storage | Saving form input temporarily (on this device only) | 30 minutes after the last input; after that it is not loaded again and is removed the next time the form opens. Removed at once when you create the analysis, sign out, or close the tab |
| onesky:chunk-reload-at | Browser session storage | Records when the page reloaded itself after failing to load its files just after a new release, so it reloads only once (no personal information) | Until you close the tab |
Two Cloudflare features are also active. Visit statistics (Cloudflare Web Analytics) aggregate the pages visited and performance data such as load times, without cookies. Network Error Logging lets your browser report the type of error and the address to Cloudflare when it cannot reach the site.
You can block or clear cookies and storage in your browser settings, but blocking the fortune_access cookie prevents sign-in. Blocking the visit-statistics script with a content blocker does not affect use of the Service.
11. Security measures
- Passwords are stored only as Argon2id hashes; the original password is never stored.
- All traffic is encrypted with HTTPS.
- The sign-in cookie cannot be read by scripts.
- Each account sees only its own information. Other accounts' information can be looked up only by the operator's administrator account, to answer inquiries and investigate errors.
- There are no share links that publish a report.
- Database credentials are kept only in server secrets, and passwords and cookie values are masked in access records.
12. Privacy officer and contact
This is where questions about personal information, requests to view or delete it, and complaints are received.
- Privacy officer
- One Sky Privacy Office
The contact email has not been published yet; it will appear here as soon as it is ready. Until then you can download or delete your information yourself with “Export this subject's data” and “Delete this subject and reports” on a report screen, and “Delete account permanently” on the “Account” screen (/en/account).
You can also report or seek advice about a privacy infringement from these Korean authorities.
- Personal Information Infringement Report Center privacy.kisa.or.kr, 118 (in Korea)
- Personal Information Dispute Mediation Committee www.kopico.go.kr, 1833-6972
- Supreme Prosecutors' Office www.spo.go.kr, 1301 (in Korea)
- Korean National Police Agency ecrm.police.go.kr, 182 (in Korea)
Change history
Changes to this policy are announced on this page at least 7 days before they take effect, and a summary of each change is listed below with its effective date.
- Policy established