TRUE SUN Legal & help
Third-party services and processors
Third parties used for accounts, places, purchase verification, AI generation, hosting, and the website reading page, with the data each type receives.
Last updated
About this list
These parties process data only as needed to run the service. We do not sell birth details to them for unrelated advertising. The list may change with infrastructure; material updates are dated on this page and in the privacy policy.
Infrastructure and accounts
Cloud database and authentication provider Supabase: sign-in email, OTP session, profiles, purchase and quota records, chat and report metadata, and website reading page submissions.
Cloud computing platform Cloudflare (app APIs and chart calculation): handles API requests over HTTPS, chart calculation, quota checks, and generation jobs; may include account id, birth date and time, gender, coordinates and timezone of the birth or Question place, question text, and store transaction IDs.
Places and AI generation
Place service Geoapify (place search and geocoding): search terms or one-time coordinates for Questions to return city, country, timezone, and labels.
AI providers (the AI workflow platform Dify, and AI model providers such as OpenRouter and Google): receive structured birth data, question text, chat messages, and context to generate reports, profile analysis, and chat replies, and return the generated text. They generate content only for this service; log retention follows their terms.
Payments and app stores
App stores (in-app purchases and subscriptions): process payment and return transaction IDs and subscription state; we do not receive full payment credentials.
Email delivery
Email delivery provider Resend: when you submit feedback in the app, the feedback type and message, the reply email you enter, app version, device platform, and interface language are sent as an email notification to our support inbox so we can handle and reply to it.
Push notification service Firebase Cloud Messaging (FCM): after you allow notifications in the system prompt, we keep this device's push token, device platform, and interface language, and when your report is ready we send one notification through Firebase (the report type, never the report content). Turning notifications off in system settings, signing out, or deleting your account stops them.
Website reading page
Cloudflare: hosts the website and its APIs, and runs the Turnstile bot check on submissions (receives IP address and browser details).
Email delivery provider Resend: sends the 6-digit code to the email you enter, and marketing email only if you agreed to it.
Place service Geoapify: receives the words you type when you search for a birth city on the website (sent through our server), and returns the city, country, timezone, and coordinates.
AI workflow platform Dify and AI model providers: receive the chart calculated from your birth details (never your email) to write your personal reading.
Meta (Facebook, Instagram), TikTok, and Google Ads: used only to measure which ads bring website sign-ups. Their pixels or conversion tag load only after you tap Accept on the cookie bar. They receive only two website events: email confirmed (Lead) and account created (CompleteRegistration). The events our server sends carry a SHA-256 hash of your email (never the plain email), the event ID, the click ID (fbclid, ttclid, or gclid, kept only with your consent), the page address, and the IP address and browser details passed along with the request. They never receive birth details, reading text, App in-app purchases or subscriptions, or any event linked to your App account.