Privacy notice

MyNumbers is a numerology reading service published at mynumbers.co. This notice was rewritten by checking it against the code that actually runs the service, rather than against what the product was originally meant to do — where the two disagreed, this version follows the code. A short list of what still needs fixing, in the code or in this notice, sits at the end.

We have not yet completed registration with the UK Information Commissioner's Office, and the registered company name, number and office address that this notice and the site footer should carry have not been published — the operator has not filled those fields in yet. Treat this as an accurate working description, written so a solicitor can check it quickly, not as a finished document.

What we collect and why

We never ask for, and you should never enter, health, religious, ethnic, sexual-orientation or political information. Nothing on this site has a use for it, and the text that writes your reading is built to refuse it even if you enter it.

Free while payment is off

At the time of writing, no payment provider is connected, so the full reading is given away rather than sold — a deliberate, reversible setting, not a bug. That changes what personal data actually moves through the system right now:

• No email is currently collected for a free reading. The on-screen prompt offering to email you a copy updates the page you are looking at and nothing else — it does not send anything and does not store your address anywhere. Until that is built properly, the link the page gives you is the only way to keep a free reading.
• Every reading you generate — free or paid — is still stored on our server, under a random link rather than your name, because that is what lets the page survive a refresh or a new device. The name and date of birth you entered are part of that stored record. See "How long we keep it" below.

How long we keep it

• The order record — your chart, including your name and date of birth, and, once written, the reading itself — is stored under a random identifier, never under your name. We do not currently delete these automatically, and there is no self-service "delete my data" tool in the product yet. If you want a record removed, use the contact route in "Your rights" below and we will remove it by hand; that is a manual step today, not an automated one.
• A separate, shorter-lived cache avoids writing the same reading twice for two people who happen to share a name and date of birth. It is keyed by a one-way hash of your name and date of birth, not by the plain values, and it expires automatically after 90 days. This is distinct from the order record above, which does not currently expire.
• Rate-limiting and daily-cost counters (used to stop one visitor generating an unreasonable number of readings) are keyed by IP address, not by name, and expire automatically within a day or two.
• If a payment is ever taken — not currently possible; see above — the order, the email address given at checkout, and a record of the cancellation-waiver wording you agreed to would be kept for as long as tax law requires a transaction record to be kept. That rule is written into this notice ahead of the paid path being switched on. It is not yet enforced by any code, because no payment has yet been taken.

The AI that writes your reading

The interpretive text is written by a third-party AI model, currently one operated by Anthropic. Your name is sent to it, along with the numbers already computed from your date of birth — Life Path, Expression, Soul Urge, and so on. The date of birth itself is not sent, only the arithmetic already done with it. We have not independently confirmed Anthropic's data-processing terms for this account; that is one of the items a solicitor needs to check — see "What is still missing" below.

The reading is generated automatically. It is not "automated decision-making" in the sense the law means by that phrase: it has no legal or similarly significant effect on you, and nothing about you is scored, assessed or decided.

Baby name mode

This mode is meant to let a parent try candidate names against a child's birth or due date. As built, it currently has no working free path — the free-preview and free-generation endpoints only accept a single name and a single date of birth per request, not a shortlist of candidates — so this mode does not currently complete a request at all. Once a paid path is switched on, a baby-mode purchase would be stored exactly like any other order (see "How long we keep it" above). An earlier version of this notice said nothing about a child is written to the database; that is not true of the code as it now stands, and this notice will not say it again until it is.

Who receives it

We do not sell your data. We have not yet drawn up the international-transfer paperwork that would be needed once real customer data is routinely sent outside the UK — this is on the list below, not something we can honestly say is already in place.

Staff access

There is currently no admin tool for staff to browse individual readings — the only administrative screen in the product manages site settings. The order records described above are, as with any database, directly readable by anyone with access to the hosting account or the database itself: in practice, the operator and any developer with production access. That access is not separately logged today. A masked, audit-logged staff view has been designed but not built, and this notice will not claim it exists until it does.

Your rights

You can ask what we hold about a reading you generated, ask us to correct it, or ask us to delete it. Because there is no self-service tool for this yet, write to the contact address published on this site and we will act on the request by hand. We do not currently have a published response-time commitment we can stand behind, so none is printed here — a solicitor should help set one before this notice is relied on for a live paid service. You can also complain to the ICO (ico.org.uk) or your local supervisory authority in the EU.

Children

The service is not for under-18s and we do not knowingly collect their data. Baby name mode is for a parent or guardian entering a candidate name for their own child — see "Baby name mode" above for what that mode currently does, and does not, do with the data entered.

Security

Data you submit travels over TLS. Beyond that, we rely on the security our hosting and database platform (Vercel, and Postgres where configured) provide by default; the application code does not add its own encryption on top of that for chart or reading data. Administrative secrets — API keys and the like — are encrypted separately before they are stored, and are never returned to a browser once set.

What is still missing

This section exists so nobody mistakes this document for a finished one.

1. ICO registration has not been completed.
2. The registered company name, number and office address are not yet published anywhere on the site.
3. There is no automated deletion schedule for order records, and no self-service delete tool — deletion is a manual, by-request process today.
4. No international data-transfer paperwork is on file for sending data to the AI provider or to any processor outside the UK.
5. The staff-access tool an earlier version of this notice described (masked names, a per-view audit log) does not exist yet; today's actual access control is "whoever holds database or hosting credentials."
6. Nobody has been named as the person or role responsible for privacy requests.

None of this is legal advice, and a solicitor should review the whole document — not only this list — before it is relied on for a live paid service.