Privacy Policy

Who we are

Raw Trait is operated by Nicolas Xu at rawtrait.com. We are the controller of the personal data described in this policy. We are a small team and we read every privacy email ourselves.

What we collect

• Account. Your email address and a salted, hashed password. Passwords are managed by our authentication provider — we never see your plaintext password.
• Birth data. The date, time, and place of birth you enter to generate a reading, plus an optional display name and gender. This is the input to the reading.
• Your readings. The personality report we generate for you, stored against your account.
• Payment metadata. A customer identifier from our payment processor, the last four digits of the card you used, the billing email, and the amount. We never receive or store your full card number or CVC — the payment processor handles those entirely.
• Technical data. Your IP address, browser user-agent, the language you chose, an A/B test bucket identifier, and any error events captured by our monitoring provider.

Why we collect it

To run the Service. Specifically: to create your account, generate your reading, take payment, send transactional email (verification, receipts, refund notifications), prevent fraud and abuse, fix bugs, and understand which parts of the product are working. We do not sell your data and we do not use it for third-party advertising.

Service providers

We share the minimum necessary data with industry-standard service providers — for hosting, database, authentication, payment processing, transactional email, error monitoring, and AI model inference (see section 10). They process data on our behalf under contractual safeguards. For the current list of named providers, write to support@rawtrait.com.

Cookies and local storage

• An HTTP-only session cookie that keeps you signed in.
• wuxing-locale — your language preference, stored in your browser.
• rt-auth-variant — the variant of the sign-in flow you saw (used for an internal A/B test).

We do not use third-party advertising cookies or cross-site tracking. We do not use analytics that fingerprint your browser.

How long we keep it

We keep your account and the readings tied to it for as long as your account exists, plus 30 days after you delete the account to allow for accidental-deletion recovery. Payment records are kept for up to seven years where tax or audit law requires it. Error logs older than 30 days are pruned automatically by our monitoring provider.

Your rights

Wherever you live, you can ask us to:

• Confirm what data we hold about you.
• Send you a copy of that data in a machine-readable format.
• Correct data that is wrong.
• Delete your account and the data tied to it.
• Stop using your data for product analytics or A/B testing.

Email support@rawtrait.com from the address on your account. We aim to respond within 30 days. If you live in the European Economic Area, the United Kingdom, California, or mainland China, the GDPR, UK-GDPR, CCPA/CPRA, or PIPL may give you additional specific rights — we honor those frameworks even where we are not strictly bound by them.

Where your data lives

Our infrastructure is hosted primarily in the United States. If you are using Raw Trait from another country, your data will be transferred to the United States for processing. By using the Service you understand and consent to that transfer. We rely on industry-standard contractual safeguards with each of our providers.

Children

Raw Trait is not for anyone under 18 and we do not knowingly collect data from anyone under 18. If we learn we have collected data from a minor, we delete it and close the account. If you believe a minor has used Raw Trait, please write to us at support@rawtrait.com.

Security

Data is encrypted in transit (TLS) and at rest through our hosting providers. We are not a card-data environment — our payment processor, Creem, handles cards on hosted pages we do not control. We follow industry-standard practice and review changes that touch personal data carefully. No system is perfectly secure; if you discover a vulnerability please tell us at the contact email above before disclosing it publicly.

About the AI that writes your reading

Your reading is written by a large language model running on Fireworks AI, a United States provider. We send the model:

• Your birth data (date, time, place, optional name and gender).
• Our internal system prompt, which contains the interpretive framework.

We do not send the model your email address, your password, your payment information, or any other account identifier. Fireworks’ published policy is that customer prompts and outputs are not used to train models. The reading you receive is generated specifically for the input you provided; two people with identical inputs may still receive different readings because the model is non-deterministic.

Changes to this policy

We will post any update on this page with a new “Last updated” date. If a change materially expands what we collect or how we use it, we will also email registered users.

Contact

For any privacy question or to exercise the rights above, email support@rawtrait.com.