Lee JungAe, a sole proprietor registered in the Republic of Korea under the trade name 덕구스튜디오 (English display name: Duckgu Studio), operates Lodestar for launch in the United States, Republic of Korea, and Japan. Lodestar is an iOS service for astrology-inspired reflection. This policy explains what Lodestar processes, why it is used, and the choices available to you.
This policy also covers private in-app support and the Lodestar website community and inquiry forms where available. Private support is separate from public community sharing, which is not enabled in the current iOS release.
Information we process
| Area | Information | Purpose |
|---|---|---|
| Account and sign-in | Firebase UID and the name and email supplied through Sign in with Apple | Authenticate you, maintain your account, and provide support |
| AI conversations and reflections | Submitted text, replies and the latest result in the current conversation; reference notes and mood in modes that use them; derived sun sign and solar season; for AI chat, the lunar birth-year animal and the Western zodiac symbol derived from the sun sign; language, local date, and a pseudonymous safety identifier | Safety checks, conversation and reflection responses, private history, and interrupted-request retries |
| Website public copies | The title and text you choose to submit, optional sun sign, account link, consent version and time, copy revision, and publication or moderation status | Review a separate copy for publication, record your consent, and manage revisions and withdrawal |
| Private inquiries in the app and website | Account-linked subject, category, original messages and replies, message language, status history, and timestamps | Allow you and authorized support staff to follow and resolve your inquiry |
| Website reports and blocks | Reported public-copy identifier and revision, reason, staff decision and note, status and timestamps; viewer-specific opaque block identifiers | Review reports, record moderation decisions, and hide blocked authors from your signed-in view |
| Website audit records | Action, target identifier, staff or member role, a hashed actor reference, and timestamp; no journal or inquiry message text | Check moderation and support actions and protect the service |
| Subscription access | StoreKit entitlement or transaction identifiers, plan/status, and previously recorded trial timing retained for compatibility, where present | Verify Plus access, reconcile purchases and restorations, and prevent duplicate processing; historical trial data does not grant access |
| Notification settings and delivery | After sign-in and required setup, an account-authenticated installation ID is sent to Firebase to retrieve that device’s notification settings, even before notifications are enabled. If you turn them on: an APNs token, app language, time zone, selected time and notification types, last activity, whether you journaled that local day, fixed notification content, and delivery and duplicate-prevention metadata | Retrieve notification settings, deliver the functional notifications you selected, skip reminders you no longer need, and prevent duplicate delivery |
| Security and operation | App-integrity signals, essential configuration requests, limited operational logs, per-account counts of AI and safety requests, and rate-limit window timestamps | Used only to protect the service, apply rate limits, and troubleshoot; never used for advertising or location-related purposes |
| Legacy on-device records | If an earlier app version saved a place or lucky-item record, it may remain in protected account-scoped storage on that device. The current version does not create new records of this type or send them to Duckgu Studio servers, Google, or OpenAI. | Show the previously saved record read-only until you delete Lodestar’s local account data or the app |
Information kept only on your device
Voice input uses on-device speech recognition on supported devices and languages. Lodestar does not save or upload the recording. You can edit the transcription before saving it locally or choosing Send for an AI reflection under your AI permission.
Exact date of birth, gender, the local guardian-consent confirmation used for eligible teen access, non-AI notes, and keepsakes are stored only on your device and excluded from device backup. Duckgu Studio does not receive these fields through the normal service flow, and they are not sent to OpenAI.
Chat rooms, their full message histories and unsent drafts, and any names and birth dates you save for family or friends are kept in protected, account-scoped storage on that device and excluded from device backup. This room history and these person profiles do not sync across devices. Saved profile names and exact birth dates are not automatically sent to Duckgu Studio servers or OpenAI. For AI chat, the device calculates and sends the sun sign and lunar birth-year animal; the animal changes on Lunar New Year, not January 1. The server derives the Western zodiac symbol from the sun sign without receiving the exact birth date.
Deleting a chat room removes its history, draft, and saved profile details from this device. Deleting a person profile from the profile list does not remove the profile details already kept in an existing room. Information already sent for AI processing remains subject to the server and third-party retention rules below; deleting a room is not a request to delete those server records.
The current release does not provide map search or nearby-place recommendations, request iOS location permission, collect device coordinates or place categories, send them to Google Maps/Places, use the Google Maps/Places SDK or provider, or create new place records. The location-independent daily lucky item and number remain available and are calculated on your device.
If an earlier app version saved a place or lucky-item record, it may remain on that device. The current version displays previous records in read-only form, does not collect new location data or create place records, and does not send them to Duckgu Studio servers, Google, OpenAI, or another external provider. Those records are deleted when you delete Lodestar’s local account data or the app.
If you voluntarily include any of this information in an AI-reflection prompt, it becomes part of the reflection input described above.
The current release does not include an advertising SDK and does not request or display ads. Lodestar does not sell personal information or share it for cross-context behavioral advertising. If advertising is considered later, Duckgu Studio will update the applicable policy and terms, provide advance notice, and obtain consent or provide opt-out controls where required by law before activation. Any future ads must remain non-personalized; must not target minors; must not use journal or AI content, birth information, or sensitive information for targeting; and may appear only to eligible free users on neutral screens, never on AI or journal input and result screens, crisis, account, purchase, or legal screens.
Firebase Analytics and Performance SDKs are not included in the current release. Analytics and marketing email or push messages are inactive. Optional functional notifications are available only on devices where you turn them on, and each notification type can be turned off. Marketing messages may be enabled only after the required policy, consent, age-protection, international-transfer, and store disclosures are updated; they will use a separate opt-in where required.
AI and third-party processing
During initial setup after sign-in, you can explicitly allow or decline sharing with OpenAI in the United States for AI safety checks, conversations, and reflection. Declining still lets you use on-device notes. Your choice, notice version, and date are kept for that account on this device. The app asks again if a current choice is missing or the AI data-sharing notice changes, including the addition of the derived lunar birth-year animal for AI chat. AI requests require permission for the current notice. Once allowed, Send submits the request without another consent dialog each time. You can later allow or revoke permission from Profile → AI data permission.
A follow-up can resend recent submitted text and the latest completed response from the current conversation to keep the response in context. Reflection modes may also include reference notes you selected and your mood. The same private conversation or reflection record is updated. Other conversations are not automatically retrieved as cross-session AI memory. The backend also sends language, local date, derived sun sign and solar season, and a hashed account-derived safety identifier to OpenAI. AI chat additionally sends the lunar birth-year animal calculated on the device and the Western zodiac symbol derived on the server from the sun sign. AI chat does not require or automatically attach a mood or reference notes. Exact birth date, gender, name, email, the original account identifier, and purchase receipts are not automatically sent to OpenAI. Information you write in submitted text remains part of that text. The UTC offset is used by Lodestar’s backend, not included in the AI input.
The Firebase backend sends AI-reflection input and necessary context to OpenAI. OpenAI requests set `store:false`, so generated responses are not stored as API application state; this setting does not by itself disable abuse-monitoring logs. OpenAI API inputs and outputs are not used to train or improve OpenAI models unless Duckgu Studio explicitly opts in. Duckgu Studio has not confirmed that Zero Data Retention or Modified Abuse Monitoring is enabled for the production project. Under the default setting, OpenAI may retain content in abuse-monitoring logs for up to 30 days; longer retention may occur where required by law or reasonably necessary to protect the services or third parties from harm.
Service providers and overseas processing
Apple processes App Store payments and sign-in data when you use Sign in with Apple. Google Firebase provides authentication, database, functions, app attestation, and remote configuration. Firebase Analytics and Performance SDKs are not included in the current release. The Crashlytics SDK is linked, but automatic crash-report collection and symbol upload are disabled. Crash information may be kept locally on the device, but this release does not send it to Firebase. Remote Config is fetched only after the combined Privacy Policy and Terms agreement gate.
After sign-in and required setup, the app sends an installation ID with account authentication to Firebase to retrieve that device’s notification settings, even if notifications are off. This lookup alone does not create a notification registration or send data to Novu or APNs. If you turn notifications on for a device, Lodestar sends a pseudonymous subscriber ID, that device’s APNs token, app language, and time zone to Noti-Fire Apps Ltd. d/b/a Novu, an Israeli company, in Novu’s United States region. Each alert contains only its fixed title, body, type and Lodestar destination, plus delivery and duplicate-prevention metadata, and is routed through Apple Inc.’s APNs. Firebase keeps your selected schedule and notification types, last activity, and whether you journaled that local day. Your name, email, exact birth date, journal text, and AI result are not sent to Novu or APNs for notification delivery.
Firebase, OpenAI, Novu, and Apple may process information outside your country, including in the United States. The primary Firestore database and configured Novu region are in the United States; Novu is operated by Noti-Fire Apps Ltd. in Israel, and APNs by Apple Inc. in the United States. Notification information is sent to Firebase over encrypted connections when the app retrieves settings after sign-in and required setup. Data is sent to Novu and APNs only for notifications you have enabled, including registration, status updates and delivery; turning them off or signing out can send a deletion request. We apply the contractual and technical safeguards required by applicable law.
Analytics and marketing email or push messages are currently inactive. Their data categories, recipients, transfer details, retention, safeguards, age restrictions, consent, and opt-out controls will be confirmed before activation.
- Google Firebase: authentication, database, server functions, app integrity, and remote configuration
- OpenAI: AI safety checks, reflection generation, and follow-ups within the current conversation
- Apple: Sign in with Apple
- Apple StoreKit: subscription and transaction processing
- Noti-Fire Apps Ltd. d/b/a Novu, using its United States region, and Apple Push Notification service (APNs): optional functional notification delivery
- No advertising provider is active in the current release. Any future provider, data flow, transfer location, and retention period will be disclosed before activation.
- Google Workspace: support and privacy email handling
Retention
When you complete account deletion, the sign-in account is deleted immediately and access to its server-side service data is blocked immediately. The app deletes account-scoped data stored on that device immediately. Remaining server-side service data is kept separately for 30 days, inaccessible to a new account and not used to provide the service, personalize content, send marketing, or create profiles. At the end of 30 days, we permanently delete all account-linked service data in our systems; short-lived caches may expire earlier. You can register again with the same Apple Account during those 30 days, but it creates a new Lodestar account and does not restore the deleted account or its retained records.
The only exception in our systems is the minimum evidence that applicable law requires us to retain. Under Article 6 of the Korean E-Commerce Consumer Protection Act and Article 6 of its Enforcement Decree, this may include necessary contract or withdrawal, payment or service-supply, and consumer complaint or dispute evidence that we hold. We separate those records from service data, keep only the fields needed for the legal duty, and use them only for legal retention and response. They are permanently deleted when the statutory period and any legally required hold end.
| Information | Retention |
|---|---|
| Sign-in account and remaining AI-reflection service data | The sign-in account is deleted immediately. Remaining server records are isolated from new accounts and permanently deleted after 30 days, except for the minimum separately retained statutory evidence described below |
| Website public copies, consent, and moderation status | Public display and account access end immediately on a deletion request; permanently deleted at the end of the 30-day deletion waiting period |
| Private inquiries in the app and website | While the account is active, resolved inquiries are kept for up to three calendar years after resolution. Account deletion blocks access immediately and permanently deletes these records after 30 days, even if the normal retention period would end later |
| Website reports, blocks, and moderation or support audit records | Access is blocked immediately on a deletion request; account-linked records are permanently deleted at the end of the 30-day deletion waiting period |
| Interrupted-request retry cache | No longer than 2 hours, and in all cases no later than the account-deletion deadline |
| Notification settings and delivery state | On-device settings and the installation ID are deleted when account deletion is accepted. Firebase state is kept while the account is active. Turning notifications off or signing out requests deletion of that device’s Novu subscriber and APNs token; account deletion requests deletion for all devices. Novu notification activity and push-message records are retained for no more than 90 days under currently available standard plans; Apple handles transient APNs data under its own rules. |
| Contracts and withdrawal or cancellation records | 5 years where Korean e-commerce record-retention duties apply |
| Payment and service-supply records | 5 years where Korean e-commerce record-retention duties apply |
| Consumer complaints and dispute-resolution records | 3 years where Korean e-commerce record-retention duties apply |
| Display and advertising records | 6 months where Korean e-commerce record-retention duties apply |
| Routine operational and security logs | Account-linked portions are permanently deleted or irreversibly de-identified no later than the end of the 30-day deletion waiting period; logs with no account link are normally kept for 90 days |
| OpenAI abuse-monitoring logs | Up to 30 days by default; potentially longer where required by law or reasonably necessary to prevent harm |
| On-device notes and legacy records | Deleted immediately when the in-app account-deletion request is confirmed |
Website sharing, support, and browser storage
Private journals in the iOS app are never automatically made public. Website sharing requires a separate copy that you choose and explicitly consent to publish. Authorized staff review the current copy before publication; a revised submission requires renewed consent and review. The public view contains only the approved title and text, optional sun sign, public-copy identifier, revision, and publication time. It does not expose your authentication UID. Withdrawal stops further public access through the service, but cannot recall copies or screenshots that someone else already saved.
Private inquiries sent from the app or website are stored in Google Firebase in the United States and linked to your account. The in-app form asks for separate permission to send the subject, category, reply language, message, and account identifier. The conversation is available only to you and authorized support staff, not other members or the public. We preserve original messages, replies, their language, and status history. Staff translations are separate language-tagged replies and do not replace the original. Inquiry text is not automatically sent to a third-party translation service or AI provider. Account deletion follows the separate 30-day schedule above.
A report records the public copy and revision reported, your reason, and the staff decision, note, status, and timestamps. These records are available to authorized moderation staff, not the public. Blocking uses an opaque identifier specific to the signed-in viewer; the block list does not expose the blocked author’s authentication UID. Audit records contain action and identifier metadata, not private journal or inquiry message text.
The website uses Firebase Authentication with browser-tab session persistence to maintain your sign-in and apply your blocks as you navigate within that tab. Live journal and inquiry contents are not persisted by the website in localStorage or sessionStorage. Website requests also use Firebase App Check with Google reCAPTCHA Enterprise for abuse protection.
Your choices and rights
Profile → AI data permission lets you allow or revoke future AI requests on this device. Revoking permission does not recall information already transferred or delete saved reflections. You can keep using local notes and request deletion separately through the account controls or privacy contact below.
Where applicable, you may request access, correction, deletion, restriction, or withdrawal of consent through privacy@duckgustudio.com. We may need to verify your identity before acting.
From Profile, you can permanently delete your Lodestar sign-in account and this device’s account-scoped data immediately. Remaining server-side service records are kept inaccessible for 30 days and then permanently deleted, subject only to statutory retention. Registering again with the same Apple Account during that period starts a new account without restoring those records.
Deleting your Lodestar account does not cancel an Apple App Store subscription. Cancel it separately in your Apple account settings. Only the minimum records that applicable law requires are kept separately for the statutory period.
United States state privacy notice
For United States residents, the categories processed are the identifiers, account information, commercial or subscription records, Internet or device activity, user-provided reflection content, and inferences described above. Sources are you, your device, Sign in with Apple, StoreKit, and the service providers listed in this policy. We use and disclose these categories for the stated service, safety, security, support, transaction, and legal purposes.
During the preceding 12 months, Lodestar has not sold personal information or shared it for cross-context behavioral advertising, and the current release does not show ads. We do not offer a financial incentive for personal information and do not knowingly sell or share personal information of users under 16. If advertising is considered later, it will not use sensitive information, birth information, or AI and journal content for targeting, and the required notice, consent, and opt-out controls will be provided before activation.
Depending on your state and whether the relevant law applies, you may have rights to confirm processing, access, correct, delete, or obtain a portable copy of personal information; to opt out of sale, targeted advertising, or certain profiling; to limit certain sensitive-data uses; to use an authorized agent; to appeal a denied request; and to receive service without unlawful discrimination. Submit a request or appeal to privacy@duckgustudio.com. We will verify requests as appropriate and explain any denial and available appeal route. If an opt-out practice is introduced, Lodestar will provide the required control and honor applicable recognized universal opt-out signals before activating it.
Age, security, and changes
The minimum age is 14. If you have not reached the age of majority where you live, you may use Lodestar only with permission from a parent or legal guardian. Users under 14 may not create an account or use the service because no child-account or verified-parental-consent program is offered at launch. If we learn that an under-14 user provided information, we will restrict the account and take reasonable steps to delete the information as required.
We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security. Material changes will be announced in the app or on the service website before they take effect.
Contact
Operator: Lee JungAe, sole proprietor registered under the trade name 덕구스튜디오 (English display name: Duckgu Studio) (Republic of Korea; Business Registration No. 756-51-01119)
Representative: Lee JungAe
Business address: Apt. 1502, Building 104, Gyeongdong Apartments, 202 Dongmyeong-ro, Nam-gu, Busan, Republic of Korea
Public telephone: +82-10-3875-7339
Privacy: privacy@duckgustudio.com
Support: support@duckgustudio.com