Your data boundary
Tianji Wendao keeps chart calculation, almanac results, task projects, field attachments, and decision journals on your device. Remote environment analysis, AI explanations, sharing, and calendar export happen only after you choose them.
What stays on your device
Your birth details, calculated charts, almanac results, decision-journal entries, grave and space survey projects, date-selection projects, and any compass field records you choose to save are stored locally. There is no Tianji account, cloud sync, advertising SDK, third-party analytics SDK, or cross-app tracking. Removing the app removes this local data.
On the website, Fengshui course completion, bookmarks, the last visited lesson, workspace self-check scores, and their update time stay in the current browser. They are not sent with tutor requests. You can remove them by clearing this site’s browser data.
If you choose a local floor-plan image in the Fengshui course tool, the page reads it only into the current browser tab’s memory to draw the overlay. The image is not uploaded to Tianji’s server, is not included in AI tutor requests, and is not retained by the tool after the page is closed or reloaded.
The web Daily Almanac stores incense records, optional private messages, notes and tasks only in your browser. Backups are unencrypted files under your control. Its separate, optional usage measurement is off by default. If enabled, it sends this site only a random browser identifier, a page-visit flag and a generic interaction flag, aggregated by UTC day. It sends no incense action types, recorded dates, messages, notes, tasks or chart information. Identifiable usage rows expire within 30 days. Disable measurement in the almanac settings at any time.
The two-person compatibility feature calculates its report and relationship K-line locally. On the web, it offers an optional first-party product-metrics checkbox. If you opt in, Tianji records only a random session identifier, funnel step, whether zero/one/two birth times were known, the result band, and event time. It never records names, nicknames, birth dates or times, places, current intimacy choice, chart pillars, questions, free text, or device fingerprints. Raw events are retained for no more than 30 days; daily aggregate counts may be retained longer to evaluate the feature. Declining does not change the compatibility experience. The iOS app uses no analytics SDK.
On the web, the most recent 20 compatibility reports are stored in the current browser so you can reopen them. These local records may include the nicknames you entered, the derived local report, payment progress, and the completed AI explanation. They do not include birth dates, birth times, places, or full pillars. You can delete one record or clear all compatibility history from the compatibility page. Browser history is not account-synced and disappears if browser site data is cleared.
When you open Compass, the app requests foreground location to calculate true north and display coordinates, altitude, and accuracy. Standalone Compass location and heading are processed on the device and are saved locally only if you tap “Save Field Reading.” The Level and Slope tool similarly processes device motion only while that tool is open and does not upload or automatically save those readings.
Remote Candidate Screening is a separate, user-initiated exception. When you tap to start remote screening, the selected candidate’s precise latitude and longitude, screening radius, and site type are sent to Tianji’s server. The server uses a coordinate grid and bounding area derived from that point to request public elevation, waterway, road, and map data from public terrain/map data services. Terrain and map responses may be temporarily cached on Tianji’s server to complete the analysis, retry transient failures, and avoid duplicate public-data requests; normal cache periods are no longer than 24 hours. The terrain request does not include the candidate name, project name, deceased-person profile, photos, voice notes, or field notes.
Optional remote analysis for a Space Survey is also started only by you. It sends precise coordinates, the selected 2/5/10/20 km radius, space dimensions, and building/entrance bearings. It does not send the construction year, project name, typed address, people, photos, audio, or notes. A local rule report remains available if remote analysis fails or is skipped.
Field-record photos use Apple’s system photo picker without broad photo-library access. Microphone access is requested only when you start a voice note. Selected photos and voice recordings are stored in the app’s protected local folder and are not uploaded. Camera access is requested only while AR field alignment is open; the live camera feed is not captured, saved, or uploaded. A field PDF is generated locally only after you request it, is removed when the record screen closes or on the next app launch, and leaves the app only when you explicitly choose a destination in the iOS share sheet.
Date Selection can open Apple’s system calendar editor after you choose a date and grant write-only calendar access. Tianji prepares an all-day draft, but you choose the calendar, time details, and whether to save or cancel. Tianji does not read your calendars.
What is sent when you use AI
AI request contents vary by feature. For a personalized chart reading, only after you tap “Send question,” Tianji sends:
- the question you entered; and
- a chart-structure snapshot derived from your birth details, including Four Pillars and chart-house/star information.
Your profile name is excluded. A chart snapshot can still reveal or narrow down birth information, so do not include names, contact details, health records, financial account information, or other highly sensitive details in your question.
The Fengshui course tutor on the website is a separate exception. It does not read your local profile or automatically attach a chart snapshot. When you choose a suggested question, press Enter in the question field, or click “Ask,” it sends the complete question text, the current lesson title, and the lesson summary through Tianji’s proxy to DeepSeek; the client also attaches the device’s current local date and time, IANA time zone when available (otherwise a device-local-time-zone marker), UTC offset, and UTC time. LinkAI may be used as a fallback if DeepSeek is unavailable. Saved completion status, bookmarks, last-visited history, and workspace self-check scores are not sent, but the current lesson title and summary are. Anything you type in the question—including birth details, Four Pillars, an address, or a precise location—is sent in full. Do not enter those details, names, contact details, health records, financial account information, or other sensitive information.
If you separately request a Space Survey AI explanation, only the space type, dimensions, optional construction year, bearing/accuracy evidence, local rule version, and any remote evidence summary are sent. Coordinates, address text, project name, photos, audio, and notes are excluded. A Date Selection AI explanation sends the rule activity code, candidate dates, fixed grades, almanac evidence codes, and participant-conflict counts; participant labels, birth years, and zodiac signs are excluded. AI is an explanation layer and cannot change deterministic rule grades.
If you tap “Generate AI deep analysis” in the two-person compatibility feature on the web or iOS, the request contains only the relationship stage, fixed result and dimension bands, confidence band, rule IDs, redacted evidence categories, and month categories. It excludes nicknames, birth details, places, current intimacy choice, full pillars, and free text. AI cannot change the deterministic result, rule evidence, or relationship K-line, and the complete local report remains available if AI fails.
How AI data is processed
The request is encrypted in transit and passes through Tianji’s server to DeepSeek. If that service is unavailable, LinkAI may be used as a fallback. These providers process data in the People’s Republic of China and may retain request data or security logs according to their service, safety, caching, and legal-retention rules.
Tianji’s proxy does not intentionally write question bodies or chart snapshots to application logs. It processes the network address for delivery and abuse prevention; its local rate-limit record uses a one-way address hash and a rolling 60-second request count. Infrastructure access logs may be retained for security and operations.
For a paid compatibility diagnosis, Tianji temporarily stores a de-identified recovery record on its own server so a payment started in WeChat can be recovered after Alipay opens another browser context. It contains the random order identifier, relationship stage, fixed bands, confidence, rule IDs, evidence categories and display text, month categories, and up to two AI response texts. It excludes nicknames, birth details, places, current intimacy choice, full pillars, and free-form user text. Paid recovery records are removed seven days after payment; expired unpaid recovery records are removed earlier.
Purpose and sharing
AI request data is used only to generate the answer, keep the service reliable, prevent abuse, and comply with law. Tianji does not sell this data or use it for advertising. It is shared only with hosting/network infrastructure and the AI providers needed to provide the feature, or when legally required.
Your choices and requests
- Do not send a question to avoid AI data transfer. All deterministic chart and almanac features remain available offline.
- Delete individual journal records in the app, or delete the app to remove all locally saved data.
- For access, correction, deletion, or other privacy requests concerning provider-side data, review the Tianji support page and email [email protected]. Provider cooperation may be required and legal retention exceptions may apply.
Children and changes
Tianji Wendao is not directed to children under 13, and children should not submit personal data through AI. Material policy changes will be posted here with a new effective date.
你的数据边界
排盘、黄历、天机项目、现场附件和决策日记保存在本机。远程环境分析、AI 解释、分享和日历导出，只有你主动选择后才会发生。
保存在本机的数据
出生信息、计算结果、黄历、决策日记、墓穴/空间勘察项目、办事择日项目和你主动保存的罗盘现场记录保存在当前设备。应用不设天机账号、不做云同步，不使用广告、第三方分析 SDK 或跨 App 追踪。删除 App 会清除这些本机数据。
在网页端，风水课程的完成状态、收藏、最近访问课节、工位自查分数及更新时间只保存在当前浏览器，不会随伴读助教请求发送。清除本站浏览器数据即可删除这些记录。
如果你在风水课程工具中选择本地户型图，页面只会把图片读入当前浏览器标签页的内存，用于绘制叠加层。图片不会上传至天机服务器，不会随 AI 助教请求发送，关闭或刷新页面后工具也不会继续保留该图片。
网页“今日一炷香”黄历的香记、可选寄语、随记和待办仅保存在当前浏览器；导出的备份是由你自行保管的未加密文件。黄历另有独立、默认关闭的可选使用统计：开启后仅向本站发送随机浏览器标识、页面到访与一般操作标记，按 UTC 日期汇总，不发送点香行为类别、记录日期、寄语、记事、待办或命盘。带浏览器标识的使用记录在 30 天内到期删除，可随时在黄历设置中关闭统计。
“双人婚恋合盘”在本机计算报告与感情 K 线。网页端提供可选的第一方匿名体验统计；只有你勾选同意后，天机才会记录随机会话标识、漏斗步骤、双方时辰完整度、结果等级和事件时间；不会记录姓名/昵称、生辰、地点、当前亲密度选择、四柱、问题、自由文本或设备指纹。原始事件最多保留 30 天；每日聚合计数可能为评估功能而保留更久。拒绝统计不影响合盘功能。iOS App 不使用分析 SDK。
网页端会在当前浏览器保存最近 20 条合盘历史，便于重新查看。记录可包含你填写的昵称、派生出的本地报告、支付进度和已完成的 AI 说明，但不包含出生日期、出生时间、地点或完整四柱。你可以在合盘页删除单条记录或一键清空。历史不做账号同步；清除浏览器网站数据后也会一并消失。
打开罗盘时，应用会申请前台位置权限，用于计算真北并显示坐标、海拔和定位精度。单独使用罗盘时，位置与航向只在设备上处理；只有点击“定穴并保存”后才会保存到本机。“水平与坡度”工具同样只在工具打开时于本机处理设备姿态，不上传或自动保存相关读数。
“远程候选点初筛”是由你主动启动的独立例外。点击开始远程初筛后，所选候选点的精确经纬度、分析半径和场地类型会发送至天机服务端。服务端会根据该点生成坐标网格和边界范围，并向公开地形/地图数据服务请求高程、水系、道路和地图数据。为完成分析、重试临时失败并避免重复请求，公开地形与地图响应可能在天机服务端暂时缓存，正常缓存期限不超过 24 小时。地形请求不包含候选点名称、项目名称、逝者资料、照片、录音或现场备注。
“空间勘察”的可选远程分析同样仅由你主动启动。请求会发送精确坐标、所选 2/5/10/20 公里范围、空间尺寸及建筑/入口方向；不发送建造年份、项目名、地址文字、人物、照片、录音或备注。不使用或分析失败时，本地规则报告仍可生成和保存。
现场照片通过 Apple 系统照片选择器添加，不申请整个照片库权限。只有开始录制语音备注时才会申请麦克风权限。选中的照片和录音保存在应用受保护的本机目录中，不会上传。只有打开 AR 实景对线时才会申请相机权限，实时画面不会被拍摄、保存或上传。现场 PDF 仅在你主动生成后临时保存在本机，记录页关闭或 App 下次启动时会清除；只有通过 iOS 分享面板明确选择目标后才会离开应用。
办事择日在你选定日期并授予日历“仅写入”权限后，可以打开 Apple 系统日历编辑器。应用只准备一个全天事件草稿，日历、具体时间以及最终保存或取消都由你决定；天机不会读取你的日历。
使用 AI 时发送的数据
不同 AI 功能发送的内容不同。在个性化命盘问答中，只有点击“发送问题”后，应用才会发送你输入的问题，以及由出生信息推导出的命盘结构快照，包括四柱和宫位/星曜信息。称呼不会发送，但命盘快照仍可能缩小出生时间范围。请勿在问题中加入姓名、联系方式、健康记录、金融账户或其他高度敏感信息。
网页“风水实战教程”的伴读助教是一个独立场景，不会读取本地命理档案或自动附加命盘快照。点击快捷问题、在问题框按 Enter 或点击“提问”后，它会把问题全文、本课标题和本课摘要经天机代理发送至 DeepSeek；客户端还会自动附加设备当前的本地日期时间、设备可提供时的 IANA 时区（否则使用设备本地时区标记）、UTC 偏移和 UTC 时间。DeepSeek 不可用时可能回退 LinkAI。已保存的完成状态、收藏、最近访问记录和工位自查分数不会发送，但当前课标题与摘要会发送。你写入问题的任何内容都会完整发送，包括生辰、四柱、住址或精确位置。请勿输入这些信息，也不要输入姓名、联系方式、健康记录、金融账户或其他敏感信息。
如果你另行请求“空间勘察”AI 解释，只会发送空间类型、尺寸、可选建造年份、方向/精度证据、本地规则版本和已有的远程证据摘要；不发送坐标、地址文字、项目名、照片、录音或备注。“办事择日”AI 解释只发送规则活动代码、候选日期、固定档位、黄历证据代码和参与者冲突人数；不发送参与者称呼、出生年份或生肖。AI 只负责解释，不能改写确定性规则档位。
在网页端或 iOS 的双人婚恋合盘中点击“生成 AI 深度分析”后，才会发送关系阶段、固定结果与分项等级、置信度、规则 ID、脱敏证据类别和月份分类；不发送昵称、生辰、地点、当前亲密度选择、完整四柱或自由文本。AI 不能修改确定性等级、规则证据或感情 K 线，失败时仍可查看完整本地报告。
AI 数据如何处理
请求在传输中加密，经天机服务器发送给 DeepSeek；服务不可用时可能回退到 LinkAI。服务商在中华人民共和国境内处理数据，并可能按服务、安全、缓存和法定义务保留请求或安全日志。
天机代理不会主动把问题正文或命盘快照写入应用日志。服务器会为传输和防滥用处理网络地址；本地限流记录仅保存地址的单向哈希与滚动 60 秒请求数。基础设施访问日志可能为安全和运维而保留。
付费婚恋诊断会在天机自有服务器临时保存一份去身份化恢复记录，使从微信发起、再由支付宝打开其他浏览器上下文的支付仍可取回。记录包含随机订单号、关系阶段、固定档位、置信度、规则 ID、证据类别与展示文案、月份分类，以及最多两次 AI 响应文本；不包含昵称、生辰、地点、当前亲密度、完整四柱或用户自由文本。已付款恢复记录在付款 7 天后删除；过期未付款记录会更早清理。
用途、共享和你的选择
AI 数据仅用于生成回答、保障服务、防止滥用和履行法定义务，不出售或用于广告。除必要的托管、网络和 AI 服务商外不会共享，法律要求的情形除外。
- 不发送问题即可避免 AI 数据传输；确定性排盘和黄历仍可离线使用。
- 可在应用内删除单条日记，或删除 App 清除全部本机数据。
- 需要访问、更正或删除服务商侧数据时，请先查看天机支持页面，并发送邮件至 [email protected]；部分请求需服务商配合，且可能受法定保留义务限制。
儿童与政策更新
本应用不面向 13 岁以下儿童，儿童不应通过 AI 提交个人信息。重大政策变更会在本页面更新生效日期。