The short version. You give us birth details; we calculate and write readings from them. We don't sell or share your data for advertising. An AI provider writes the prose from calculated signals only, never from your name or birth details. You can see, export, correct or delete your data at any time, wherever you live.
Self Dictionary writes a personal dictionary about you from your birth details. That means it handles information that is personal by nature. This page says, in plain words, what is collected, why, on what legal basis, who else handles it, where it goes, and what you can do about it. It applies to everyone who uses the site, wherever they are.
1. Who is responsible
The data controller is Tasha Amanda, an individual based in Indonesia, operating Self Dictionary at www.theselfdictionary.com. For anything about your data, write to hello@theselfdictionary.com. There is no separate data protection officer; the operator handles requests personally.
2. What is collected
Account: your email address and a hashed version of your password. Passwords are never stored in readable form. An optional display name.
Birth details: for each person you add: name, date of birth, time of birth if known, how certain the time is, city and country of birth, and, if you choose to say, how that person relates to you (partner, family, friend).
What the site produces: the calculated signals and the written readings for each person, stored so you can reread them.
Purchases: when you unlock an area, the order reference, amount, currency and time, as reported by the payment provider. Card numbers are never seen or stored by Self Dictionary.
Gift codes: which code was applied to which dictionary.
Recognition test: which of two readings you picked. If you opt in, the text of your Shadow Loop reading is kept in an anonymous pool and shown to other readers without your name, birth details or account.
Usage: page views with the page path, approximate country (derived from your IP address, which is not stored), device type, referring site and language; plus how you read: which entries and sections you open and how long they stay on screen, lines you tap to keep, copy or share as an image (the image carries only the line and the site name), PDF downloads, the local hour of your visit, and the one-tap reaction you may give an entry (felt seen, not me, too soft, too harsh). This is used in aggregate to learn which parts of a reading land, never to profile you individually. A random visitor identifier is set in a cookie so repeat visits can be counted without knowing who you are.
How pages are used: where on a page you click or tap (the position and which button or link, never the words on it), how far you scroll, how long the page is open, clicks that seem to do nothing or are repeated in frustration, and errors the page runs into. Self Dictionary also keeps a recording of how a visit moved: the page layout, scrolling, pointer movement and clicks, so problems can be seen and fixed. Anything you type is never recorded, sign-in and password pages are never recorded, and on pages that show readings or your account every word is masked, so a recording cannot show what your readings say. This all runs on our own servers, not a third-party analytics service. Recordings are deleted after 30 days and the rest after 180 days. If your browser sends a Do Not Track or Global Privacy Control signal, none of this is collected.
Password reset: if you ask to reset your password, a single-use link is emailed to your account address. Only a scrambled form of the link is stored, and it stops working after one hour or once used. Resetting signs you out everywhere else.
Before you sign up: if you enter birth details on the home page first, the calculation is stored for 24 hours under a random token so it can be attached to your account when you create one. If you never sign up, it is discarded.
Self Dictionary does not collect government identifiers, payment card numbers, precise location, or contacts. Birth details are personal data but not a special category under the GDPR; the readings are interpretive text, not health or biometric data, and they are not used to infer anything protected.
3. Why, and on what legal basis
Providing the service (running the calculations, writing and storing readings, keeping you signed in, fulfilling purchases and gift codes): necessary to perform our contract with you.
AI-written prose (sending calculated signals to Anthropic) and the anonymous recognition pool: your consent, which you can withdraw per dictionary at any time in the settings.
Abuse prevention (rate limits, blocking throwaway email domains), aggregate usage statistics and how pages are used (clicks, scrolling, recordings with typed text and readings masked): our legitimate interest in keeping the service running, finding what confuses people and fixing it, done on the site's own servers and without advertising networks. You can object at any time by turning on Do Not Track or Global Privacy Control in your browser, or by emailing us.
Keeping purchase records: legal obligations for accounting and refunds.
Your data is not sold, rented, shared for cross-context behavioural advertising, or used for profiling that produces legal or similarly significant effects on you. Readings are generated automatically, but nothing is decided about you from them.
4. Who else handles data
Anthropic (United States) writes the prose. It receives the calculated signals for a reading (for example, which patterns the systems agree on) and the language to write in. It does not receive your name, birth details, email or account. Switch this off per dictionary in the prose settings and readings are written from a fixed template on our server instead.
Dodo Payments is the merchant of record for purchases. When you unlock an area you are sent to their checkout, where they collect payment details under their own privacy policy. They receive your email address and a reference telling us which reader and which area to unlock.
OpenStreetMap Nominatim turns the birth city and country you type into coordinates. It receives the place name only.
ip-api.com turns your IP address into a country code, used for a default language and for the visitor count by country. The IP address is not stored by us.
Resend (United States) delivers password reset emails. It receives your email address and the email's contents (the reset link), nothing else.
Railway (United States) hosts the application and its database.
These providers act on our instructions as processors, except Dodo Payments, which is an independent controller for the payment itself. None of them may use your data for their own purposes beyond what their terms with us allow.
5. Where data goes (international transfers)
The site is operated from Indonesia and hosted in the United States, so your data is transferred outside the country you live in, including outside the EEA and the UK. Transfers to our processors are covered by their contractual commitments, including standard contractual clauses where the GDPR or UK GDPR requires them. If you would like a copy of the relevant safeguards, email us.
6. Other people's details
You can add up to three people to your account. Only add someone else's birth details if they are an adult and have agreed to it. Their dictionary belongs to your account; you can delete it at any time, and they can ask us to delete it directly.
7. Cookies
A session cookie that keeps you signed in, for up to 30 days. Strictly necessary.
A language cookie, set only when you choose a language. Strictly necessary for the choice you made.
A random visitor identifier for the site's own visit counting, kept for one year. It contains no personal details and is not shared.
A short-lived token (24 hours) if you started a dictionary before signing up.
The page also keeps a random visit number in your browser's session storage, cleared when you close the tab, so clicks on different pages of one visit can be grouped.
There are no third-party advertising or tracking cookies, so no cookie banner is shown. If you clear cookies you are simply signed out.
8. How long data is kept
Dictionaries are kept until you delete them. Deleting a dictionary from "My Dictionaries" removes its birth details and readings immediately. Accounts are kept until you ask for deletion, after which the account and its dictionaries are removed within 30 days. Purchase records are kept for as long as accounting and tax rules require (typically up to 10 years), without the readings they paid for. Aggregate usage counts contain no personal details and are kept. Visit recordings are deleted after 30 days; click, scroll and error records after 180 days. Password reset links expire after one hour. Backups roll over within 30 days.
9. Your rights
Wherever you live, you can ask to:
access the data held about you and receive a copy;
export it in a usable form (every reading can be downloaded as a PDF from the site, and we can provide the stored data on request);
correct it;
delete it ("right to be forgotten");
restrict or object to processing based on legitimate interest;
withdraw consent for the AI writer or the recognition pool at any time, without affecting what happened before;
not be treated differently for exercising any of these rights.
Email hello@theselfdictionary.com from the address on your account. We answer within 30 days (within 45 days where that is the applicable limit) and do not charge for reasonable requests. We may ask you to confirm you own the account.
European Economic Area and United Kingdom
You have these rights under the GDPR and the UK GDPR. You can also lodge a complaint with your national supervisory authority, or with the UK Information Commissioner's Office.
United States
Residents of California and other states with consumer privacy laws have the rights to know, access, correct, delete, and to opt out of sale or sharing of personal information. Self Dictionary does not sell or share personal information and does not use sensitive personal information for anything beyond providing the service, so there is nothing to opt out of. You may use an authorised agent to make a request. Self Dictionary does not respond differently to browsers that send a Global Privacy Control signal because no sale or sharing takes place.
Indonesia
You have these rights under the Personal Data Protection Law (UU 27/2022), including the right to withdraw consent and to complain to the data protection authority once established.
Elsewhere
Readers in Brazil (LGPD), Australia (Privacy Act), Singapore (PDPA) and other countries with privacy laws have comparable rights, and the same email address handles them.
10. Security
Connections use HTTPS. Passwords are hashed with bcrypt. Access to readings is checked on the server for every request. Payment details never pass through Self Dictionary. No system is perfectly secure; if a breach affects your personal data you will be told without undue delay, and authorities will be notified where the law requires it.
11. Age
Self Dictionary is for adults. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if you believe a minor has created an account, email us and it will be removed.
12. Changes
When this policy changes, the version date at the top changes, and the sign-up form records which version each account agreed to. Material changes will be announced on the site, and where the law requires it, you will be asked to agree again.