Privacy Policy

1. Controller

Overthinking is operated by NAX, a brand of THEBRG ENTERPRISE (003120480-W), Malaysia. This policy explains what we collect and why, and is issued in line with the Malaysian Personal Data Protection Act 2010 (PDPA).

This policy covers every Overthinking experience, including 占卜, every MY LUCK mode and every challenge mode. All are fixed-price digital entertainment experiences. Results are for entertainment, reflection and cultural experience only and do not guarantee future outcomes or constitute professional advice. Purchase and refund conditions are explained in our Terms & Conditions and Refund Policy.

2. No separate account required

There is no sign-up or password. Paid access is linked to a random play code and secret token stored on your device. Depending on the experience you choose, you may provide an email and country for challenge rankings, or a nickname, birthday, Chinese zodiac and optional partner birthday for MY LUCK personalisation. We do not ask for your legal name, phone number, address, photograph or identity documents.

2A. Leaderboard details you give us

After payment you provide an email address and a country so your completed runs can be ranked. The email address is stored privately with your entry record and is never displayed on the public ranking. The ranking shows a random player label together with the country and score. We do not verify the address, send marketing to it, or sell or share it. You may ask us to remove your ranking entries at any time using the contact details below.

3. What we store

• Entry record — a random play code, a random secret token, the number of entries bought and used, the amount, the currency, and the payment reference.
• Device identifier — a random string generated in your browser so your entries stay available on that device. It is not linked to your identity and can be cleared by clearing your browser storage.
• Game run record — the challenge sequence, progress and score of each run.
• 占卜 reading record — your question, optional background, chosen life area, cast lines, hexagrams, language, generated reading and creation time.
• MY LUCK record — the nickname, birthday, zodiac and optional partner birthday you provide, plus selected mode, generated fortune result, score, digital card and session history.
• Technical logs — standard server logs kept briefly for security and fraud prevention.

4. Payments

Payments are handled by HitPay Payment Solutions. Card, bank and wallet details are entered on the processor's secure page and never reach our systems. We receive only the payment status and reference. HitPay's own privacy policy applies to the data you give them.

5. Why we process this data

To credit and honour your paid entries, generate and retain the reading, fortune or challenge experience you requested, show your history and collection, let you resume an unfinished session, prevent payment fraud and abuse, comply with tax and accounting obligations, and keep the Service working and secure. We do not sell your data or use it for advertising.

6. Sharing

We share data only with our payment processor, our hosting and database providers acting on our instructions, and where required by Malaysian law, a court order, or a lawful regulatory request.

7. Retention

Entry and payment records are retained for up to seven (7) years to satisfy Malaysian accounting and tax requirements. Challenge runs, 占卜 readings, MY LUCK profiles and MY LUCK session records are retained for up to twelve (12) months, unless you request deletion earlier and no legal or fraud-prevention obligation requires retention. Technical logs are retained for up to ninety (90) days.

8. Storage on your device

We store your device identifier, your play code and your entry token in your browser's local storage. These are strictly necessary for the Service to work without an account. We do not use advertising or tracking cookies.

9. Children

The Service is not directed at children under 13. Players below the age of legal capacity in their jurisdiction should only play with the consent of a parent or guardian, who is responsible for any payment made.

10. Your rights

Subject to the PDPA, you may request access to, correction of, or deletion of the data associated with a specific play code or payment reference, and you may limit our processing. Because we hold no identity data, you must supply the play code or payment reference so we can locate the record. Requests may be refused where retention is required by law or for fraud prevention.

11. Security

Entry and run data is held in a protected database that is not readable from the browser. All paid access is validated on our servers. No system is perfectly secure, but we apply reasonable technical and organisational safeguards.

12. Contact

Privacy queries: NAX, a brand of THEBRG ENTERPRISE (003120480-W), Malaysia — nax.com.my