Privacy Policy

1. Controller

Overthinking is operated by NAX, a brand of THEBRG ENTERPRISE (003120480-W), Malaysia. This policy explains our data practices under Malaysia’s Personal Data Protection Act 2010 (PDPA).

It covers 占卜, all My Luck modes: fixed-price digital entertainment only. Results do not guarantee future outcomes or constitute professional advice. See the Terms & Conditions and Refund Policy for purchase and refund conditions.

2. No separate account required

There is no sign-up or password. Paid access uses a random play code and secret token stored on your device. For My Luck personalisation you may provide a nickname, birthday, Chinese zodiac and optional partner birthday. We do not request your legal name, phone number, address, photograph or identity documents.

3. What we store

• Entry record — random play code and secret token, entries bought and used, amount, currency and payment reference.
• Device identifier — random browser-generated string keeping entries on that device; it is not linked to your identity and can be removed by clearing browser storage.
• 占卜 reading record — question, optional background, life area, cast lines, hexagrams, language, reading and creation time.
• My Luck record — nickname, birthday, zodiac, optional partner birthday, mode, fortune, score, digital card and session history.
• Technical logs — standard server logs kept briefly for security and fraud prevention.

4. Payments

HitPay Payment Solutions handles payments. Card, bank and wallet details are entered on its secure page and never reach our systems. We receive only payment status and reference. HitPay’s own privacy policy applies to data provided to them.

5. Why we process data

To credit and honour paid entries; generate and retain requested readings and fortunes; show history and collection; resume sessions; prevent fraud and abuse; meet tax and accounting obligations; and keep the Service secure. We do not sell data or use it for advertising.

6. Sharing

We share data only with our payment processor, hosting and database providers acting on our instructions, or where required by Malaysian law, court order or lawful regulatory request.

7. Retention

Entry and payment records are kept for up to seven (7) years for Malaysian accounting and tax obligations. 占卜 readings, My Luck profiles and sessions are kept for up to twelve (12) months, unless deletion is requested earlier and no legal or fraud-prevention duty requires retention. Technical logs are kept for up to ninety (90) days.

8. Storage on your device

Your device identifier, play code and entry token are stored in your browser’s local storage and are necessary for account-free access. We do not use advertising or tracking cookies.

9. Children

The Service is not directed at children under 13. Anyone below their jurisdiction’s age of legal capacity should play only with parental or guardian consent; the adult is responsible for payment.

10. Your rights

Subject to the PDPA, you may request access to, correction or deletion of data linked to a play code or payment reference, and limit processing. You must provide the code or reference to locate your record since we do not hold identifying data. Requests may be refused where law or fraud prevention requires retention.

11. Security

Entry and reading data is stored in a protected database inaccessible from the browser. Paid access is validated on our servers. No system is perfectly secure; we use reasonable technical and organisational safeguards.

12. Contact

Privacy enquiries: NAX, a brand of THEBRG ENTERPRISE (003120480-W), Malaysia — nax.com.my