Privacy Policy

Information We Collect

We collect information you provide directly and information collected automatically through your use of the Service.

• Account & Contact Data: your email address when you request a tarot reading (used only to deliver your reading via Resend).
• Reading Content: the question(s) you submit and the tarot reading generated for you, which may include personal reflections you choose to share.
• Payment Data: billing information processed by our payment provider (Stripe). We do not store full card numbers.
• Usage Data: aggregate, non-identifiable traffic metrics collected via our self-hosted Umami analytics (cookieless, no persistent identifiers or IP storage). We do not track personal data.
• Communications: messages you send to our support or contact addresses.

How We Use Your Data

• Generate your personalized AI tarot reading based on the question you provide.
• Deliver reading results to the email address you provide (via Resend).
• Process payments and prevent fraud (via Stripe).
• Improve, maintain, and secure the Service.
• Comply with legal obligations.

Third-Party AI & Infrastructure Providers

To provide the Service, we share certain data with vetted third-party processors. In particular, the question you submit and the cards drawn are sent to the DeepSeek API, which powers the AI generation of your tarot reading. It is transmitted securely over HTTPS, processed transiently in memory, used solely to produce your reading, and is never stored.

We use the following service providers:

• DeepSeek API — AI inference that generates your tarot readings from your question and drawn cards. Processing is transient and in memory; no data is stored.
• Hetzner Online GmbH — production application hosting and infrastructure.
• Resend & Stripe — email delivery of your reading and secure payment processing.
• Umami Analytics — a cookieless, privacy-preserving analytics tool that gathers aggregate traffic metrics only. No personal data or persistent IP addresses are tracked or stored.

These providers process data only as necessary to perform their functions and are bound by appropriate data processing terms. We do not sell your personal information.

Cookie Policy

We use only strictly necessary cookies and local session storage required for the Service to operate (for example, remembering your reading session). We do not use any tracking, advertising, or cross-site cookies.

• Strictly necessary cookies / session storage: required for core site functionality (for example, session state). These are not used for tracking.

Because we use no tracking cookies, no cookie consent banner is required. You may still control cookies through your browser settings; disabling strictly necessary cookies could affect basic site operation.

Data Retention

We follow a zero data retention model. We do not operate a user database and keep as little as possible.

• Reading questions & generated readings: processed transiently in real time, in memory, via the DeepSeek API to produce your result. They are never written to disk or stored, and exist only for the duration of the request.
• Email address: stored solely by our email/payment processors (Resend/Stripe) to deliver the service, and never logged in any internal user database of ours. You may request erasure at any time.
• Payment data: processed by our payment provider (Stripe); we do not store payment details or maintain an internal user database.
• Analytics: Umami collects aggregate, non-identifiable traffic metrics only. No personal data or persistent IP addresses are tracked or stored.

Your Rights (Access & Deletion)

Depending on your location, you have rights under the GDPR (EEA/UK) and the CCPA/CPRA (California), including:

• Access the personal data we hold about you.
• Request correction or deletion of your personal data.
• Object to or restrict certain processing.
• Data portability.
• Opt out of the sale or sharing of personal information (we do not sell your data).
• Withdraw consent at any time.

To exercise these rights, email [email protected]. We will respond within the timeframes required by law (generally within 30 days). You also have the right to lodge a complaint with your local supervisory authority.

Contact Us