Privacy Policy

Last updated: July 2, 2026

This Privacy Policy explains how Tarot Insights ("we", "us", "our") collects, uses, stores, and protects your information when you use our application (the "Service").

We are committed to complying with applicable data protection laws, including the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA/CPRA) in the United States.

Your privacy in short

We never sell your personal data, and we never share it for anyone else's commercial gain.

We do not use your data for advertising, marketing, or profiling.

Your data is encrypted in transit and access is restricted to you and the systems needed to run the Service.

You stay in control — you can access, export, or delete your data at any time.

To generate your readings, the content you submit is sent to a third-party AI provider (currently Google) for processing. By using the Service you consent to this. See Section 3.

1. What Data We Collect

1.1 Account Information

If you create an account, we collect:

Email address (required to create an account)
Display name (from your Google profile if you sign in with Google, or set manually)
A unique account identifier generated when your account is created

1.2 Content You Create

When you use the Service, the following content is created and stored:

Questions and context you submit for tarot readings
Reading session data, including the spread type, drawn cards, card positions, and reading progress
AI-generated interpretations and summaries produced during your readings
Chat history between you and the AI within each reading session
Profile preferences, such as card reversal settings and selected card back design

1.3 Data Stored Only on Your Device

The following data is stored in your browser's local storage and is not transmitted to our servers:

Anonymous identifier — a randomly generated ID for visitors without an account, used solely to generate a consistent daily card draw
Daily card cache — your recent daily card results, stored so that your daily card stays the same throughout the day

You can remove this data at any time by clearing your browser data.

1.4 Technical Data Collected Automatically

When you access the Service, we may automatically collect:

Browser type and language
Device type and operating system
General location (country level, derived from IP address)
IP address (anonymized where required by law)

We make reasonable efforts to anonymize technical data wherever possible.

1.5 Data We Do NOT Collect

We do not collect special categories of personal data (such as health, religious beliefs, biometric data, sexual orientation, or political opinions)
We do not use cookies for advertising or cross-site tracking
We do not collect or process payment information

2. How We Use Your Data

We process your data for the following purposes:

Providing tarot readings and interpretations — using your questions, context, and card data. Legal basis: performance of a contract.
Generating AI-powered interpretations — using your questions, context, card details, and language preference. Legal basis: performance of a contract.
Saving and displaying your reading history — using your reading sessions and chat history. Legal basis: performance of a contract.
Maintaining your account and preferences — using your email, display name, and settings. Legal basis: performance of a contract.
Generating your daily card draw — using your anonymous or account identifier and the current date. Legal basis: legitimate interest.
Improving the Service and fixing issues — using anonymized technical data. Legal basis: legitimate interest.
Complying with legal obligations — using account data where required. Legal basis: legal obligation.

We do not sell your personal information, and we do not use your data for targeted advertising or automated profiling.

3.1 How AI Is Used

Tarot Insights uses an AI service provided by Google to generate card interpretations and reading summaries. When you open a card or request a reading, the following data is sent to the AI service:

Your question and any optional context you provided
The card drawn, its position in the spread, and its orientation
Interpretation guidelines and your language preference

3.2 What Happens to Data Sent to the AI Service

This data is processed on Google's servers and is subject to Google's Privacy Policy
We do not control how Google processes data it receives through its services
The AI-generated responses are stored as part of your reading history in our database

3.3 Other Service Providers

We use Google's cloud services for authentication, sign-in (including Google sign-in), and data storage. The data shared with these services includes your email address, display name, authentication credentials, and the content described in Section 1.2, which is stored on our behalf.

All service providers operate under their own privacy policies. We encourage you to review Google's Privacy Policy.

We may engage additional trusted service providers in the future. Any such change will be reflected in an updated version of this policy.

Generating readings is a core function of the Service, and it cannot be performed without the involvement of a third-party AI provider. Because of this:

By submitting a question, context, or reading request, you acknowledge and agree that the content you provide is sent to and processed by our third-party AI provider (currently Google) for the sole purpose of generating your reading.
This transfer happens only to deliver the feature you asked for. Your data is not shared with the AI provider for advertising, marketing, resale, or profiling by us.
If you do not want your input to be processed by a third-party AI provider, please do not submit it. The AI-assisted reading features of the Service cannot function without this processing.

We rely on this arrangement as necessary for the performance of the contract between you and us (delivering the reading you requested). Where consent is the applicable legal basis in your jurisdiction, your submission of a reading request constitutes that consent, and you may withdraw it at any time by discontinuing use of the AI features.

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

Performance of a contract — processing necessary to provide the Service you requested (readings, account features, history)
Consent — where you have given it, for example when accepting this policy at sign-up
Legitimate interests — for Service improvement, security, and analytics, where these interests are not overridden by your rights and freedoms
Legal obligation — where processing is required to comply with applicable law

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

5. Data Storage and Security

5.1 Where Your Data Is Stored

Your data is stored on cloud infrastructure provided by Google, in data centers that may be located outside your country of residence. For transfers of personal data out of the EEA, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission.

5.2 Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

Encrypted data transmission (HTTPS/TLS)
Access controls that restrict stored data to authenticated users
Server-side verification of every request to our services
Isolation that ensures each user can access only their own data

While we take reasonable precautions, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention

Account information — retained until you delete your account
Reading sessions and history — retained until you delete your account or request deletion
Profile preferences — retained until you delete your account
Data stored on your device — retained until you clear your browser data
Anonymized technical data — retained for up to 26 months

You may request deletion of your data at any time (see Section 10). Upon account deletion, we remove your personal data within 30 days, except where retention is required by law.

7. Your Rights

If you are located in the European Economic Area, you have the right to:

Access — request a copy of the personal data we hold about you
Rectification — request correction of inaccurate or incomplete data
Erasure ("right to be forgotten") — request deletion of your personal data
Restriction — request that we limit how we process your data
Data portability — receive your data in a structured, commonly used, machine-readable format
Objection — object to processing based on legitimate interests
Withdrawal of consent — withdraw consent at any time where processing is based on consent
Complaint — lodge a complaint with your local data protection supervisory authority

7.2 Rights Under the CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

Know — request disclosure of the categories and specific pieces of personal information we have collected about you
Correct — request correction of inaccurate personal information
Delete — request deletion of your personal information
Opt out of sale or sharing — we do not sell or share personal information as defined by the CCPA, so no action is needed
Non-discrimination — not be discriminated against for exercising your privacy rights

7.3 How to Exercise Your Rights

To exercise any of these rights, contact us at the address in Section 10. We will respond within one month under the GDPR (extendable for complex requests) or 45 days under the CCPA. We may need to verify your identity before fulfilling your request.

8. Children's Privacy

Tarot Insights is not directed at children. We do not knowingly collect personal data from:

Children under 16 years old in the European Economic Area
Children under 13 years old in other jurisdictions, or under the minimum age set by local law

If you are a parent or guardian and believe your child has provided us with personal data, please contact us. We will promptly delete such data from our systems.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last updated" date at the top of this policy
Notify you through the app or on our website before the changes take effect

If you do not agree with a change, you should stop using the Service and may request deletion of your data.

10. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or have a privacy concern, please contact us at:

📧 privacy@tarotinsights.app

If you are in the EEA, you may also contact your local data protection authority. A list of EEA supervisory authorities is available at edpb.europa.eu.