Privacy Policy

1. Information We Collect

We collect the following categories of personal information to provide and improve our readings, reports, and tools:

• Account information: your email address and display name, and — if you sign in with Google — your authentication identifier and, optionally, your profile photo.
• Reading inputs: the question or intention you enter, any free text describing your situation, your selected mood, and the cards drawn. These may reveal sensitive information about you or other people you mention. Please avoid entering full names or identifying details about others.
• Birth and relationship details: for astrology and relationship readings and reports, your date of birth and — where you provide them — your time of birth, place of birth (which may include approximate or precise location coordinates and time zone), and a partner's name and date of birth.
• Reading history and reflections: your past readings and interpretations, and any notes or journal reflections you choose to save.
• Healing tool entries (optional): if you use our no-contact tracker, breakup journal, or message decoder, the information you enter there — your streak start date, your stated goal and reasons, daily mood check-ins, logged urges and what triggered them, journal entries, any personally significant dates you add, and messages you paste for decoding (which may include another person's words — please avoid including full names or identifying details). These can reveal sensitive information about your emotional state and relationships; they are private to your account and are never shown to other users.
• Purchase information: records of your purchases, subscription status, and credit balance, plus identifiers from our payment processor (Stripe). We do not store your full card number — card details are handled directly by Stripe.
• Marketing attribution: referral and campaign identifiers (such as click IDs and UTM parameters) and the page you arrived from.
• Communications: messages you send us (for example, through the contact form) and, where applicable, your email engagement such as opens and clicks.
• Device, usage, and analytics data: browser and device type, IP address, and analytics identifiers collected through the tools described in "Cookies and Tracking."
• Push notification data (optional): if you opt in, the subscription details needed to send you web or app notifications.
• Inferred data: limited automated inferences drawn from your activity — such as the topic or category of your question, a preferred reading style, and how much readings or quiz results resonate — used to personalize the service.

2. How We Use Your Information

We use your information to:

• Provide personalized readings, reports, and chat — which involves sending your inputs to our AI providers (see "How We Share Your Information")
• Save your reading history for future reference
• Process your purchases, subscriptions, and credits
• Send account-related communications and, where you have opted in, marketing communications
• Secure the service, prevent fraud, and improve our products and user experience
• Personalize your experience using limited automated analysis — for example, inferring your question's topic, remembering a preferred reading style, and scoring how much readings or quizzes resonate. This is automated and for entertainment only, with no legal or similarly significant effect on you.
• Produce aggregate, de-identified statistics (for example, common themes or popular cards) from which you are not identified, for editorial, research, and marketing purposes

3. Legal Bases for Processing (EU/EEA and UK)

If you are in the EU/EEA or the UK, we rely on the following legal bases:

• Performance of a contract — to provide the readings, reports, and purchases you request.
• Consent — for marketing communications, non-essential cookies and advertising, and any sensitive details you choose to enter. You can withdraw consent at any time.
• Legitimate interests — to secure, analyze, and improve the service, where not overridden by your rights.
• Legal obligation — to keep records (such as financial records) as required by law.

4. Data Storage, Security, and Retention

Your data is stored using industry-standard encryption. We use Firebase Authentication and Firestore with security rules, and our systems are hosted in the United States. Access is limited to you, to our authorized personnel, and to the sub-processors described below.

We keep your account profile and saved reading history until you delete it or close your account. Financial records are retained for as long as required by law (and are anonymized, rather than deleted, when you close your account). Unredeemed credits expire after 12 months, and short-lived items such as download links expire within a few days. You can delete your account and associated personal data at any time from your account settings.

To hold no more than we need, much of the supporting data we generate is deleted automatically on a schedule, even while your account stays open:

• Security and rate-limiting records — sign-in links and usage counters expire within hours to a few days, and payment-processor webhook logs are deleted after 30 days.
• Quiz and tool results — results you generate from our standalone quizzes and tools are deleted on a rolling basis, between 90 days and 12 months after they are created, depending on the tool.
• Chat summaries and personalization memory — saved chat summaries are deleted after about 90 days, and the lightweight memory used to remember your preferences is deleted after 12 months of inactivity.
• Healing tool entries — no-contact tracker check-ins, urge logs, breakup journal entries, and decoded messages are deleted 12 months after they are created, and your tracker itself is deleted after 12 months of inactivity.
• Email engagement and marketing attribution — email open and click records, and ad-referral identifiers, are deleted after 90 days.
• Generated report files — downloadable report PDFs are kept for about 12 months and then deleted, and the temporary links used to download them expire within 48 hours.
• Sensitive details on payment records — although we keep financial records for as long as the law requires, the personal details you entered to create a report (such as names, dates of birth, and your question) are removed from those records after 12 months.

5. How We Share Your Information

We do not sell your personal information. We share personal information only as follows:

• Sub-processors that run the service:
  • AI providers — Google (Gemini, accessed via OpenRouter) and Anthropic (Claude), both based in the United States, generate your readings, chat responses, reports, and — if you request them — reflections on your healing journal and weekly activity and decodes of messages you paste. Your inputs are sent to them only to produce your results, and under our agreements they do not use your personal data to train their own models.
  • Payments — Stripe processes purchases and subscriptions.
  • Infrastructure — Google Cloud / Firebase, Vercel, and Cloudflare host and deliver the service, and Resend sends our emails.
  • Operational and security tools — Sentry monitors errors (its reports are scrubbed of names, emails, and birth details, and session recording is off), Upstash provides rate-limiting (which processes your IP address), Slack delivers our internal operational alerts (which may include your email address), Mapbox looks up a birth place you type for our astrology features, and web-push services operated by your browser or device vendor (such as Google, Apple, or Mozilla) deliver any notifications you opt into.
• Analytics providers: Google Analytics, Firebase Analytics, and Microsoft Clarity help us understand how the service is used (Clarity is configured to mask on-screen text). For EU/UK visitors these load only after you consent; everyone can decline or clear them (see "Cookies and Tracking").
• Advertising measurement (Meta): to measure and improve our ads, we use the Meta pixel (which sets Meta cookies and shares page-visit and checkout events with Meta) and, when you make a purchase, a server-side confirmation (a hashed version of your email, the ad-click identifier from the link you arrived on if any, and the purchase amount). Both are covered by the same consent as our analytics: for EU/UK visitors nothing loads or is sent unless you accept the cookie banner. Under California law (CPRA) this may be considered "sharing" for cross-context behavioral advertising; to opt out, use our Your Privacy Choices page (we also honor the Global Privacy Control browser signal as an opt-out) or email contact@tarostarot.com.
• Legal and safety: when required by law or legal process, to protect our rights, users, safety, or property, or with your explicit consent.
• Aggregate, de-identified insights: we may share aggregate statistics and anonymized insights (for example, common questions, popular cards, or regional trends) with editorial partners, journalists, and researchers. This data is stripped of personal identifiers before sharing.

6. International Data Transfers

We are based in the United States and process your personal data there, as do our providers (including Google, OpenRouter, Anthropic, and Stripe). If you are in the EU/EEA or the UK, this means your personal data is transferred to the United States. Where required for these transfers, we rely on appropriate safeguards, such as the Standard Contractual Clauses (with the UK Addendum) made available by our service providers.

7. Cookies and Tracking

We use (a) essential cookies to run the site and keep you signed in; (b) analytics tools — Google Analytics, Firebase Analytics, and Microsoft Clarity (configured to mask on-screen text) — to understand how the service is used; and (c) the Meta pixel to measure our advertising (see "How We Share Your Information").

For visitors in the EU/EEA and UK, non-essential analytics and the Meta pixel load only after you accept our cookie banner; you can decline. You can change your choice at any time on our Your Privacy Choicespage, and we honor the Global Privacy Control (GPC) browser signal as an opt-out. Separately, we set a few first-party cookies of our own to remember where you arrived from (for referral and campaign attribution) and which version of a page you were shown (for testing); these are first-party only and are never used for cross-site or behavioral advertising. We also use your browser's local and session storage to remember form entries and your place in a reading on your device. You can control or clear cookies and local storage through your browser settings at any time.

8. Your Rights

Depending on where you live, you may have the right to:

• Access, correct, or delete your personal data
• Receive a copy of your personal data
• Opt out of marketing communications
• In the EU/EEA and UK: object to or restrict processing (including automated processing used to personalize the service), and lodge a complaint with your local data protection authority
• In California: opt out of the "sharing" of your personal information (via Your Privacy Choices or the GPC browser signal) and not be discriminated against for exercising your rights

To exercise any of these rights, use your account settings or email us at contact@tarostarot.com. You can delete your account and associated data at any time from your account settings.

9. Children's and Minors' Privacy

The Service is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date.

11. Contact Us

Taro's Tarot is operated by Known by One, LLC. If you have questions about this privacy policy or our data practices, please contact us at:

Email: contact@tarostarot.com
Website: https://tarostarot.com