Privacy Policy

Effective date: October 13, 2026

This policy explains what personal data Tarot Told Me collects, why, and what you can do about it. It covers the website tarottoldme.app and the Tarot Told Me mobile app (together, the “Service”).

1. Who we are

The Service is operated by Pavel Motorin, an individual developer, Resavska 33, stan 1, 11000 Belgrade, Serbia (“we”, “us”). We decide how your data is used and are responsible for it.

Privacy questions and requests: support@tarottoldme.app.

2. The short version

• We collect what we need to run the Service: your email if you subscribe, your account and readings if you use the app, and basic technical data.
• Some readings in the app are written by an AI service (OpenAI). To do that, we send it your question and the related reading details.
• We do not sell your data, show ads, or track you across other companies’ apps and websites.
• Your notes in the app stay on your device.
• You can delete your account and data at any time, in the app or by emailing us.
• The Service is for adults aged 18 and over.

3. Data we collect

On the website

• Email sign-ups. When you join the waitlist, the newsletter, or the free email course, we collect your email address, the form you used, your language, the date you confirmed, and — if you came through one of our own tagged links (for example a QR code on a stream) — the campaign tag of that link. When you sign up, we look up your approximate country from your IP address using a local database. We store the country code with your subscription and share it with MailerLite, our email provider, so we can group subscribers by region. We don't store your IP address. For now, we don't accept sign-ups from some countries. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
• Free tools. The tools run in your browser. What you enter, such as a date of birth in the Birth Card tool, is used only to calculate your result. Your entries and the result cards you create are not saved on our servers.
• Technical data. Like most websites, our servers receive your IP address, browser and device type, the pages requested, and the time of the request.
• Analytics. If you accept analytics cookies, Google Analytics collects usage data such as pages viewed, approximate location (country or city), device and browser type, and a cookie identifier. See the Cookie Policy.
• Our own analytics (Umami). We run Umami, an open-source analytics tool, on our own server. The data stays with us and is not shared with or sold to anyone. Umami sets no cookies and stores nothing in your browser. For each page you open, it receives the page address (without anything after "?", except campaign tags such as utm_source), the page title, the address of the page you came from (without anything after "?"), your screen size and browser language. It also measures how quickly the page loaded and responded in your browser (timings only). From your IP address and browser details our server works out your browser, operating system, device type and approximate location (country, region and city). The IP address itself is not stored. To tell one visit from another, Umami creates an anonymous visitor code from your IP address and browser details. The code changes every month, cannot be turned back into an IP address, and is not linked to your name or email. Within that month, the pages and actions of one visitor are linked to each other. We also record a few actions as events: that a reading was started or completed and with which tool, that the share card was shown, customised or shared (and the chosen format and colour), that a sign-up form was shown, submitted or showed an error, that you arrived through a shared link, and that you switched language or followed a link to our social accounts. Events never include your question, your birth date, the cards you drew, the answer, your note on a share card or your email address. If you join the waitlist, the sign-up event is recorded at the same moment as your sign-up. We do not combine the two records, but someone with access to both could match them by time. If your browser sends a "Do Not Track" signal, Umami records nothing. Our own team's visits are excluded.
• Heatmaps and session replays. To see how our pages are used, our own analytics tool (Umami, on our server) records where on a page visitors click and how far they scroll. For a sample of visits it also records a replay: how the page looked, how it was scrolled and what was clicked. What you type yourself — your question, your date of birth, a note on your share card and your email address — is replaced by blank blocks in your browser before anything is sent, so it is never part of a replay. The cards drawn and the answer shown on the page can be seen in a replay. Replays are kept for one month, except individual recordings we save for analysis. Our own team's visits are not recorded, and nothing is recorded if your browser sends a "Do Not Track" signal.
• Anonymous visit counts. We count visits in an anonymous, aggregated way — for example, how many times a page was viewed, which tool was used, the language, the site you came from (search engine or app name only) whether the screen is phone- or desktop-sized, and whether the browser's time zone matches our team's (a yes/no flag — we use it to leave our own visits out). We also count the local hour of the visit, which page you arrived on, whether you came through a link someone shared from our tools or through one of our own tagged links (for example a QR code on a stream), and — counted the same way, with no identifier — whether a visit led to a reading, a share (including the card format and colour chosen, never your note) or a sign-up, and whether a sign-up form was seen or failed to send. These counts are daily totals: they contain no IP address, no cookies or other identifiers, and nothing you type or draw, so they cannot be linked to you. Once a week these anonymous totals are summarised with the help of an AI model (OpenAI); the totals contain nothing that identifies you. They are not linked to your email address; on a day with very few sign-ups, a total can still hint at where a subscriber came from.

In the app

• Account. You sign in with Apple or Google. We receive a user identifier and your email address (which may be a private relay address), and your name if the sign-in provider shares it.
• Readings. The questions you ask, the mood you select, the spread and cards drawn, the readings generated for you, and your answers in My Story.
• Purchases. Your insights balance, purchase and promo code records. Payments are handled by the app store. We never receive your card details.
• Device and usage. App version, device model, operating system, language, time zone, app events (for example, a reading started or completed), crash reports, and a push notification token if you allow notifications.
• Support. The content of messages you send us and the account identifier needed to help you.

What stays on your device. Notes you write in the app and unfinished drafts are stored only on your device. We cannot see or restore them.

Sensitive topics. You choose what to write. Questions sometimes touch on health, relationships, or other private matters. Please share only what you are comfortable with, and avoid details that identify other people. We do not use this content to profile you or for advertising.

4. How we use data

We use personal data to:

• provide the Service: create your account, generate and save readings, and keep your history and balance;
• process purchases and promo codes, and prevent abuse of free insights;
• send emails you signed up for, and service messages about your account or purchases;
• send push notifications if you turned them on;
• understand how the Service is used and fix errors;
• keep the Service secure, including automated checks of questions for safety;
• answer support requests and meet legal obligations.

We rely on your consent, on the need to perform our agreement with you, on our legitimate interest in running and protecting the Service, and on legal obligations, as applicable in your country.

We do not sell personal data. We do not share it for advertising. We do not use it to train AI models.

5. AI-generated readings

Some readings in the app are generated by artificial intelligence: The Reading, My Story, and the closing passage of a ritual. We use models provided by OpenAI. Basic card interpretations and Card of the Day are pre-written texts stored in the app and involve no AI.

When you request one of these readings, we send OpenAI the text of your question, the mood you selected, the cards drawn, and, in My Story, your answers. We do not send your name, email address, or account identifier.

OpenAI processes this content to generate the reading and to check it for safety. Under OpenAI’s terms for business API customers, this content is not used to train its models, and it may be kept for up to 30 days to monitor for abuse.

The app asks for your permission before your content is first sent to OpenAI. If you do not agree, you cannot receive AI-generated readings.

6. Who receives data

We share personal data only with service providers that help us run the Service, and only as needed for that purpose.

We may also disclose data if the law requires it, to protect our rights or the safety of others, or as part of a transfer of the business. In a transfer, this policy continues to apply to your data.

7. International transfers

We and our providers process data in the countries listed above, which may be outside the country where you live. Their data protection laws may differ from yours. By using the Service you understand that your data is transferred to and processed in these countries. Where the law requires your consent for this, we ask for it.

8. How long we keep data

• Account and readings: until you delete them or delete your account.
• Account deletion: when you request deletion, your account is deactivated and then permanently deleted after 30 days. You can restore it by signing in during that period.
• Inactive accounts: deleted after 24 months without a sign-in.
• Email subscriptions: until you unsubscribe.
• Server logs: up to 30 days.
• Analytics data: up to 14 months.
• Anonymous visit counts: up to 400 days.
• Our own analytics (Umami): 14 months.
• Session replays: one month, except individual recordings we save for analysis.
• Purchase records: as long as tax and accounting laws require.

When a period ends, we delete the data or make it anonymous. Electronic records are erased so they cannot be recovered. Copies in backups are overwritten within a short period.

9. Your choices and rights

You can:

• see and delete individual readings in the app;
• delete your account and all server data in the app settings;
• unsubscribe from emails with the link in any email;
• turn off push notifications in your device settings;
• change analytics cookies in Cookie Settings on the website.

Depending on where you live, you may also have the right to access your data, receive a copy, correct it, delete it, restrict or object to its use, and withdraw consent. Withdrawing consent does not affect earlier processing.

To use these rights, email support@tarottoldme.app. We may ask you to confirm your identity. We reply within 30 days, or sooner where the law requires. We will not treat you differently for using your rights.

10. Security

We use reasonable technical and organizational measures to protect data, including encryption in transit and restricted access. No system is completely secure. If a breach affects your data, we will notify you and the authorities as the law requires.

11. Age

The Service is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

12. United States

We do not sell personal information and do not share it for cross-context behavioral advertising. We do not use sensitive personal information for purposes that require an opt-out.

Residents of some states, including California, have rights to know, access, correct, and delete their personal information, and to appeal a refused request. Use the contact in section 9. You may use an authorized agent.

Analytics cookies are off until you accept them, so our website does not need to respond to “Do Not Track” browser signals.

13. South Korea

This section applies to users in the Republic of Korea and prevails over the rest of this policy where they differ.

• Items, purposes, and retention are set out in sections 3, 4, and 8.
• Overseas transfer and outsourcing. Your data is transferred over the network to the recipients listed in section 6, at the time you use the related feature, for the purposes and retention periods stated in this policy. You may refuse the transfer by not using the Service or by deleting your account, but the Service cannot be provided without it.
• Destruction. Data is destroyed without delay when its retention period ends or its purpose is fulfilled, by permanent deletion of electronic files.
• Your rights. You may request access, correction, deletion, or suspension of processing, and withdraw consent, at any time by email. We respond within 10 days.
• Marketing emails are sent only with your consent, which you can withdraw at any time.
• Person responsible for personal data: Pavel Motorin, support@tarottoldme.app.
• Remedies. You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors’ Office (spo.go.kr, 1301), or the National Police Agency (ecrm.police.go.kr, 182).

14. Latin America

If you live in a Latin American country, you have the rights your local law gives you, which usually include access, correction, deletion, and objection, and the right to withdraw consent. Use the contact in section 9. You may also complain to the data protection authority of your country.

15. Changes

We may update this policy. The date at the top shows the latest version. If a change is significant, we will tell you in the app or by email before it takes effect.

16. Contact

Pavel Motorin, Resavska 33, stan 1, 11000 Belgrade, Serbia. Email: support@tarottoldme.app.