Privacy Policy

1. Data We Collect

When you draw a reading, we store the cards you drew, the question you typed (if you added one), the AI interpretation written for your cards, and any accuracy ratings you give. If you are not signed in, we link your readings to your device with a guest identifier cookie (tarot.guest_id). You can sign in with Google, which shares your name, email address, and profile photo with us, or with a sign-in link sent to your email. When you sign in, we store your email address (and, if you use Google, your name and profile photo), keep a record of your signed-in sessions, which can include your IP address and your browser's user agent, and link your readings to your account. If you make a purchase, we store a record of it, your Stripe customer or checkout ID, and your credit balance. We never see or store your raw payment card numbers; those are handled entirely by Stripe.

2. How We Use Your Data

We use the data we collect to deliver and improve the reading experience, manage your credit balance, process payments, associate reading history with your account across devices, send account emails, and respond to support requests. We use advertising pixels and server-side conversion events to understand how people discover and return to the site and to improve our ads. We do not sell your data to third parties.

3. Data Storage

Account and reading data is stored in Neon Postgres hosted in the US. Payment card data is stored and processed exclusively by Stripe; tarots.world never has access to raw card numbers or CVVs.

4. Third-Party Processors

We share your data only with the processors required to operate and measure the service:

• Google: OAuth sign-in, Tag Manager, Analytics, and Ads conversion measurement. Google Privacy Policy
• Stripe: payment processing. Stripe Privacy Policy
• Neon: database hosting and sign-in. Neon Privacy Policy
• OpenAI: receives your question and the cards you drew to write your interpretation. It does not receive your name or email address.
• Resend: sends account emails, such as your welcome email.
• Render: hosts the website.
• Meta, Snap, TikTok: advertising pixels and server-side conversion events, when enabled (see section 5).

5. Cookies, Analytics, and Advertising

We set a guest identifier cookie (tarot.guest_id) for guest readings and, when you sign in, session cookies that keep you signed in. If you arrive from a link on Facebook or Instagram, we also store its click identifier in a _fbc cookie for 90 days. We load Google Tag Manager, Google Analytics, and Google Ads on every page, and advertising pixels from Meta, Snap, and TikTok when they are enabled. These services set their own analytics and advertising cookies.

When they are enabled, our server also sends some events directly to Meta, Snap, and TikTok: page views, drawing a reading, signing in, starting a checkout, and completing a purchase. These events can include your IP address, your browser's user agent, the page address, and the browser and ad click identifiers from their cookies. When available, they also include hashed (SHA-256) versions of your email address, name, phone number, country, and postal code (from your account or your Stripe checkout) and of your account or guest ID, and for checkouts and purchases, the amount and plan. To match a purchase, we attach your IP address, user agent, and ad click identifiers to the Stripe checkout. Meta, Snap, and TikTok use this information to measure our ads and to improve how they are delivered, under their own privacy policies.

6. Data Retention

Account data is retained for as long as your account is active. The guest cookie expires after one year. You may request deletion of your account, your readings, and any associated data at any time by emailing us at hello@tarots.world.

7. Children

tarots.world is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with their information, please contact us so we can delete it.

8. Contact

Questions about this policy or requests to access or delete your data? hello@tarots.world