Privacy Policy

1. What we collect

What you give us

• Your question — what you type into the reading tool.
• Optional background — age range, gender and relationship status. All three are optional; everything works without them. If you fill them in, they are saved with that reading for one purpose: to see which groups find the readings closer to their situation, so we know how to improve them. They are drop-down menus, so only the listed options are stored — never free text — and they never appear in the URL. Deleting the reading deletes them too.
• Email for sign-in — your first three readings need no sign-in. From the fourth, you leave an email to continue, still free and with no limit (each reading is generated on the spot and costs us real money). We store your email as your account identifier, together with the device codes you signed in from (the random value described in section 2), how many times you signed in and when you last did. There are no passwords: we email you a six-digit code, so we never hold a password of yours. Besides sign-in codes, we may occasionally send tarot-related email; every one has an unsubscribe link, and unsubscribing does not affect signing in.
• Reading feedback — the “very much / a little / not really” you tap under a reading, plus any optional note. It is stored inside that reading, so deleting the reading deletes it too.

Created automatically

• The cards you drew and their positions.
• Server logs — our web server records your IP address, browser user-agent and the URLs you visit, which is standard for running and securing a website. Logs rotate daily and are deleted after 30 days.
• Usage counters — to stop abuse of the AI readings we count uses per IP per hour. The counter is stored under a hash of the IP, never the IP itself, and expires after an hour.
• Visitor code and country — each reading carries an 8-character visitor code and the country Cloudflare detects (e.g. US, JP). The code is a hash of your IP and a secret key only our server knows: the same person gets the same code, but it cannot be turned back into an IP. Its only use is telling whether several readings came from the same person. Both are deleted with the reading.
• Where you came from — each reading records the host name of the site that brought you here (e.g. www.google.com) and any utm_ tags in the URL. Host name only, never the full URL, since full URLs often contain search terms. Deleted with the reading.

Why

We use this data to provide and improve the readings, understand how the site is used, and keep it secure. We do not sell your personal data, and we only share it where needed to run the service (the AI provider that writes the readings, hosting and security providers) or where the law requires.

2. Stored in your browser

The reading flow remembers your choices between steps in your own browser (localStorage); this is not sent to us automatically:

• Your question and the cards drawn in this reading.
• Your reading list — the private link, a shortened question and the time of each reading. It exists only in your browser; our server has no copy of this list.
• A random device code generated by your browser on your first reading and sent with each reading. It has nothing to do with your IP, name or any personal data; it only tells us whether several readings came from the same device. We also set it as a first-party cookie (tarot_dev, one year) so the free-reading count survives browsers that clear local storage.
• Where you came from for this visit, kept in sessionStorage — it disappears when you close the tab.

If you sign in, your browser also keeps a sign-in cookie containing a hash of your email, an expiry time and a signature — no plain-text email and no password. It is HttpOnly and Secure and lasts one year.

You can clear all of this at any time from your browser settings.

3. What is sent to the AI provider

Readings are written by a third-party AI model provider, currently DeepSeek (model deepseek-v4-flash). If we change providers, this section will be updated. When you finish drawing, our server sends the provider:

• your question,
• the cards, whether each is upright or reversed, and their positions,
• our existing card meanings as source material,
• the optional background, if you filled it in.

The request comes from our server, not your browser, so the provider never receives your IP address, browser details or any device identifier. See the DeepSeek privacy policy for how it handles API data. Paragraphs labelled “AI reading” are produced this way.

4. Saved readings

After each reading we save it at a private link (like /r/8f3a2c9e…) so you can come back to it. It contains your question, the cards and the reading text.

• The address is a random 16-character string — it can’t be guessed or found by search.
• The page is marked noindex and blocked in robots.txt, so search engines don’t index it.
• Whether to share the link is entirely up to you.
• Readings are deleted automatically after 12 months.
• You can delete one at any time with the “Delete this reading” button on its page.

5. Cookies, analytics and ads

This site shows no ads.

We use Cloudflare for content delivery and security; it may set cookies needed to detect abnormal traffic (Cloudflare privacy policy).

We use Microsoft Clarity to see how pages are used — where people tap, how far they scroll, where they get stuck. It records interactions (clicks, scrolling, window size) and produces anonymous session replays and heatmaps. We mask the most sensitive parts: your question, the full reading text, the content of private reading pages and the email field appear only as blocks in replays, so Clarity never receives that text. Clarity sets its own cookies; see the Microsoft privacy statement.

6. Children

This site is not directed at children under 13 and does not knowingly collect their data.

7. Your rights

You can ask to access, correct or delete data we hold about you. The quickest ways:

• Delete a reading: open its link and press “Delete this reading”.
• Clear local data: clear this site’s data in your browser settings.
• Anything else: email [email protected].

8. Disclaimer

Tarot readings are for self-reflection and entertainment. They are not medical, psychological, legal or financial advice and guarantee no outcome. If you are facing real difficulties in any of these areas, please seek a qualified professional.

9. Changes

When the site changes, this page is updated along with the date at the top. Questions: [email protected].