Privacy Policy

Effective Date: 2026-06-11 Last Updated: 2026-08-26

Tarotdoxa LLC (“Tarotdoxa,” “we,” “us,” or “our”) operates the Tarotdoxa mobile application and website (the “Service”). This Privacy Policy describes our practices regarding the collection, use, and disclosure of information when you use our Service.

We designed Tarotdoxa to collect as little personal information as possible. You can use the core of the Service - drawing cards and receiving readings - without creating an account, and in that case your readings stay on your device. If you choose to create an optional account, we store your reading history and any credits you buy on our servers so they are available across your devices and on the web. We do not sell your personal data, and we never use your readings to train our reading engine without your separate written consent.

1. Who We Are

Tarotdoxa LLC is an Oregon limited liability company. You can reach us at:

2. What We Do Not Do

To be explicit:

3. Information We Process

Account Information (Optional)

You can create an account so your readings and credits travel across devices and to the Tarotdoxa website. We offer sign-in by email (a one-time code or magic link sent to your address) and Sign in with Apple. Additional sign-in methods (such as Google and phone) may be added later. When you create an account, we collect and store:

Account identity and sign-in are handled by Supabase Auth (see §6). If you sign in with Apple or Google, that provider authenticates you; we receive only the minimal identity information needed to create your account. You can delete your account at any time from within the app (see §7), which permanently removes your account and the server-side data described below.

Reading History and Chat (Stored Only With an Account)

Without an account, your readings are stored only locally on your device, as before. With an account, the readings you choose to keep - the cards drawn, the spread, the generated interpretation, any optional topic, and any follow-up “Reading Chat” conversation - are synced to and stored on our servers (Supabase) so they are available on your other devices and on the web. This history is private to your account and is not shared. You can delete individual readings, or your entire account, at any time.

Credits

If you buy reading credits, we store your credit balance on our servers, associated with your account, so it is available wherever you sign in. Credit balances do not expire. The purchase itself is handled by Apple (in the app) or by our payment processor on the web (see “In-App and Web Purchases” below); we do not store your payment card details.

Information You Provide

If you contact us (for example, by emailing us), we receive the information you send and use it only to respond to you.

Marketing Emails (Optional)

If you ask us to keep you posted about Tarotdoxa (for example, by joining the launch list on our website, or, in a future version of the app, by turning on email updates), we store your email address and a record of your consent with our email provider, Klaviyo, so we can send you occasional product news. This is entirely optional and separate from your account: we add you only when you explicitly opt in, never by default, and every marketing email includes a one-click unsubscribe. You can also unsubscribe at any time by emailing info@tarotdoxa.com. You do not need an account, or the app, to join or to leave the list.

In-App and Web Purchases

In-app purchases (subscriptions and credit packs) are processed entirely by Apple through the App Store; we receive only aggregate, anonymized purchase data and never see your payment card, billing address, or Apple ID. Web purchases (when the website launches) are processed by our payment processor, which handles your payment details under its own privacy policy; we receive confirmation and the credits to apply, not your card data. Apple’s privacy practices are at https://www.apple.com/legal/privacy/.

Information Generated During Your Reading

When you draw cards, the cards drawn, your selected spread, and any optional context you provide are sent to our reading engine to generate your reading. If you are not signed in, the reading is stored only on your device. If you are signed in, it is also saved to your account history as described above.

Astrology and Birth Information (Optional)

The astrology features need a birth date, and they work better with a birth time and birth place. What happens to each of those is different, on purpose:

This is not location data. We do not ask for, request permission for, or receive your current location at any point, on any platform.

Time Zone

The app and the website tell our reading engine which time zone your device is set to, as a standard identifier such as America/Los_Angeles. This is not a permission, and it is not your location: it is the same setting your clock uses, and thousands of miles of the Earth share each one.

We need it because a reading names days. Which day the moon is full, whether an eclipse is Thursday night or Friday morning, and which day counts as “today” for your daily card are all questions about a calendar, and a calendar only means something somewhere. Without your time zone we would have to guess one, and we would be wrong for most people. We use it to work out those dates and nothing else, and we do not store it with your account.

Anonymous Analytics

We use Apple’s built-in analytics (which require your opt-in via iOS settings) to understand aggregate usage patterns: which features are used, which spreads are popular, crash data. These are anonymized by Apple and not tied to your identity.

Technical Information

When the app communicates with our reading engine, our servers automatically receive standard technical information (such as IP address, a timestamp, and the device time zone described above). We use this only to operate and secure the Service, and we delete server logs after 30 days.

4. How We Use Information

We process information to:

5. How We Train Our Reading Engine

Tarotdoxa’s voice and reading patterns were developed by Holly Cole, a co-founder of Tarotdoxa LLC, drawing on over two decades of her own tarot practice. We trained our reading engine using:

We have never used your reading as training data. We will never use your reading as training data without your explicit, separate, written consent. The model encodes patterns, not individual readings.

6. Sharing Information and Service Providers

We do not sell, rent, or trade personal information. We share information only in the limited circumstances below, with providers acting on our behalf under their own privacy policies:

Across the gateway and all three AI providers, the position is the same at every hop: 30-day maximum retention, and no training on your readings without explicit permission.

We do not transfer your personal information to any other third party.

7. Your Rights

You have the right to:

Deleting your account permanently removes your account, your synced reading history and chats, and your credit balance from our servers. Credits do not expire but are forfeited on account deletion. To exercise any other right, email info@tarotdoxa.com; we will respond within 30 days.

Additional rights for residents of California (CCPA/CPRA), Colorado, Virginia, Connecticut, Texas, and other US states with comprehensive privacy laws

You have the rights described above. You may designate an authorized agent to make requests on your behalf. We do not “sell” personal information and we do not “share” it for cross-context behavioral advertising under any applicable state law.

Additional rights for residents of the European Economic Area, United Kingdom, Switzerland, and other GDPR-equivalent jurisdictions

You have the rights above, plus the right to data portability, to object to processing based on legitimate interests, and to lodge a complaint with your local data protection authority. Our lawful basis for processing is performance of the contract (delivering the Service and maintaining your account) and our legitimate interest in operating and securing the Service.

8. Children

Tarotdoxa is intended for users aged 18 and older. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA/UK). If you believe a child has provided us information, email info@tarotdoxa.com and we will delete it.

9. Security

We use industry-standard technical and organizational measures to protect the information we process. Account data is access-controlled so that each account can reach only its own records. No system is perfectly secure, but we minimize what we collect.

The questions you type before a reading get an extra layer: they are scrambled (encrypted) inside our reading engine’s records, not just on the wire and on the disk. Our own database tools show unreadable text in their place, and our staff dashboard is blocked by the database itself from reading stored reading content at all. The one system that can unscramble a typed question is the reading engine, because it needs to show your own history back to you. Your synced journal keeps its own copy of your past readings; those fields (the question, your notes, your reading chats) move under the same at-rest encryption as the next app updates roll out, and this page will say so plainly once that conversion is complete. To be plain about the limit: we hold the key on our servers, so this makes casual human access impossible rather than merely forbidden; it is not yet the stronger kind of encryption where only your own device could ever unscramble your words. That stronger direction remains under consideration beyond the current work.

10. Data Retention

11. International Users

Tarotdoxa is operated from the United States. If you access the Service from outside the United States, your information may be processed in the United States, handled consistently with this Privacy Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app and via the Effective Date above. Your continued use after a change constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data subject requests, or to exercise any right above:

We are the data controller for purposes of GDPR. Our designated Privacy Contact is Russell Gardner.

We collect only what the Service needs. Without an account, your readings stay on your device. With one, they follow you across your devices - and you can delete them, and your account, whenever you choose.