Privacy Policy
Last updated: August 2026
The short version: your reading history stays on your device, your question goes to our AI provider so the cards can be read, and we collect as little as possible.
1. Your readings live on your device
Your reading history is stored in your browser’s localStorage. It stays on your device and is never uploaded to us; clearing your browser’s site data deletes it.
If you create an account, your reading history (including the optional question you write before a reading) and credit balance are stored in our cloud database (Supabase) so they follow you across devices. You can delete any reading — or your entire account — yourself at any time from the History page; deletion is immediate and permanent.
Want a reading that leaves no trace at all? Flip on “Private reading” before you draw and it will never be written down — not on your device, not in our cloud.
2. AI processing (DeepSeek) — data processed in China
To generate a reading, we send your question (or chosen theme) and the drawn cards to our third-party AI provider, DeepSeek, which processes this data on servers in China. If you are in the EEA or the UK, this is an international transfer of your data under GDPR; by using the reading feature you direct us to make that transfer. Please don’t include sensitive personal details in your question.
3. Analytics (PostHog)
We use PostHog for product analytics — events such as page views, spread selections, and reading completions — so we can tell what is working. These events carry usage details (like which spread you chose), not the text of your question.
4. Sharing
If you choose to share a reading, a snapshot of it (cards and interpretation) is stored on our servers so that the shared link works. Readings you never share never leave your device.
5. Rate limiting (IP addresses)
To enforce daily reading limits, our servers store your IP address only as a salted one-way hash — never in raw form. (Our hosting provider may retain standard server logs.)
6. Payments (Stripe)
Payments are processed by Stripe. Your card details go directly to Stripe; we never see or store your card number.
7. Your rights and contact
You can delete individual readings, your whole history, or your entire account directly from the History page — no email needed. You can also reach us at support@mystictarot.app; on-device history is yours to delete whenever you like by clearing site data, and sending us a shared-link URL will delete its snapshot.