Privacy Policy

1. Your readings live on your device

Your reading history is stored in your browser’s localStorage. It stays on your device and is never uploaded to us; clearing your browser’s site data deletes it.

If you create an account, your reading history and credit balance are stored in our cloud database (Supabase) so they follow you across devices. You can request deletion of your account and all associated data at any time.

2. AI processing (DeepSeek) — data processed in China

To generate a reading, we send your question (or chosen theme) and the drawn cards to our third-party AI provider, DeepSeek, which processes this data on servers in China. If you are in the EEA or the UK, this is an international transfer of your data under GDPR; by using the reading feature you direct us to make that transfer. Please don’t include sensitive personal details in your question.

3. Analytics (PostHog)

We use PostHog for product analytics — events such as page views, spread selections, and reading completions — so we can tell what is working. These events carry usage details (like which spread you chose), not the text of your question.

4. Sharing

If you choose to share a reading, a snapshot of it (cards and interpretation) is stored on our servers so that the shared link works. Readings you never share never leave your device.

5. Rate limiting (IP addresses)

To enforce daily reading limits, our servers store your IP address only as a salted one-way hash — never in raw form. (Our hosting provider may retain standard server logs.)

6. Payments (Stripe)

Payments are processed by Stripe. Your card details go directly to Stripe; we never see or store your card number.

7. Your rights and contact

You can request access to, or deletion of, the data we hold about you at any time by emailing support@mystictarot.app. On-device history is yours to delete whenever you like by clearing site data; send us a shared-link URL and we will delete its snapshot.