Privacy Policy

The short version

TarotAI operates this service and is responsible for the information handling described in this policy.

Free accounts are available through Google or an email verification code. TarotAI does not currently process payments, run advertising, use third-party behavioral analytics, or track you across sites.

Information we handle

• Anonymous reading information: the current question, private context, card, and bilingual answer are held in your browser session. A 30-minute local copy is created only when you start sign-in so the reading survives the redirect.
• Account and saved reading information: if you sign in and choose Save or Share, Supabase processes your account identifier and stores the question, private context, card, orientation, answer snapshot, and time.
• Basic technical information: hosting and infrastructure providers may process your IP address, browser and device information, requested URL, referring page, and timestamps in ordinary server and security logs.
• Messages you send us: if you contact us, we receive your email address and message.

Please do not put sensitive personal information or another person’s private information into a reading question.

How and why we use information

We use the limited information described above to deliver pages and readings, maintain performance and security, prevent abuse, diagnose errors, respond to messages, and comply with legal obligations.

Where a legal basis is required, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service, your consent where requested, and compliance with law.

Cookies and tracking

TarotAI does not currently set advertising or analytics cookies and does not track you across third-party websites. Because we do not engage in that tracking or sell or share personal information for cross-context behavioral advertising, browser “Do Not Track” and Global Privacy Control signals do not change the current handling described here.

Our hosting infrastructure may use strictly necessary technical mechanisms to deliver and protect the service. If we add optional analytics, advertising, or similar technologies, we will update this policy and provide any choices required by law.

When information is shared

We may disclose limited information to hosting, infrastructure, security, and communications providers that process it for us; to professional advisers; or to authorities when reasonably necessary to comply with law, protect rights and safety, or investigate abuse. Information may also transfer as part of a merger, financing, acquisition, or sale of assets, subject to appropriate protections.

We do not currently sell personal information or share it for cross-context behavioral advertising.

Retention and security

Anonymous reading data is not added to our database. Saved readings remain in your account until you delete them. Deleting a reading removes the live business record and revokes its share link; encrypted infrastructure backups may retain a residual copy until the provider’s normal backup rotation completes.

We use reasonable safeguards appropriate to the information we handle, but no internet service can guarantee absolute security.

International processing

TarotAI and its service providers may process information in countries other than the one where you live. Where required, we use legally recognized safeguards for international transfers. Privacy laws and protections may vary by location.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information; receive a portable copy; withdraw consent; or appeal a decision about a request. You may also complain to your local data-protection authority.

You can view, export as JSON, and delete saved readings from My Readings. A share hides the original question by default and always excludes private context and account details; you may explicitly include the question and may revoke the link later. For other requests, email privacy@tarotai.ai. We may need to verify your identity.

Children’s privacy

TarotAI is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided personal information to us, contact us so we can investigate and delete it where appropriate.

Service providers, changes, and contact

Supabase provides authentication and database services. Our configured email delivery provider, including Resend when enabled, sends verification messages. Our hosting provider delivers and protects the website. Each provider processes limited information for those purposes.

We may update this policy when our service or legal obligations change. For privacy questions or requests, contact privacy@tarotai.ai.