Privacy Policy
Last updated 15 September 2026
- We keep your email, your readings and your notes so the app can work. Nothing more.
- Our server is in the European Union.
- No ads, no analytics, no tracking cookies. We do not sell your data.
- If you use AI interpretation or photo reading, your question and cards (or the photo) go to OpenRouter, a US company, and on to an AI model provider. Your email and journal notes do not.
- You can download all your data, and delete any reading or your whole account, yourself in the app.
1. Who is responsible for your data
TarotSense is run by [OPERATOR NAME], the data controller for the personal data described here. For anything about your data, write to [CONTACT EMAIL].
2. What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Your email address and a one-way hash of your password (we never store the password itself). The date you signed up. | To let you sign in and keep your readings yours. |
| Sessions | A hash of your sign-in token, with its expiry date. A session lasts at most 30 days. | To keep you signed in, and to sign you out when you log out. |
| Readings | The question you wrote, the spread, which cards you drew and in which position, whether each was reversed, whether the draw was physical or dealt by the app, any follow-up questions, your journal notes, and dates. | This is the service: a record of your draws you can come back to. |
| Interpretations | The text of each interpretation, whether it came from our rule-based engine or an AI model, which model, and how many tokens it used. | So you can reread past interpretations. |
| Photos | Only if you photograph a spread. The photo is held in memory while the cards are read from it, then discarded. It is never saved on our server. | To fill in the cards for you. |
| Server logs | Your IP address, the time, the address requested and the result, for each request. | To keep the service secure, limit abuse and fix faults. |
Things you might write
Questions and journal notes are free text. We do not ask for health details, beliefs or other sensitive information, and we suggest you leave out anything you would not want stored. If you do write it, we treat it like the rest of your readings: stored for you, never used for anything else, and deleted when you delete the reading.
3. Legal basis
- To provide the service (GDPR Article 6(1)(b)): your account, readings, interpretations and photos.
- Our legitimate interest in running a secure service (Article 6(1)(f)): server logs and rate limiting.
We make no automated decisions about you that have legal or similarly significant effects. An interpretation is text for you to reflect on, not a decision about you.
4. Where your data is kept
Our server and database are hosted in the European Union by [HOSTING PROVIDER]. Your account and readings stay there. The only data that leaves the EU is what you send to OpenRouter, described next.
5. AI interpretation and OpenRouter
TarotSense has two ways to interpret a reading. The rule-based engine runs entirely on our server. AI-assisted interpretation, and reading cards from a photo, use OpenRouter (OpenRouter, Inc., United States), which passes the request to the company that runs the AI model.
When AI is turned on for the service, the Auto setting uses it. To keep a reading on our server, choose Rule-based before you press Interpret.
What is sent
- For an interpretation: your question, any focus you gave, the spread and its position questions, the cards and whether each is reversed, and your follow-up questions.
- For photo reading: the photo, and the list of cards in the deck.
What is never sent
- Your email, password, account id, journal notes or past readings.
What happens to it there
According to OpenRouter's privacy policy, it does not log the content of requests by default and does not use them to train models. The model provider that answers the request has its own data policy, which can include keeping requests for a limited time. Because OpenRouter is based in the United States, this is a transfer outside the EU; OpenRouter relies on the European Commission's Standard Contractual Clauses (GDPR Article 46) for it.
6. Who else sees your data
Only the two service providers named above: our hosting provider and OpenRouter (with the AI model provider it routes to). We do not sell your data, share it with advertisers, or use it to train AI models. We will disclose data to authorities only where the law requires it. Readings are private to your account; there is no sharing feature.
The people who run TarotSense use an internal admin tool to support the service. It shows your email, when you signed up, and the outline of your readings: dates, which cards were drawn, and which engine or AI model interpreted them. It does not show your questions, journal notes, follow-up questions or interpretation texts. Those are only taken out when you ask for a copy of your data, to send to you.
7. Your browser
The app keeps your sign-in tokens in your browser's local storage so you stay signed in. That is all it stores. There are no cookies, no analytics, no advertising or social media scripts, and no fonts or scripts loaded from other companies. Logging out removes the tokens.
8. How long we keep it
- Readings and interpretations: until you delete them, or your account.
- Account: until you delete it.
- Sessions: expire after 30 days at most, or when you log out.
- Photos: not kept. Discarded as soon as the cards are read.
- Server logs and backups: up to 30 days.
9. Your rights
Under the GDPR you can ask us to:
- give you a copy of your data (access and portability),
- correct it,
- delete it,
- restrict how we use it, or object to how we use it.
You can do the most common ones yourself, on the Account page in the app: download a copy of all your data as a file, or delete your account. Deleting your account removes it and every reading, note and interpretation in it straight away. You can also delete single readings. For anything else, write to [CONTACT EMAIL] from the address you signed up with. We reply within one month.
You can also complain to a data protection authority. In Finland that is the Office of the Data Protection Ombudsman; you can also contact the authority where you live.
10. Security
Traffic to TarotSense is encrypted with HTTPS. Passwords are stored as bcrypt hashes, sign-in tokens as hashes, and sessions are short-lived. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
11. Age
TarotSense is for people aged 16 and over.
12. Changes
If we change this policy, we will update the date at the top. If a change affects how your data is used, we will tell you by email before it takes effect.