Privacy Notice

1. What we collect

• Photos of your spread: used only to identify the cards; see the next section for how they are handled.
• The question and follow-up text you type, and your AI-assisted readings.
• Your email address (signing in is required for readings).
• Your IP address and country or region (determined by Cloudflare from the IP) when you register and when you last used the Service: used for account security, abuse prevention and statistics, and visible only to the operator in the admin console.
• Visitor counter: the visitor number on the home page counts each IP address once a day; we keep only a salted hash of the IP (it cannot be turned back into the IP) for at most 3 days.
• Essential cookies: the anonymous session id, your 18+ confirmation and your sign-in state.
• Usage statistics: aggregate data such as pages visited, referrers and device type, collected with Google Analytics (see section 4).
• Basic technical logs such as error records and request times, used to fix faults.
• We do not collect precise location, do not ask for your real name, and do not read your contacts or other photos in your library.

2. How photos are handled

• Before upload, location and other metadata are removed from the photo on your device.
• Before upload, the photo is checked for faces on your device; if a face is detected it is not uploaded and you can only retake it.
• Only the cropped photo of the cards, together with the question and follow-up text you wrote, is sent to a third-party model provider to identify the cards and write the reading.
• Our servers delete the photo within 24 hours of recognition finishing.
• The model provider retains it under its terms for [insert the provider's actual retention period] and then deletes it; it is not used to train models.
• Your questions and readings are kept in your history, where you can delete them at any time.

3. How we use this information

• To identify the cards, write the reading and answer follow-up questions.
• To keep readings in your history so you can revisit, share or delete them.
• To handle sign-in (sending the sign-in link) and, once payments are on, purchases.
• To keep the Service safe, for example preventing abuse and fixing faults.
• We do not sell your data, do not use it for ad targeting, and do not use your photos or text to train models.

4. Cookies

Essential cookies: the anonymous session id, your 18+ confirmation and your sign-in state. The Service cannot work without them.

Analytics cookies: we use Google Analytics to learn which pages are visited, where visitors come from and what devices they use, so we can improve the product. It stores cookies such as _ga in your browser (kept for up to 2 years). We do not use advertising cookies or ad targeting.

Visitors in the European Economic Area, the UK and Switzerland first see a notice they can decline: unless they tap Accept, the analytics tool is not loaded and no analytics cookie is set; the choice can be changed at any time via "Cookie settings" in the footer. Visitors elsewhere can switch analytics off in their browser's cookie settings or with Google's opt-out add-on (tools.google.com/dlpage/gaoptout).

5. Third parties that handle data

• The AI model provider: receives the cropped photo of the cards and the text you typed, for AI-assisted card recognition and readings (retention in section 2).
• The payment provider Stripe (once payments are on): payment happens on Stripe's pages; we never see or store your card number.
• An email provider: used only to send sign-in links and purchase confirmations.
• Hosting and infrastructure providers: run the website and database.
• Google (Google Analytics): receives aggregate usage data such as pages visited, referrers and device type; never your photos, questions or readings.

6. How long we keep it

• Photos: deleted from our servers within 24 hours of recognition.
• Questions and readings in an anonymous session: kept for 30 days with the session, then deleted automatically.
• Questions and readings in an account: kept until you delete them or delete the account.
• Email address and purchase records: kept until you delete the account; purchase records may be kept longer where tax and accounting law requires it.
• IP address and country from registration and your latest use: the latest record is overwritten by your next use; both are deleted when you delete your account.
• Technical logs: kept for at most [N] days.

7. Your rights

In Settings you can export your data, delete your whole history or delete your account at any time. You can also contact [contact email] to exercise your rights of access, rectification, erasure, restriction, portability and objection; we reply within the time the law allows. Users in the EU / UK can also complain to their local data protection authority.

8. Children

The Service is only for people aged 18 and over and we do not knowingly collect information from minors. If you believe a minor has given us information, please contact us so we can delete it.

9. International transfers

The model provider, hosting and payment services may be located outside your country or region. We protect transfers through contractual terms and other safeguards permitted by law.

10. Changes and contact

When this notice changes we update the date at the top, and significant changes are announced on the site. For privacy questions contact [contact email] (data controller: [operating entity]).