Effective Date: June 11, 2026 · Last Updated: June 11, 2026
Tarotdoxa LLC ("Tarotdoxa," "we," "us," or "our") operates the Tarotdoxa mobile application and website (the "Service"). This Privacy Policy describes our practices regarding the collection, use, and disclosure of information when you use our Service.
We designed Tarotdoxa to collect as little personal information as possible. You can use the core of the Service - drawing cards and receiving readings - without creating an account, and in that case your readings stay on your device. If you choose to create an optional account, we store your reading history and any credits you buy on our servers so they are available across your devices and on the web. We do not sell your personal data, and we never use your readings to train our reading engine without your separate written consent.
Tarotdoxa LLC is an Oregon limited liability company. You can reach us at:
To be explicit:
You can create an account so your readings and credits travel across devices and to the Tarotdoxa website. We offer sign-in by email (a one-time code or magic link sent to your address) and Sign in with Apple. Additional sign-in methods (such as Google and phone) may be added later. When you create an account, we collect and store:
Account identity and sign-in are handled by Supabase Auth (see §6). If you sign in with Apple or Google, that provider authenticates you; we receive only the minimal identity information needed to create your account. You can delete your account at any time from within the app (see §7), which permanently removes your account and the server-side data described below.
Without an account, your readings are stored only locally on your device, as before. With an account, the readings you choose to keep - the cards drawn, the spread, the generated interpretation, any optional topic, and any follow-up "Reading Chat" conversation - are synced to and stored on our servers (Supabase) so they are available on your other devices and on the web. This history is private to your account and is not shared. You can delete individual readings, or your entire account, at any time.
If you buy reading credits, we store your credit balance on our servers, associated with your account, so it is available wherever you sign in. Credit balances do not expire. The purchase itself is handled by Apple (in the app) or by our payment processor on the web (see "In-App and Web Purchases" below); we do not store your payment card details.
If you contact us (for example, by emailing us), we receive the information you send and use it only to respond to you.
In-app purchases (subscriptions and credit packs) are processed entirely by Apple through the App Store; we receive only aggregate, anonymized purchase data and never see your payment card, billing address, or Apple ID. Web purchases (when the website launches) are processed by our payment processor, which handles your payment details under its own privacy policy; we receive confirmation and the credits to apply, not your card data. Apple's privacy practices are at https://www.apple.com/legal/privacy/.
When you draw cards, the cards drawn, your selected spread, and any optional context you provide are sent to our reading engine to generate your reading. If you are not signed in, the reading is stored only on your device. If you are signed in, it is also saved to your account history as described above.
We use Apple's built-in analytics (which require your opt-in via iOS settings) to understand aggregate usage patterns: which features are used, which spreads are popular, crash data. These are anonymized by Apple and not tied to your identity.
When the app communicates with our reading engine, our servers automatically receive standard technical information (such as IP address and a timestamp). We use this only to operate and secure the Service, and we delete server logs after 30 days.
We process information to:
Tarotdoxa's voice and reading patterns were developed by Holly Cole, a co-founder of Tarotdoxa LLC, drawing on over two decades of her own tarot practice. We trained our reading engine using:
We have never used your reading as training data. We will never use your reading as training data without your explicit, separate, written consent. The model encodes patterns, not individual readings.
We do not sell, rent, or trade personal information. We share information only in the limited circumstances below, with providers acting on our behalf under their own privacy policies:
We do not transfer your personal information to any other third party.
You have the right to:
Deleting your account permanently removes your account, your synced reading history and chats, and your credit balance from our servers. Credits do not expire but are forfeited on account deletion. To exercise any other right, email privacy@tarotdoxa.com; we will respond within 30 days.
You have the rights described above. You may designate an authorized agent to make requests on your behalf. We do not "sell" personal information and we do not "share" it for cross-context behavioral advertising under any applicable state law.
You have the rights above, plus the right to data portability, to object to processing based on legitimate interests, and to lodge a complaint with your local data protection authority. Our lawful basis for processing is performance of the contract (delivering the Service and maintaining your account) and our legitimate interest in operating and securing the Service.
Tarotdoxa is intended for users aged 17 and older. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA/UK). If you believe a child has provided us information, email privacy@tarotdoxa.com and we will delete it.
We use industry-standard technical and organizational measures to protect the information we process. Account data is access-controlled so that each account can reach only its own records. No system is perfectly secure, but we minimize what we collect.
Tarotdoxa is operated from the United States. If you access the Service from outside the United States, your information may be processed in the United States, handled consistently with this Privacy Policy.
We may update this Privacy Policy from time to time. Material changes will be announced in the app and via the Effective Date above. Your continued use after a change constitutes acceptance of the updated policy.
For privacy questions, data subject requests, or to exercise any right above:
We are the data controller for purposes of GDPR. Our designated Privacy Contact is Russell Gardner.