Privacy Policy

1. Who runs tarot~ink

tarot~ink is a tarot practice app: readings that build on your own history, a journal of your pulls, camera scans of physical spreads, and custom decks. It is run by:

Under the EU General Data Protection Regulation (GDPR) this person is the controller of your personal data. Everywhere this page says "we", it means the operator named above. The full provider details are in the legal notice (Impressum).

2. The short version

• Your readings, your questions, your threads and your decks are stored in Frankfurt, Germany. Nothing is sold, and nothing is used for advertising.
• Readings are written by a language model run by OpenAI. Your question, your cards and the context the app has about you are sent to OpenAI to write it. OpenAI does not train on it.
• Card art, the camera scanner and the live reading run on Google's Gemini models under paid terms. Google does not use them to improve its products.
• The memory that lets a reading pick up where the last one left off is yours to cut: forget a reading, cut a thread, or delete the account.
• Delete the account from Profile and everything above is gone, including the memory. Section 10 lists the few things that stay and for how long.

3. What we keep, and why

This table is built from the code that runs the app, not from a template. Every row names the data, what it is for, where it is stored, which company handles it, where that company processes it, how long it stays, and the GDPR ground we rely on.

What you can leave out

An email address (or an Apple or Google sign-in) is the only thing an account needs. Birth details, a display name, an avatar, friends, notifications and the camera are all optional. Without birth details there is no cosmic profile; the readings, the journal and the decks work the same.

4. Your words in a reading

People ask tarot about partners, health, faith and family. Under GDPR Article 9 that kind of content is "special category" data, and the Court of Justice has held that data which only indirectly reveals such things counts too (C-184/20). So we treat the text of your readings, your follow-ups, your threads and the memory drawn from them as special category data, and we store and process it on one ground only: your explicit consent. Today the app does not ask a separate consent question before the first reading; the consent we rely on is the choice you make when you write a question and send it, and you can withdraw it at any time. Withdrawing means forgetting a reading, cutting a thread, or deleting the account; each is one action in the app and takes effect at once. A separate consent step before the first reading is planned. [TODO] We never infer a diagnosis, an orientation or a belief from what you wrote and store it as a fact about you. The memory keeps your own words and links each one back to the reading it came from.

5. How readings and card art are made

Every reading carries this line in the app: "Written by AI". No person reads for you. The same is true of the live reading, the calendar digests, the prompt rewriting behind card art, and the card images themselves. This is the disclosure required by Article 50 of the EU AI Act, in force since 2 August 2026.

What is sent, and to whom:

• Reading text goes to OpenAI: your question, the cards, your follow-up messages, and the context the app holds for you (relevant memory, open threads, your chart if you entered birth details, and how often each card has come up for you). OpenAI does not use API data to train its models and keeps abuse monitoring logs for up to 30 days.
• Memory extraction goes to OpenAI as well, and the resulting text is sent to Google's embedding API to make it searchable. Both run on paid API terms that exclude training on your data.
• Card art, camera scans and the live reading go to Google Gemini: your deck description and reference image, the photo of your spread, and what you type during a live reading.

The reading provider can change. The service is built so that the reading model can be switched to Anthropic or OpenAI models on Amazon Bedrock, or to Google Gemini; if that happens we update this page and the date at the top before the switch reaches you.

6. Who else sees it

We do not sell data and we do not share it with advertisers or data brokers. These are the companies that process your data for us, what each gets, and the contract that binds them.

A small number of administrators can look at data to run the service, handle a report, or answer a request from you. Other users see only what you show them: your handle, display name and avatar to friends and in search, and nothing from your readings.

7. Where it lives, and transfers out of the EU

The database, file storage, API server and memory service all run in Frankfurt, Germany. The model calls in section 5 leave the EU: OpenAI and Google process them in the United States. Notifications pass through Expo in the United States. Website waitlist emails are held by Resend in the United States.

For each of those transfers we rely on one of:

• the EU-US Data Privacy Framework, for providers certified under it. The General Court upheld the framework on 3 September 2025 (T-553/23); an appeal to the Court of Justice (C-703/25 P) is pending. If the framework falls, the clauses below take over.
• Standard Contractual Clauses in each provider's data processing agreement.

Write to us for a copy of the safeguards that apply to a given provider.

8. What the memory keeps, and how to forget

After a reading the app keeps what you asked, in your words, and what came up: the cards, the people and situations you named, and how the reading closed. It also keeps a short portrait of your reading patterns, rebuilt as readings accumulate. A later reading may quote one of these back to you, with the date and a link to the reading it came from. It quotes; it does not diagnose.

The controls, all in the app:

• Don't remember this reading, on the reading itself, removes everything the memory drew from it. The reading stays in your journal.
• Cut a thread: press and hold a thread in Your Story. It is deleted, not hidden.
• Delete the account (section 10) drops the whole memory bank.

Forgetting deletes. Memory never words a notification, and the app never surfaces anything from your readings to another person.

9. Analytics and feedback

The app asks once, after you finish onboarding, whether you want to share usage analytics. Until you say yes the answer is no, and you can change it at any time with the Share usage analytics switch in Profile. Saying no changes nothing else in the app.

With your yes, the app sends usage events to PostHog, hosted in Frankfurt: which screens open, which features you use, app version, device model and OS version, and error reports. The server sends events about readings and generations under your account id, also only with your yes. The events are built from ids and settings, not from the text of your readings. The app does not record your screen. There is no advertising identifier, no tracking across other apps or websites, and no data broker.

Under section 25 of the German TDDDG, storing or reading anything on your device that the app does not strictly need requires your consent first, and the analytics in turn rest on that consent (Art. 6(1)(a) GDPR). Until you say yes, the app does not start the analytics library at all, so nothing goes to PostHog, not even your IP address, and nothing is stored on your device. With your yes it keeps its state in memory only. When you withdraw, the app sends the events it collected while you agreed and then stops the library; the server stops within a minute. Events already sent stay in PostHog for the retention in section 3; email us and we remove them.

Feedback you send from Profile goes to PostHog as a feedback event whatever your analytics answer, because you asked us to send it: your message, the category you picked, the app version and build, and your platform and OS version. If you share usage analytics, the last ten screens you opened and the session id go with it, so we can retrace your steps. [TODO]

10. How to delete everything

In the app: Profile, scroll to the bottom, Delete account, then confirm. It happens at once and cannot be undone. One request removes, in this order:

• every file you stored: card images, avatar, camera scans
• your memory bank, portrait and digests
• your sign-in record, and with it every row that hangs off it: profile, birth details and charts, readings and messages, threads, decks and cards, scans, friends, referrals, push tokens, notification log, device links, usage counters

If any step fails, nothing after it runs; sign in again and retry.

What stays, and for how long

• Your email on the beta allowlist, so a re-invite still works. Email us to remove it.
• Analytics in PostHog under your old account id [TODO]. Email us and we delete it by hand.
• OpenAI's abuse monitoring logs, up to 30 days; Google's limited abuse window for paid API calls.
• Database backups, which roll over on their own [TODO].
• Moderation notes that reference the id of something you posted, with no other data.
• Anything we are legally required to keep, for as long as that law says.

If you cannot open the app, email hello@tarotink.app from the address on the account and we delete it within 30 days. [TODO]

11. How to get a copy of your data

Email hello@tarotink.app from the address on the account and you get a machine-readable export (JSON) of your profile, birth details, readings and messages, threads, decks and card images, scans and memory within 30 days, and usually much sooner. This is your right to portability under Article 20. [TODO]

12. Your rights

Under the GDPR you can:

• See what we hold about you (Article 15), and get a copy (Article 20, section 11).
• Correct it (Article 16): profile and birth details in the app, anything else by email.
• Erase it (Article 17): section 10, or a single reading's memory, or a thread.
• Restrict or object to processing that rests on legitimate interest (Articles 18 and 21): the device limits, the scanner dataset, analytics and logs.
• Withdraw consent (Article 7(3)) at any time, as easily as you gave it. Withdrawing does not undo what was lawfully done before.
• Complain to a supervisory authority (Article 77), in the EU country where you live or work or where you think the law was broken. The authority responsible for us is [TODO].

Write to hello@tarotink.app. We answer within 30 days. Providing data is never a legal obligation; the only contractual necessity is an email or a sign-in, without which an account cannot exist.

13. Is a reading an automated decision?

No. Article 22 of the GDPR covers decisions made solely by automated means that have legal effects on you or affect you similarly significantly, such as a refused loan or an automated hiring rejection. A reading is generated text for your own reflection. It grants or refuses you nothing, and no one else relies on it. The app also does not score you, rank you, or sort you into groups for anyone. If you ever feel a reading has had a real effect on you, write to us and a person will look at it.

14. Age

You must be 16 or older to have an account. Under GDPR Article 8 a person under 16 cannot give the consent this service rests on in Germany and many other EU countries, and our model providers do not allow the data of younger users. We do not knowingly keep data from anyone under 16; if you think we hold some, email us and we delete it.

15. The website and cookies

This website sets no cookies and loads no analytics, advertising or tracking scripts, so there is nothing to consent to and no cookie banner. If you switch between light and dark mode, that choice is saved in your browser's local storage under the key "theme" and never leaves your device. Saving a setting you asked for is allowed without consent under section 25(2) no. 2 of the German TDDDG. If you join the waitlist, your email is sent to Resend to manage your place on the list.

In the app, sign-in tokens live in the device's secure store and a few preferences in app storage. Both are necessary for the app to work.

16. Changes to this policy

When something material changes (a new provider, a new purpose, a shorter or longer retention), we tell you in the app or by email at least 30 days before it takes effect, and we update the date at the top and the log below.

• October 17, 2026: the app now asks before any analytics, keeps them off until you say yes, and has a switch in Profile to change your answer. Screen recordings are off. Server events go out only with your consent. Feedback is sent when you submit it, with your recent screens only if you share analytics.
• October 17, 2026: named the operator as a person rather than a company, linked the legal notice, said what the website stores and why it needs no consent, set out the consent the app analytics need, and widened the complaint right to the authority where you live.
• September 11, 2026: removed the unused website cookie controls and updated the website storage description.
• September 5, 2026: rewritten from the code. Reading model is OpenAI, not Gemini. Added the memory service, threads, live readings, camera scans, device limits, the beta allowlist, screen recordings, server logs, and the website waitlist. Named what account deletion leaves behind. Raised the special category consent to cover reading text, not only birth details.
• March 18, 2026: first version.

17. Contact