Privacy Policy

1. Personal data we collect

Account and profile data: your email, account identifier, sign-in provider, language and regional writing preference, saved birthday information and zodiac sign, personality type and assessment scores.

Reading data: your questions, selected themes, cards drawn, AI interpretations, follow-up questions and answers, saved personality and horoscope insights, and bookmark choices.

Service and payment records: plan and subscription status, usage and credit balances, promotion redemptions, payment and checkout identifiers, purchase amounts and dates. AI operation records include model, language, request category, token usage, estimated cost and timestamps; the app’s AI usage log does not store the full prompt or answer. We also receive information you send when contacting support.

2. Required and optional information

Account information is needed to create and secure an account. A question and card selection are needed to provide a reading. Payment information requested by Stripe is needed for a purchase. Without the information required for a particular feature, we may be unable to provide that feature.

Birthday settings, support messages and the details you choose to include in your questions are voluntary. A personality assessment is needed for personality-based personalization. Avoid including identity document numbers, passwords, card details, sensitive medical information or identifiable details about other people in your questions.

3. How we use personal data

We use data to authenticate you, save preferences, calculate your personality profile and zodiac sign, generate and display personalized insights, maintain private reading history, administer subscriptions and credits, process promotions, respond to support requests, and investigate errors, misuse and payment disputes.

Personal data is used for these purposes or directly related purposes. A new, unrelated use requires your prescribed consent unless an exception under applicable law applies. Tarot and personality insights are reflective content, not guaranteed predictions or professional advice.

4. AI processing

When you request new AI content, the relevant question, cards, personality or zodiac context, language and regional style are sent through OpenRouter to the selected model provider. Follow-up requests may include the earlier reading and conversation so the answer has context. Your account email is not needed in the reading prompt.

OpenRouter may route requests to different providers. Their processing, retention and any model-training practices are governed by their own terms and settings; this policy does not promise that every provider has zero retention or excludes training. Reopening an already saved answer does not itself require a new AI request.

5. Disclosure and service providers

Lovable Cloud provides hosting, account services and database infrastructure. OpenRouter and model providers process AI requests. Stripe processes payments and subscription services, and sign-in providers process their respective sign-in flows. These services receive the information needed for their role and may apply their own privacy policies. Payment card details are entered through Stripe’s payment interface, not stored as full card numbers in the app’s account database.

Authorized administrators can access account, subscription, credit and usage information for service administration and support. Readings are not published as public pages. Information may also be disclosed where required by law or reasonably necessary to investigate fraud, protect security or establish or defend legal claims.

6. Processing outside Hong Kong

Hosting, authentication, payment and AI services may process or store information outside Hong Kong. The destination depends on the service and AI routing; we do not represent that all data stays in Hong Kong. Other jurisdictions may have different privacy protections. Review the provider policies linked below before submitting information you consider sensitive.

7. Retention and deletion

The app retains your eight newest non-bookmarked Tarot readings; older non-bookmarked readings are automatically removed as new readings are saved. Bookmarked readings are exempt from this limit and remain until you delete them or delete your account. You can delete individual readings from your history.

Account deletion is available from Profile and removes your profile, readings, their card and follow-up records, usage records and sign-in account. It does not necessarily erase every financial or operational record: subscription and credit-purchase records may remain, and AI usage logs can remain with their account and reading links removed. Third-party records are subject to the providers’ retention arrangements.

Retention outside the reading-history limit varies by record type; no single fixed period applies across all service, transaction and provider records. Contact us about retained information, access or deletion. Records necessary for legal, accounting, dispute or security purposes may need to be kept, subject to applicable law.

8. Security and confidentiality

Account-based access controls restrict ordinary users to their own readings, follow-ups and usage records. AI credentials are kept server-side. Administrative functions require an authorized administrator account. These measures reduce unauthorized access; no online service can guarantee absolute security. Keep your sign-in details private and contact us if you suspect unauthorized access.

9. Browser storage and third-party technology

The app uses browser local storage to maintain sign-in state and remember language choices. Clearing browser storage may sign you out or reset preferences. An installed app may also cache public app files. Sign-in, hosting and payment services may use their own cookies or similar technologies under their policies. This app does not currently implement a dedicated advertising or marketing-analytics integration.

10. Direct marketing

The current app does not use your personal data for direct-marketing campaigns or provide it to others for their direct marketing. If this changes, we will provide the required notice and obtain consent as required by Hong Kong law. You may withdraw direct-marketing consent and opt out without charge. Account, security and purchase-related messages are service communications.

11. Access, correction and complaints

Under the Ordinance, you may request confirmation of whether we hold your personal data, a copy of that data, and correction of inaccurate data, subject to applicable exemptions. Send requests to the administrator using the email below. We may request proportionate information to verify your identity, but will not ask for your password.

Data access and correction requests are handled within the applicable statutory period, generally 40 days after receipt. If we cannot fully comply within that period, we will explain the reason and next steps in writing as required. A non-excessive fee may be charged for a data access request where permitted by law, with advance notice. You can also raise concerns with Hong Kong’s Privacy Commissioner for Personal Data at www.pcpd.org.hk.

12. Changes to this policy

We may update this policy when the service or applicable requirements change. The updated version and date will appear here. Where a change requires a separate notice or consent, an updated policy alone does not replace that requirement. English, Traditional Chinese and Simplified Chinese versions are provided for accessibility; your statutory rights are unaffected by the language selected.