Privacy Policy

Welcome to FlipTarot (“we,” “our,” or “us”). We are committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered tarot reading platform.

This policy applies to the FlipTarot website and mobile apps. If you do not agree with it, please do not use our services.

Depending on how you use FlipTarot on the web or in our apps, we collect:

• Account details: your email address and display name, and the account identifier from Google or Apple when you sign in with them. Passwords are handled by our authentication provider and stored only as secure hashes.
• Reading content: the questions you ask, the cards drawn, AI interpretations, follow-up questions, ratings and feedback. Please do not include sensitive health, financial or legal details in your questions.
• Photos you upload for Photo Reading. We send them to our AI provider to recognize the cards and do not keep the image after the scan.
• Screenshots you submit for sharing rewards, kept in private storage so we can review the claim.
• Purchase records: product, amount, currency, status and the payment provider’s transaction reference. Card and account numbers are entered with the payment provider and never reach us.
• Technical data: IP address, browser or device type and operating system, used to keep the service running and to prevent abuse. IP addresses used for rate limiting are stored only as keyed hashes.
• Crash and error reports from our apps: what went wrong, the app version, device model and operating system, and the screens and network requests just before it. They are not linked to your account and do not include your questions or readings.
• Aggregated usage statistics, such as pages visited and steps completed in a reading, collected without cookies.

We use this information to:

• Provide readings, follow-ups, your reading history and the features of your plan
• Manage your account, credits, purchases and subscriptions
• Answer support requests and send service messages, such as sign-in and password emails
• Understand which features work and improve the service, using aggregated statistics
• Detect fraud, abuse and unauthorized access, and enforce our Terms
• Comply with legal obligations

Readings are written by AI models. To create one, we send the provider only what the reading needs: your question, the cards and positions, your reading language and guide settings. We do not send your name or email address.

• Google (Gemini API) writes interpretations, routes questions to a suitable spread and recognizes cards in Photo Reading images
• Alibaba Cloud Model Studio (Qwen models) writes interpretations when it is selected for a reading or when Google is unavailable
• We use these providers’ paid business APIs, not their consumer apps, and we do not allow them to use your content to train their models. Their terms may permit short-term retention of requests for abuse monitoring.
• All requests are sent over encrypted connections

AI interpretations are for entertainment and self-reflection and are not professional advice.

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. We share it only with the providers that run FlipTarot on our behalf:

• Supabase: database, sign-in and file storage (United States)
• Vercel: website hosting, and privacy-friendly Web Analytics and Speed Insights
• Google and Alibaba Cloud: AI processing, as described above
• Stripe: card payments and subscriptions on the website
• Alipay: payments on our Simplified Chinese website
• Apple App Store, Google Play and RevenueCat: in-app purchases and subscriptions in our apps
• Sentry: crash and error reports from our apps (United States)
• Google and Apple: sign-in, when you choose those options

We may also disclose information when required by law, to protect the rights and safety of our users and FlipTarot, or as part of a merger or acquisition, in which case this policy continues to apply.

We use industry-standard measures to protect your information:

• Encryption of data in transit and at rest
• Access controls that limit personal data to the people and systems that need it
• Secure authentication and keyed hashing of security identifiers
• Regular backups and timely security updates

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Depending on where you live, you can:

• Access your data and receive a copy in a portable format
• Correct inaccurate information
• Delete your account and all of its readings in your account settings, or ask us to delete specific data
• Object to or restrict certain processing
• Withdraw consent where we rely on it
• Lodge a complaint with your local data protection authority

To exercise a right that is not available in your account settings, contact us using the details below. We may need to verify your identity first.

We only use cookies and browser storage that the service needs:

• Sign-in cookies that keep you logged in
• A language cookie that remembers your preferred language
• Browser storage for drafts and in-progress readings, so they survive a reload

We do not use advertising cookies or cross-site tracking. Our analytics are cookieless: they record page views and product steps without identifying you, remove query strings and replace private link codes (such as share links) before anything is sent.

Our services are not intended for children under 13, or under the higher minimum age that applies in your country. We do not knowingly collect personal information from children under that age. If you believe a child has given us personal information, contact us and we will delete it.

Our database is hosted in the United States, and our providers may process data in other countries, including where Google and Alibaba Cloud operate their AI services. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on safeguards such as the Standard Contractual Clauses in our providers’ data processing terms.

We keep your account and readings while your account is active. When you delete your account, we delete your profile, readings, follow-ups, ratings, purchase records, referral data and uploaded screenshots from our systems, remove your Stripe customer record and delete your sign-in identity. Photo Reading images are not stored. Hashed rate-limit records are deleted on a rolling basis. Payment providers keep their own transaction records as the law requires.

We may update this Privacy Policy from time to time. When we do, we will post the new version on this page and update the date at the top. For material changes, we will also give you notice in the service or by email.

If you have any questions regarding this Privacy Policy, your data, or your rights, please contact us.

If you are in the European Economic Area, the United Kingdom or Switzerland, you have rights under data protection law, including access, rectification, erasure, restriction, data portability and objection. We process your data to perform our contract with you (providing readings and purchases), for our legitimate interests (security, fraud prevention and improving the service), to comply with legal obligations, and with your consent where required.

If you are a California resident, you have the right to know what personal information we collect, use and disclose, and to request access, correction and deletion. We do not sell personal information or share it for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.