This Privacy Policy explains how PracticeTarot.com ("we", "us") collects, uses, shares, and protects your personal information when you use practicetarot.com and related services (the "Service"). We are the data controller for the personal information described here. For questions or to exercise your rights, contact us at team@practicetarot.com.
1. Information We Collect
Information you provide
- Account details: name, email address, and password (managed by Firebase Authentication; we never see your password)
- Optional profile details, such as date of birth if you choose to provide it
- Learning content: journal entries, practice reading interpretations, questions, and answers you submit in lessons and exercises
- Purchase information: plan, credits, and billing status. Card details are collected and processed by Stripe and never stored on our servers
- Communications with our support team
Information collected automatically
- Usage data: pages viewed, features used, lesson and practice progress, and interaction events
- Session replays: we use PostHog to record how visitors interact with the site (mouse movement, scrolling, clicks). Text you type into input fields is masked by default in these recordings
- Device and technical data: browser type, operating system, screen size, approximate location derived from IP address, and performance metrics
- Error and diagnostic data when something goes wrong
- Cookies and similar technologies (see Section 6)
2. How We Use Your Information
We use your information to (with GDPR legal bases in parentheses):
- Provide the Service: lessons, practice readings, AI feedback, journal, and account management (performance of a contract)
- Process payments, manage subscriptions and credits, and send transactional emails such as receipts and account notices (performance of a contract)
- Generate AI feedback: your practice responses and related context are sent to our AI provider to produce evaluations and coaching (performance of a contract)
- Understand and improve the Service: analytics, session replays, funnel analysis, and performance monitoring (legitimate interests)
- Measure advertising effectiveness, such as Google Ads conversion tracking (legitimate interests, or consent where required)
- Keep the Service secure and prevent fraud and abuse (legitimate interests)
- Comply with legal obligations such as tax and accounting rules (legal obligation)
- Send marketing communications, if any, only with your consent, which you can withdraw at any time (consent)
We do not use automated decision-making that produces legal or similarly significant effects about you.
3. Who We Share Information With
We do not sell your personal information. We share it only with service providers who process it on our behalf, and in the limited situations below:
- Google Firebase (authentication, database, and hosting infrastructure)
- Stripe (payment processing)
- OpenAI (AI-generated readings, evaluations, and feedback). Content you submit for feedback is processed under OpenAI's API terms, which do not permit use of your data to train their models
- PostHog (product analytics and session replay, hosted in the US)
- Google Ads (advertising conversion measurement)
- SendGrid (Twilio) (transactional email delivery)
- Vercel and Railway (application hosting)
- Authorities or other parties when required by law, or to protect our rights, users, or the public
- A successor entity in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data
4. International Transfers
Our service providers are primarily located in the United States. Where your data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses implemented by our providers.
5. Data Retention
We keep your account data and learning content for as long as your account is active. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must retain records to comply with legal obligations (for example, payment records) or resolve disputes. Analytics data and session replays are retained according to our analytics provider's retention settings and then deleted.
6. Cookies and Tracking
We use cookies and similar technologies for authentication, remembering your preferences, analytics, and advertising measurement. Our analytics respects the "Do Not Track" browser setting — if enabled, PostHog tracking is disabled. You can also control cookies through your browser settings; blocking some cookies may affect how the Service works.
7. Data Security
We use appropriate technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and reputable infrastructure providers. Payment card data is handled entirely by Stripe and never touches our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Rights
Wherever you live, you can:
- Access and review your personal information
- Correct inaccurate data
- Delete your account and associated data
- Receive a copy of your data in a portable format
- Opt out of marketing communications
To exercise any of these rights, email team@practicetarot.com. We will respond within the timeframe required by applicable law and may need to verify your identity first.
If you are in the EEA, UK, or Switzerland (GDPR)
You additionally have the right to object to processing based on legitimate interests, restrict processing, withdraw consent at any time (without affecting prior processing), and lodge a complaint with your local data protection supervisory authority.
If you are a California resident (CCPA/CPRA)
You have the right to know what personal information we collect, use, and disclose; to delete and correct it; and to not be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising as defined by the CCPA. We do not knowingly collect personal information of consumers under 16 for sale or sharing.
9. Children's Privacy
The Service is not intended for anyone under 16 years of age, and we do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us personal information, contact us at team@practicetarot.com and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we will provide additional notice, such as by email or an in-app notice, before the change takes effect.
11. Contact Us
Questions about this policy or our data practices? Contact us at:
Email: team@practicetarot.com