This Privacy Policy explains how PracticeTarot.com ("we", "us") collects, uses, shares, and protects your personal information when you use practicetarot.com, the PracticeTarot.com iOS app, and related services (the "Service"). We are the data controller for the personal information described here. For questions or to exercise your rights, contact us at team@practicetarot.com.
1. Information We Collect
Information you provide
- Account details: name, email address, and password (managed by Firebase Authentication; we never see your password)
- If you sign in with Apple or Google: the name and email address that Apple or Google shares with us, and an account identifier from that provider. We never receive your Apple or Google password. With Sign in with Apple you can choose to hide your email; we then receive a private relay address from Apple, and emails we send to it are forwarded to you by Apple
- Optional profile details, such as date of birth if you choose to provide it
- Learning content: journal entries, practice reading interpretations, questions, and answers you submit in lessons and exercises
- Purchase information: plan, credits, and billing status. On the website, card details are collected and processed by Stripe and never stored on our servers. In the iOS app, Apple processes the payment; we receive your subscription status (plan, renewal and expiry dates) from Apple through RevenueCat, never your payment details
- Answers to the optional questions we ask after you sign up, such as your tarot experience, how you found us, and what you want to get out of the Service
- Communications with our support team
Information collected automatically
- Usage data: pages viewed, features used, lesson and practice progress, and interaction events
- In the iOS app: your lesson and practice progress and app settings, and how you use the app (for example screens and lessons opened and finished, readings sent for feedback, free-plan limits reached and purchase attempts, with the app version). These usage events are sent to our analytics provider, PostHog, under your account ID, so the website and the app are measured together. Daily reminders, if you turn them on, are scheduled on your device
- Push notifications (iOS app): if you allow notifications, we store a push token for your device (an identifier Apple issues so we can send notifications to it), with the app version and whether you want Tips & news. We use it only to send you notifications from the Service; you can turn off Tips & news in the app's Account screen, or all notifications in your iPhone's Settings. The token is deleted with your account
- Session replays (website only): we use PostHog to record how visitors interact with the site (mouse movement, scrolling, clicks). Text you type into input fields is masked by default in these recordings
- Device and technical data: browser type, operating system, screen size, approximate location derived from IP address, and performance metrics
- Error and diagnostic data when something goes wrong
- Cookies and similar technologies (see Section 6)
The iOS app does not track you across other companies' apps or websites. Session replays and advertising measurement are used on the website only.
2. How We Use Your Information
We use your information to (with GDPR legal bases in parentheses):
- Provide the Service: lessons, practice readings, AI feedback, journal, and account management (performance of a contract)
- Process payments, manage subscriptions and credits, and send transactional emails such as receipts and account notices (performance of a contract)
- Generate AI feedback: your practice responses and related context are sent to our AI provider to produce evaluations and coaching (performance of a contract)
- Understand and improve the Service: analytics, session replays, funnel analysis, and performance monitoring (legitimate interests)
- Measure advertising effectiveness, such as Google Ads conversion tracking (legitimate interests, or consent where required)
- Keep the Service secure and prevent fraud and abuse (legitimate interests)
- Comply with legal obligations such as tax and accounting rules (legal obligation)
- Use your answers to the optional sign-up questions to suggest where to start and to tailor the emails we send you (legitimate interests)
- Send emails about your account and your learning, such as a welcome series, lesson reminders, and occasional offers related to the Service. Every email has an unsubscribe link (legitimate interests, or consent where the law requires it)
We do not use automated decision-making that produces legal or similarly significant effects about you.
3. Who We Share Information With
We do not sell your personal information. We share it only with service providers who process it on our behalf, and in the limited situations below:
- Google Firebase (authentication, database, and hosting infrastructure)
- Stripe (payment processing on the website)
- Apple (payment processing for purchases in the iOS app, Sign in with Apple, and delivering push notifications)
- Google (Sign in with Google, if you choose it)
- RevenueCat (manages App Store subscription status for the iOS app)
- OpenAI (evaluating the practice readings you write, and generating feedback and learning content). Content you submit for feedback is processed under OpenAI's API terms, which do not permit use of your data to train their models
- PostHog (product analytics and session replay, hosted in the US)
- Google Ads (advertising conversion measurement)
- SendGrid (Twilio) (transactional email delivery)
- Vercel and Railway (application hosting)
- Authorities or other parties when required by law, or to protect our rights, users, or the public
- A successor entity in connection with a merger, acquisition, or sale of assets, in which case this policy continues to apply to your data
4. International Transfers
Our service providers are primarily located in the United States. Where your data is transferred out of the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework or Standard Contractual Clauses implemented by our providers.
5. Data Retention
We keep your account data and learning content for as long as your account is active. If you delete your account, we delete or anonymize your personal information within a reasonable period, except where we must retain records to comply with legal obligations (for example, payment records) or resolve disputes. Analytics data and session replays are retained according to our analytics provider's retention settings and then deleted.
6. Cookies and Tracking
We use cookies and similar technologies for authentication, remembering your preferences, analytics, and advertising measurement. Our analytics respects the "Do Not Track" browser setting — if enabled, PostHog tracking is disabled. You can also control cookies through your browser settings; blocking some cookies may affect how the Service works.
7. Data Security
We use appropriate technical and organizational measures to protect your information, including encryption in transit (HTTPS), access controls, and reputable infrastructure providers. Payment card data is handled entirely by Stripe (website) or Apple (iOS app) and never touches our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8. Your Rights
Wherever you live, you can:
- Access and review your personal information
- Correct inaccurate data
- Delete your account and associated data
- Receive a copy of your data in a portable format
- Opt out of marketing communications
You can delete your account yourself in Settings, on the website or in the iOS app. If you signed in with Apple, deleting your account in the app also revokes the app's access to your Apple ID. To exercise any of these rights, email team@practicetarot.com. We will respond within the timeframe required by applicable law and may need to verify your identity first.
If you are in the EEA, UK, or Switzerland (GDPR)
You additionally have the right to object to processing based on legitimate interests, restrict processing, withdraw consent at any time (without affecting prior processing), and lodge a complaint with your local data protection supervisory authority.
If you are a California resident (CCPA/CPRA)
You have the right to know what personal information we collect, use, and disclose; to delete and correct it; and to not be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising as defined by the CCPA. We do not knowingly collect personal information of consumers under 16 for sale or sharing.
9. Children's Privacy
The Service is not intended for anyone under 16 years of age, and we do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us personal information, contact us at team@practicetarot.com and we will delete it.
10. Changes to This Policy
We may update this policy from time to time. We will post the updated version on this page and update the "Last updated" date. For material changes, we will provide additional notice, such as by email or an in-app notice, before the change takes effect.
11. Contact Us
Questions about this policy or our data practices? Contact us at:
Email: team@practicetarot.com