Privacy policy

The personal-data controller (operator) will be named here after identity is confirmed — this field is intentionally empty for now (no invented registration numbers or addresses).

We minimise data: anonymous HttpOnly guest sessions; account (email / OAuth) if you choose; technical logs without full question or interpretation text by default. To generate a reading, question text and card context are processed by our servers and an AI model provider — only to deliver the service.

Payment data (when live payments ship) will be handled by the payment provider; we do not store full card numbers. Google Analytics 4 runs only after you accept analytics in cookie settings; events never include reading text, questions, or payment secrets.

Access or deletion requests will go to a published support contact once operator details are live. This policy is a draft pending legal review.