Privacy Policy

Effective Date: 2026-05-12 Last Updated: 2026-05-12

Tarotdoxa LLC (“Tarotdoxa,” “we,” “us,” or “our”) operates the Tarotdoxa mobile application (the “Service”). This Privacy Policy describes our practices regarding the collection, use, and disclosure of information when you use our Service.

We have deliberately designed Tarotdoxa to collect as little personal information as possible. The short version: we do not require you to create an account, we do not collect or sell your personal data, your readings stay on your device, and we do not retain transcripts of what you ask the cards.

1. Who We Are

Tarotdoxa LLC is an Oregon limited liability company. You can reach us at:

2. Information We Do Not Collect

To be explicit about what Tarotdoxa does NOT do:

3. Information We Do Process

Information You Provide

If you choose to contact us (for example, by emailing us about a question or concern), we will receive the information you send. We use that information only to respond to you.

Information Apple Processes for In-App Purchases

If you purchase a subscription or one-time content, the transaction is processed entirely by Apple through the App Store. We receive only aggregate, anonymized purchase data from Apple. We do not see your payment information, billing address, or Apple ID. Apple’s privacy practices are described at https://www.apple.com/legal/privacy/.

Information Generated During Your Reading

When you draw cards, the cards drawn, your selected spread, and any optional context you provide (such as a topic) are sent to our reading engine to generate your reading. We do not retain this information after the reading is delivered. The reading itself is stored locally on your device under your control.

Anonymous Analytics

We use Apple’s built-in analytics (which require your opt-in via iOS settings) to understand aggregate usage patterns: which features are used, which spread types are most popular, crash data. These analytics are anonymized by Apple and never tied to your identity.

Technical Information

When the app communicates with our reading engine, our servers automatically receive standard technical information (such as IP address and a timestamp). We use this only to operate and secure the Service. We do not log requests with identifying information beyond the minimum needed to deliver your reading, and we delete server logs after 30 days.

4. How We Use Information

We process the limited information we do receive to:

5. How We Train Our Reading Engine

Tarotdoxa’s voice and reading patterns were developed by Holly Cole, a co-founder of Tarotdoxa LLC, drawing on over two decades of her own tarot practice. We trained our reading engine using:

We have never used your reading as training data. We will never use your reading as training data without your explicit, separate, written consent.

Source materials used in training were destroyed once their pattern value was extracted. The model encodes patterns, not individual readings.

6. Sharing Information

We do not sell, rent, or trade personal information. We share information only in the limited circumstances described below:

We do not transfer your personal information to any other third party.

7. Your Rights

Regardless of where you live, you have the right to:

To exercise any of these rights, email privacy@tarotdoxa.com. We will respond within 30 days. Because we collect almost no personal information, in most cases the answer will be “we do not have records that identify you.”

Additional rights for residents of California (CCPA/CPRA), Colorado, Virginia, Connecticut, Texas, and other US states with comprehensive privacy laws

You have the same rights described above. You may also designate an authorized agent to make requests on your behalf. We do not “sell” personal information and we do not engage in “sharing” for cross-context behavioral advertising under any applicable state law.

Additional rights for residents of the European Economic Area, United Kingdom, Switzerland, and other GDPR-equivalent jurisdictions

You have the same rights described above, plus the right to:

Our lawful basis for processing the minimal information we do receive is performance of the contract (delivering the reading you requested) and our legitimate interest in operating and securing the Service. We do not transfer personal data outside your region for purposes other than delivering the reading you requested.

8. Children

Tarotdoxa is intended for users aged 17 and older. We do not knowingly collect personal information from anyone under 13 (or under 16 in the EEA/UK). If you believe a child has provided us information, please email privacy@tarotdoxa.com and we will delete it.

9. Security

We use industry-standard technical and organizational measures to protect the limited information we process. No system is perfectly secure, but our approach is data minimization first: we cannot lose what we never collected.

10. Data Retention

11. International Users

Tarotdoxa is operated from the United States. If you access the Service from outside the United States, you understand that your interactions with the Service may be processed in the United States. The minimal information we process is handled consistently with this Privacy Policy regardless of where you are.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in the app and via the Effective Date above. Your continued use of the Service after any change constitutes acceptance of the updated policy.

13. Contact

For privacy questions, data subject requests, or to exercise any of the rights described above:

We are the data controller for purposes of GDPR. Our designated Privacy Contact is Russell Gardner.

This Privacy Policy reflects our commitment to data minimization. The strongest privacy protection we can offer is not collecting your data in the first place.