Privacy

Last updated: 27 September 2026

What we collect

When you draw a card we receive your chosen category, your question, your IP address, and a random device identifier stored in a cookie. Your IP address is used only to apply a per-network limit against abuse (for example, someone clearing their cookies to bypass the free-reading limit) and is not stored alongside your question. If something breaks, our error-monitoring tool may capture technical details of that error (such as the page URL and browser type) — we've configured it not to collect page content or form input. We don't ask for your name or email for free readings.

How your question is used

Your question is sent to our AI provider, Anthropic, to write your reading through their API. Under Anthropic's commercial terms, API inputs and outputs are not used to train their models, and are automatically deleted from their backend within 30 days. We store your question for 30 days to keep the service reliable, then delete it ourselves. We keep anonymous counts (such as which card was drawn) to improve the app. We rely on your choice to use the service as the basis for this processing, and on our legitimate interest in keeping anonymous product metrics and preventing abuse.

Who else processes your data

We use a small number of service providers to run InnerRewrite Tarot: Anthropic (writes your reading), Supabase (stores reading records in Postgres), Upstash (enforces the free-reading limit), and Sentry (alerts us to technical errors). None of them are permitted to use your data for their own purposes. Some of these providers process data outside your own country — including in the United States and Singapore — under their own standard data-protection safeguards; contact us if you'd like more detail on a specific transfer.

Cookies

We use one essential cookie to apply the free-reading limit. We don't currently use analytics or advertising cookies; this page will be updated if that changes.

Your choices

Wherever you are, you can ask us to access, correct, or delete the data we hold about you, or to receive a copy of it, by contacting pathania.sucharu@gmail.com. We respond within 30 days.

If you're in the European Economic Area or the UK, this includes the rights of access, rectification, erasure, restriction, portability and objection under the GDPR / UK GDPR, the right to withdraw consent at any time, and the right to lodge a complaint with your local data protection authority. If you're in California, this includes the rights to know, delete, and correct your personal information, and to opt out of its sale or sharing — we don't sell or share personal information. If you're in India, this includes the rights of access, correction and erasure under the Digital Personal Data Protection Act; the contact above also serves as our grievance officer.