Privacy Policy

Account identity — your email address; if you sign in with Google, also your display name, avatar URL, and the stable Google subject ID. Used only to sign you in and to address you in the interface.

Profile — your chosen sigil, default spread, language. Astrology and birth-card features compute on the server from data you enter and persist only the derived tags (sun / moon / rising sign codes and soul / personality card IDs). Your raw birthday, birth time, place, and coordinates are never written to our database — this is an auditable privacy commitment, not a configurable option. The one exception is a birth chart you choose to save, described in the next item.

Saved birth charts — only when you choose "Save to my manuscript" under a chart on the birth chart page: the name you give it, when you saved it, your birth date, your birth time as you gave it (an exact time, a two-hour window, or none), the birthplace you picked (its name, country code and coordinates) and its time zone, and the house system asked for. They are kept so the chart opens again, until you delete the chart in Profile or delete your account, and they are included in your data export. If you are signed out when you choose to save, your browser holds the same details in this tab's session storage only for the trip through sign-in, and discards them if you go anywhere else. Up to 12 charts.

Readings and journal — while you are signed in, each reading is saved to your account automatically once its interpretation has finished writing: the drawn cards, spread type, the question you asked, the AI interpretation, and the reader and voice that wrote it. Your notes, tags, and mood are saved when you add them. A share token is saved only when you create a public share link, together with the link-preview image your browser draws for it — the spread's name and its cards, never your question or the interpretation; revoking the link deletes both. You can delete your readings at any time: a single one from its reading page or your Journal, or all of them at once via Profile → Delete Grimoire; a deleted reading's share link and preview image go with it.

Share link card text — when you create or update a share link, your browser also sends the words for the link's preview card: the spread's name with the names of up to three of its cards, and the excerpt of the interpretation chosen in the share sheet — never your question. They are stored only to show that card, and are deleted when you revoke the link or delete the reading.

Look-back check-ins — when you turn on "Look back at this step in 7 days" under a reading: the day it comes due (seven days after the reading), when a reminder about it was sent, and — once you answer — whether you took the step and the reflection you write (up to 2,000 characters). Only one unanswered check-in is kept at a time: setting a new one replaces it, and turning it off deletes it. An answered check-in stays with its reading until you delete that reading or your account.

Conversations — when you talk with a reader about a reading, or start a conversation directly: each message you send and each reply (including quick actions such as switching the angle or the reader), the reader and language, and the digest the reader writes of the conversation, which you can edit and which also serves as its memory of earlier messages. A conversation is kept until you clear it — which deletes it together with all its messages and its digest — or until you delete its reading or your account. When you clear a conversation, we keep only the times at which its questions of the past 24 hours were asked, with no content, so that the daily message limit still counts them; they are deleted the next time you clear a conversation after those 24 hours have passed, or with your account.

Engagement records — your daily-card draws (one card stored per user per calendar day, counted in your own time zone), 21-day challenge progress, achievement unlocks, and quiz scores. We use these to render your /profile, /journey, and /wrapped pages and to award the achievements described in the Terms. When you start a 21-day challenge, we store your time zone with it (an IANA name such as Europe/Paris) so its days are counted by your local date.

Quiz progress — while you are signed in: the stars you have earned at each station, how well you know each card (the review box it sits in), the days on which you studied (which make up your study streak), and your best three-minute rush score. Used to carry your progress across devices; kept until you delete your account.

Guide reading progress — while you are signed in: which /guide pages you have read and when, used to show your progress through the guide on any device; kept until you delete your account.

Reading reminder — if you set a reading reminder time in Profile: that time and the time zone it is sent in (an IANA name such as Europe/Paris, taken from your browser when you save it), so that the daily card reminder email arrives at that hour of your local day. Turning the reminder off clears the time; the time zone stays with your other preferences until you delete your account.

Push subscriptions — when you opt in on /profile: the endpoint URL provided by your browser plus the device's p256dh and auth public-key material (issued by your browser; not personal data on its own). Removed when you turn the toggle off.

Referrals — when you generate or redeem an invite code: the code string and one redemption row per accepted invite, used to grant the bonus month described in the Terms.

Billing — for paid subscribers: tier, renewal date, any pending grace-period deadline, and the customer / subscription IDs issued by Dodo Payments, our merchant of record. We never see your card number, expiry, or CVV.

Credits — for accounts that use them: each grant of credits (where it came from, such as the sign-up gift, a monthly grant, a daily check-in or a credit pack; how many; how many remain; when they expire) and each spend (how many, on which reading, conversation question or daily page, and whether it was refunded). Used only to keep your balance and to show what each credit went to.

Draw charges — each time a draw spends credits: the draw's ID, a SHA-256 hash of what was drawn (spread, language, question and cards — the question itself is not stored here) and how many times it was resumed, so that reloading or retrying the same reading within 24 hours is not charged again. Rows older than 24 hours are deleted the next time a draw spends your credits, and the rest with your account.

Analytics — event records keyed by a pseudonymous account ID (a random identifier, not your name or email address). No question text, no card content, no interpretation prose.

Sign-in code requests — each time a sign-in code is emailed and each time a wrong code is entered, we keep a short record to prevent abuse: a keyed hash (HMAC) of the email address, a keyed hash of the IP address, and the time. Neither the address nor the IP is stored in readable form.

Email delivery records — one record for each automated email we send (for example sign-in codes, account and membership notices, weekly letters, and marketing emails): which email it was, when it was sent, whether it was delivered, and the delivery service's message ID or error code. It never contains the text of the message. The recipient is recorded as your account or — for an email with no account behind it — as a keyed hash of the address. For account emails that may need a second attempt, the record also keeps what the email was built from (for example your plan and renewal date, or the first word of your display name) and your time zone.

Weekly letters — if you sign up with the form on the site (you confirm through a link we email you) or, while signed in, join with your account's address (never by default): your email address, the letters' language, where you signed up, when you signed up and confirmed, when the last confirmation email was sent, how many letters you have received and when the last one went out, and when you unsubscribed. Replies to lunaris@lunarcana.app are forwarded to the operator's mailbox and kept there; we read them to improve the letters and never use them for personal readings.

Guest first reading — if you try a reading without signing in: the cards drawn, the spread, your question, the language, the reading options and reader used, the interpretation and the model that wrote it, the suggested questions shown with it, the free follow-up questions you ask, with their replies, and — if a message raises a safety concern and is answered with our fixed support message instead — up to three such messages, each with that reply. To limit how many guest readings one network can start, we also store a keyed hash (HMAC) of your IP address — never the IP itself — and your browser keeps a signed cookie (lunarcana-guest) holding the reading's ID for 30 days. If you sign in within those 30 days you can keep the reading: it is copied into your account, with its follow-ups, as an ordinary reading and conversation. The guest record itself holds no name or email address.

Contract performance (GDPR Art. 6(1)(b)) — account, profile, readings, billing. Without these we cannot deliver the service you asked for.

Legitimate interest (Art. 6(1)(f)) — minimal analytics for service health and abuse prevention, aggregate website analytics through Google Analytics, sign-in code request records to stop abuse, and email delivery records to confirm that our emails arrive. Balanced against your privacy by hashing identifiers, deleting these records on a fixed schedule, and offering opt-out via sign-out.

Consent (Art. 6(1)(a)) — astrology prompt enrichment, web push, marketing email, the weekly letters, and opt-in daily card email. All off by default; you turn them on yourself.

Legal obligation (Art. 6(1)(c)) — billing records retained as required by the tax law that applies to Dodo Payments.

All user-bound rows (account, profile, readings, journal, saved cards, daily draws, challenge progress, achievements, quiz scores, quiz progress, guide reading progress, draw charges, look-back check-ins, share link card text, conversations and their digests, reading reminder time and time zone, push subscriptions, referral records, monthly usage counters, credit grants and spending records, and the email delivery records for your account and its address): until you delete your account, when they are all deleted together in a single transaction, which also takes your address off the weekly letter list.

Sign-in code request records: 24 hours.

Email delivery records: 90 days. Deleting your account deletes the records for your account and its address at once; the only one left is the record of the email confirming the deletion, kept under a hashed address, which expires after 90 days.

Weekly letter list: your entry is kept until you ask us to erase it. Unsubscribing — with the one-click link at the end of every letter, or by deleting your account — takes your address off the list at once; the entry stays, marked as unsubscribed, until you write to support@lunarcana.app.

Guest first readings: kept with no time limit, without any name or email address, as anonymous data for studying which questions people bring and how the interpretations answer them. The IP hash is erased once the reading is 30 days old (in batches, as new guest readings are started), after which the reading can no longer be claimed. If you claimed it, deleting your account removes only the link between you and the guest record; the copy in your account is deleted with the account.

Database backups: rolling 30-day retention.

Server and access logs: 30 days.

Analytics events: 12-month rolling window.

Google Analytics: user-level event data is kept for 2 months; the aggregated reports built from it are kept longer.

Billing records: kept by Dodo Payments after account deletion for as long as its tax and audit obligations require (see its privacy policy).

Refund records: when a payment is refunded or charged back, we keep a record of it (amount, currency, date, reason, and the billing email, Google subject ID and Dodo Payments customer / subscription IDs it concerned). It is not deleted with your account — only its link to the account is removed — so that the audit trail survives for seven years.

Cloudflare (United States, global edge) — Workers compute, D1 database, R2 asset storage. All hot data lives here. Cloudflare Email Service delivers our automated emails, such as sign-in codes, account and membership notices, the weekly letters, and marketing emails (we pass your email address and the rendered message); Cloudflare Email Routing forwards mail sent to support@ and lunaris@lunarcana.app to the operator's mailbox; and Cloudflare Turnstile runs the human check before a sign-in code is sent and before the cards of a guest first reading are drawn.

Google (United States) — OAuth sign-in: we receive your email, name, avatar, and subject ID, and nothing more. Separately, the operator's mailbox that mail to support@ and lunaris@lunarcana.app is forwarded to is hosted on Gmail.

DeepSeek (Singapore / China) — AI interpretation provider. We send drawn cards, spread type, question, locale, and optional astrology context. For a conversation — including a guest's follow-up questions — we also send the reading's interpretation, the digest the reader last wrote (never your own edits to it), the conversation's most recent messages, and your new message, so that it can write the reply and the digest. We never send your email, name, or history.

Resend (United States) — only the daily card reminder email, sent if you set a reading reminder time in Profile. We pass your email address and the rendered message. Marketing emails and the weekly letters do not go through Resend.

Web push relays (Apple Push Notification service / Firebase Cloud Messaging / Mozilla Push Service) — used only when you have opted in to push. We send the notification payload to the endpoint URL your browser issued; the relay forwards it to your device.

PostHog (United States, EU region available) — product analytics. While you are signed in, we send a pseudonymous account ID (a random identifier, not your name or email address) and your chosen sigil. We also send event names with their details (counts, settings and IDs, such as the spread or card involved), including which buttons and links you click but not their text; the addresses of the pages you view and of the referring page, with any question removed; your device, operating system and browser, with screen size, language and time zone; and your IP address, from which PostHog derives an approximate location. Session replays record page layout, scrolling and clicks, with all text and form inputs masked. No question text or interpretation prose.

Google Analytics (Google LLC, United States) — aggregate website analytics: the pages viewed, device and browser type, approximate location, the referring site, and a few product events (checkout started, checkout completed, reading completed). It never receives a user ID, your email address, your question or the interpretation. Google signals and advertising features are turned off.

Dodo Payments (merchant of record) — our online reseller for paid subscriptions, named at checkout and on your receipt. It handles card processing and tax compliance as an independent controller of the personal data it collects directly from you at checkout, under its own privacy policy (https://dodopayments.com/legal/privacy-policy); we receive only its abstract customer / subscription IDs. Transfers outside the EEA, where applicable, rely on EU Standard Contractual Clauses.

authjs.session-token (development) / __Secure-authjs.session-token (production) — Auth.js v5 session, httpOnly, sameSite=lax, required for sign-in.

NEXT_LOCALE — your chosen language.

lunarcana-ref — invite-code carrier, expires after redemption.

lunarcana-guest — set when a guest first reading is drawn: the reading's ID with a signature, so this browser can come back to the reading and keep it after signing in. httpOnly; expires after 30 days, and is removed when you claim the reading after signing in, or when a claim finds it has expired.

lunarcana:tz — your time zone (an IANA name such as Europe/Paris), set when you draw the daily card so the daily pages know your local date; expires after one year.

PostHog distinct_id — first-party analytics identifier, set only when NEXT_PUBLIC_POSTHOG_KEY is configured.

_ga and _ga_<container-id> — first-party Google Analytics cookies, kept for up to 2 years. They are not set for visitors in the EEA, the UK or Switzerland: there Google Analytics runs in Consent Mode with analytics storage denied and sends only cookieless, anonymous pings.

We do not set third-party advertising cookies and we do not participate in cross-site behavioural tracking.

Local storage — non-sensitive client preferences kept on the device only and never sent to our servers: ambient track + volume, mute state, install-prompt dismissal, daily meditation counter. Clearing site data removes them.

Lunarcana is hosted on Cloudflare's global network; your data may be processed in regions outside your country of residence, including the United States. Transfers originating in the EU, UK, or Switzerland rely on Standard Contractual Clauses (SCCs) where applicable.

The China edition (when launched) runs on Aliyun within Mainland China and does not mirror data out of the region. Cross-border transfer of data collected by the China edition is subject to a separate consent flow.

Access, correction, deletion, portability — email support@lunarcana.app, or use Profile → Delete Grimoire for immediate cascading deletion across every user-bound table: user / account / session / reading / readingInterpretation / savedCard / userPreference / subscription / dailyDraw / userChallenge / userAchievement / pushSubscription / referralCode / referralRedemption / usageMonthly / credit_lot / credit_spend / email_send / readingSharePreview / readingShareText / reading_check_in / conversation / conversation_message / conversation_cleared_turn / quiz_progress / guide_read / draw_charge. Deletion is a single transaction and is irreversible.

Withdraw consent — toggle astrology, push, marketing email, daily card email, and voice synthesis in Profile at any time. Marketing email stays off until you turn it on, and every marketing email and every weekly letter ends with a one-click unsubscribe link.

Object to or restrict processing — email us.

Lodge a complaint — with your local data-protection authority (EEA: your supervisory authority; UK: ICO; California: Attorney General; China: CAC).

California (CCPA / CPRA) — we do not sell or share personal information for cross-context behavioural advertising. A "Do Not Sell or Share" link is therefore not required, but you may still exercise the rights above.

China (PIPL) — you may request a copy of your data and an explanation of processing; you may withdraw consent at any time.

Lunarcana is not directed at users under 13 (under 16 in the EU). If we learn that we have inadvertently collected data from such a user we will delete it without delay.

Material changes are announced on-site at least 14 days before they take effect. The "Last updated" line at the top of this page is authoritative.

In transit — TLS 1.3 between your browser, Cloudflare's edge, and every subprocessor we call. Authentication cookies are httpOnly and sameSite=lax; session tokens are random opaque values issued by Auth.js v5 and stored only as references in our database.

At rest — our Cloudflare D1 database is encrypted using Cloudflare's managed disk encryption. We do not store your card number, expiry, CVV, or any payment instrument — only the abstract customer / subscription IDs issued by Dodo Payments.

Access controls — administrative access to the production database is limited to the maintainer's hardware-key authenticated Cloudflare account. We do not run an internal customer-support tool with unrestricted read access to user rows.

Breach notification — if a personal-data breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware and contact affected users by the email address on file without undue delay, in line with GDPR Art. 33-34 and equivalent statutes.

AI-generated tarot interpretations are produced on demand from the cards you draw and the question you ask, by a third-party language model. They are intended for reflection, journaling, and contemplative practice. Nothing about your account, eligibility, pricing, or service tier is decided by the AI.

We do not engage in automated individual decision-making (including profiling) that produces legal or similarly significant effects on you, within the meaning of GDPR Art. 22.