tarotogo is a free tarot application for entertainment and self-reflection. Contact the project at johnny.bulker@gmail.com. Read about the project and its editorial approach.
Your language, selected deck, guest journal, reflections, daily card, and interface preferences use browser storage. Clearing site data removes these local records. The installed app caches its public shell and previously viewed card artwork; network services are not available offline.
Questions and private notes are excluded from reading share links, images, and PDF exports by default. The explicit inclusion option can add them. Share links are encoded, not encrypted: anyone with the link can read included information. Backups contain private journal data and should be stored carefully.
Where configured, Continue with Google sends a Google identity token to our Azure API for verification. We use Google's stable account identifier, not email alone, to create an internal account. A verified email address and display name identify the account in the interface. We request no Gmail inbox access.
Immediately before sign-in, the app explains that existing guest readings will upload automatically. Uploaded entries include card identifiers, spread, deck, language, questions, reading text, and reflection notes. The cloud journal supports up to 500 live entries, editing, backups, and account deletion. Conflicting edits retain both versions; deletion markers prevent stale devices from bringing deleted entries back.
Sign-in uses a revocable seven-day session in a Secure, HttpOnly, host-only cookie. An account has one active browser or device session; a new successful sign-in revokes the previous session's access. Tabs sharing the same browser cookie share that session. The browser also caches account entries and unsynced changes. Signing out clears that private account cache; pending changes require export or explicit discard first. An offline device may retain cached data and pending notes until it reconnects or you clear its site storage. Guest data remains separate. Avoid storing highly sensitive information in a reading or on a shared device.
Account deletion removes the profile's personal fields, cloud journal, synchronization history, sessions, and stored pilot responses. Minimal deletion markers and non-content spending records may remain to prevent stale data from returning and enforce the usage budget. Account deletion does not unsubscribe a separately requested email subscription; use its unsubscribe link.
Earlier license-backed journaling remains separate for compatibility. It is not a Google account and does not automatically transfer its private server journal into a Google account.
New daily-card and AI-announcement enrollments are separate choices. We store your email, requested purpose, language, timestamps, pending preferences, and confirmation state when you submit the form, before confirmation. With the email provider configured, a confirmation link enables the requested purpose. Existing subscriptions retain their previous preferences. Google sign-in does not enroll you.
Where owner alerts are configured, a signup also sends the owner an alert containing the address and requested purpose. Every subscription email includes an unsubscribe link. Unsubscribing deletes the mailing-list record. Unconfirmed new signups are normally removed after 30 days by the scheduled maintenance job.
A durable delivery record prevents repeat daily emails for the same recipient and date. This includes a hashed recipient identifier, delivery status, and, while delivery is unresolved, the outgoing payload. The accepted-delivery record no longer contains that payload. An uncertain delivery may need investigation rather than an automatic retry.
Public AI readings remain paused. An explicitly invited, signed-in pilot account may see an optional AI feature only when its server configuration is enabled. The question and server-validated cards go through our API to Azure OpenAI; provider keys never reach the browser. Cloudflare Turnstile verifies an anti-abuse challenge. Provider failure does not trigger an automatic paid retry.
Account and AI requests use authorization, request limits, input checks, and CSRF protection. AI response replay text is available for up to seven days and is removed by scheduled cleanup; compact replay and budget records remain. Hosting and model providers may maintain their own operational logs according to their policies. No method is completely secure.
Google Privacy & Messaging is the intended certified consent integration. Advertising is disabled in this version until its published configuration is verified. When enabled, the ad SDK requires applicable Google consent data and is limited to substantive editorial pages and completed readings. Account, journal, legal, confirmation, and error surfaces do not initialize ads. No automatic ad refresh is used.
Our preference banner can reject optional analytics and advertising. It is not a replacement for Google's certified consent message. The privacy choices link also opens Google's applicable message when configured. Global Privacy Control blocks optional analytics and advertising loading in this version. Regional rejection or unknown consent keeps the ad loader off.
Optional Google Analytics 4 is configured, but collection starts only after your explicit analytics consent. Refusing it does not restrict readings or journaling. When enabled, we measure visits to public articles, libraries, guides and the reading app, reading starts and completions, successful local journal saves, confirmed email subscriptions, and returns on a later day. Account-cache saves do not establish successful cloud synchronization. We send only approved public page paths and bounded categories such as language, spread size, deck and local storage destination. We exclude questions, notes, email addresses, card names, reading text, account identifiers, URL query values, fragments and referrers. Private links and account screens are excluded. Refusal or revocation stops new collection; requests already transmitted cannot be recalled. Analytics never use our account identifiers or journal synchronization device keys. If Google Analytics 4 is enabled, it uses its own pseudonymous browser cookies to estimate users and sessions, plus basic device information and approximate geography. This is not anonymous measurement or a count of every visitor. Google may also receive technical tag diagnostics. Google Signals, advertising personalization, automatic form and site-search measurement are disabled. A new analytics choice is required before switching a previously accepted Plausible preference to Google Analytics. After withdrawal, Google collection stays disabled on that page; accepting again takes effect after navigation or reload.
These services may process information outside your country. Contact the project for details about the deployment and the provider arrangements relevant to your request. We do not sell your journal or email address.
Export, edit, or delete a configured cloud account from the app. Use an email's unsubscribe link to stop subscription emails. Change optional preferences through Privacy choices; clear browser storage for local data. Depending on your location you may have access, correction, deletion, portability, objection, or complaint rights. Contact johnny.bulker@gmail.com for requests that the interface cannot resolve.
tarotogo is not directed to children under 13, or a higher applicable age of digital consent. Contact us if a child has provided personal data so we can investigate and remove it. Material changes to this description appear in the date above.