tarotogo ("we", "us") operates tarotogo.com, offering tarot readings for entertainment and self-reflection.
Data controller contact: johnny.bulker@gmail.com
For EU/UK/Israel data-subject requests, email the address above with the subject "Privacy request". We respond within 30 days (or as required by law).
Stored only in your browser (not sent to us unless you sync Premium journal): reading journal, daily-card streak, spread preferences, language, premium license key cache, free-AI usage flag, cookie consent choice. See our Cookie Policy for every localStorage key.
Collected when you provide it: email address for daily-card emails, access recovery, or checkout (via payment provider). Used only to deliver the service you requested.
Collected automatically: IP address and request metadata for security, rate limiting, and abuse prevention — retained briefly, not used for profiling.
Premium journal (server): if you subscribe, saved readings may sync to our Cloudflare D1 database, keyed by your license — so you can access them across devices.
AI readings: your question and card spread are sent to our backend, which calls Anthropic's API server-side. We do not expose API keys in the browser.
Payments: processed by our Merchant of Record or payment partner (e.g. Stripe, Lemon Squeezy, Polar). We receive only email, subscription status, and license identifiers — never full card numbers. See the processor's privacy policy at checkout.
To run the service, verify subscriptions, send emails you signed up for, prevent abuse, and improve tarotogo. We do not sell your personal data. We do not build third-party advertising profiles unless you consent to advertising cookies on the free tier.
We use trusted providers who process data on our behalf under appropriate agreements:
We require processors to protect data and use it only for the services they provide us.
Free users may see ads after consent. Ad partners may use cookies — manage this via our consent banner or Cookie Policy. Premium and remove-ads customers see no ads. See also Google Ad Settings.
Depending on your location (EU/EEA, UK, Israel, California, and others), you may have the right to:
Browser-stored data (journal, settings) can be cleared anytime in your browser. Email us for server-held data.
We do not sell or share personal information for cross-context behavioral advertising as defined under California law. If that changes, we will update this policy and provide a "Do Not Sell or Share My Personal Information" mechanism. Advertising cookies, if enabled, are opt-in via our consent banner.
We and our processors may store or process data in the United States, EU, and other countries. Where required, we rely on appropriate safeguards (e.g. Standard Contractual Clauses, processor certifications). Contact us for details about transfers relevant to your region.
tarotogo is not directed to children under 13 (or 16 in the EU/UK where applicable). We do not knowingly collect personal data from children. If you believe a child provided data, contact us and we will delete it.
We use HTTPS, signed webhooks, server-side license checks, rate limits, and input sanitization. No method is 100% secure; use a strong email password and keep your license link private.
We may update this policy. Material changes appear in the "last updated" date. Continued use after changes constitutes acceptance where permitted by law.