Privacy Policy

TarotByte (“we,” “us,” or “our”) operates the website tarotbyte.app and the TarotByte reading platform. This Privacy Policy explains what information we collect, how we use it, and the choices you have. By creating an account or using our readings, you agree to the practices described here.

1. Information We Collect

Account information

When you sign up, we collect your email address and a password (stored as a secure hash, never in plain text). We use Supabase for authentication, which manages credentials on our behalf. Your email is used to confirm your account, send you reading-related notifications, and deliver The Weekly Byte newsletter if you opt in.

Reading history

The questions you ask, the cards you draw, and the interpretations generated are stored so you can revisit past readings from your account. This data is tied to your account and is not visible to other users. We may use anonymized, aggregated reading data (e.g., “the most drawn card this month”) for marketing or product insights, but never in a way that identifies you.

Payment information

If you purchase a Decan Engine add-on or subscribe, payment is processed by Stripe. We never see or store your full card number, CVV, or other raw payment details — Stripe handles that securely. We receive your Stripe customer ID, subscription status, and the email associated with your payment method so we can link your purchase to your TarotByte account and fulfill your order.

Technical data

Like most websites, we automatically collect basic technical information: your IP address, browser type, device type, and pages visited. This is used for security, abuse prevention, and understanding how the site is used in aggregate. We may use analytics tools to measure traffic patterns; any such tools are configured to respect do-not-track signals where applicable.

Email marketing

If you opt in to The Weekly Byte newsletter, we will send you periodic emails with tarot insights and product updates. You can unsubscribe at any time via the link in every email. Transactional emails (account confirmation, payment receipts) are sent regardless of newsletter preference and are necessary for the service to function.

2. How We Use Your Information

• To create and manage your account and authenticate your sessions
• To generate, store, and display your tarot readings
• To process payments and manage subscriptions and add-on credits
• To send transactional emails (confirmation links, receipts, security notices)
• To send The Weekly Byte newsletter if you have opted in
• To prevent fraud, abuse, and unauthorized access
• To improve our readings, features, and user experience in aggregate
• To comply with legal obligations

3. How We Share Your Information

We do not sell your personal data. We share information only with the service providers that power TarotByte, and only as necessary to operate the platform:

• Supabase — authentication, account data, and reading history storage (servers in the United States / region you select)
• Stripe — payment processing and subscription management
• Resend — transactional and newsletter email delivery
• Vercel — website hosting and content delivery

We may disclose information if required by law, court order, or to protect our rights, your safety, or the safety of others. In the event of a merger, acquisition, or asset sale, user data may be transferred as a business asset, and we would notify you before that happens.

4. Data Retention

We retain your account data and reading history for as long as your account is active. If you delete your account, we will remove your personal data from our active systems within 30 days, except where retention is required by law (e.g., financial records related to payments). Stripe retains payment records according to its own policies and applicable financial regulations.

5. Your Privacy Rights

Depending on your location (particularly if you are in the EU, UK, California, or other jurisdictions with privacy laws), you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated data
• Export a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent for marketing emails at any time

To exercise any of these rights, email hello@tarotbyte.app. We will respond within 30 days. You can also delete your account directly through the Supabase auth flow or by contacting us.

6. Cookies

TarotByte uses essential cookies to maintain your authenticated session. These cookies allow you to stay signed in between page loads and are necessary for the service to function. We do not use third-party advertising cookies. If we add analytics cookies in the future, we will update this policy and provide appropriate consent mechanisms.

7. Data Security

We take reasonable measures to protect your data. Authentication is handled by Supabase using industry-standard practices. Payment data is handled by Stripe, which is PCI-DSS compliant. Our service role keys and API secrets are stored as environment variables and never exposed to the browser. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Children’s Privacy

TarotByte is not directed at children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

9. International Users

TarotByte is hosted in the United States. If you access the service from outside the US, your data will be transferred to and processed in the US. By using TarotByte, you consent to this transfer. We aim to comply with applicable data protection laws including the GDPR and CCPA.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or a notice on the site. The “last updated” date above reflects the most recent revision. Continued use of TarotByte after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your data, please contact us at hello@tarotbyte.app.