Privacy Policy
What the site keeps about you, who else sees it, and how to have it removed. I keep as little as I can.
Effective [EFFECTIVE DATE].
The short version
I collect as little as I can. There is no Google Analytics, no advertising tracker and no data broker on this site. The site itself sets one cookie, and only when you sign in. I don't sell your information, and I don't share it for advertising. Your questions to the Oracle are not used to train AI models. What follows is the long version, written so you can check me.
1. Who is responsible
Healing Tarot Readings ([LEGAL NAME]), run by Rosemary from [CITY], [STATE], is responsible for your personal information on healingtarotreadings.org. Write to [CONTACT EMAIL] or [POSTAL ADDRESS] about anything in this policy.
2. What I collect, when, and why
When you browse. The site keeps its own simple record of visits, with no outside analytics company. Your browser is given a random visitor number (stored in your browser, not a cookie). For each day you visit, the site records which pages you opened, how long you stayed, which features you used (for example the Oracle, the membership page, a recording), where you came from (the referring site and any campaign tag in the link), your country and the kind of device. It never records what you type and never stores your internet address. While a page is open, it also tells the site you're there, so I can see how many people are on the site right now and which pages they're reading. If your browser sends Global Privacy Control or Do Not Track, the site counts the page view and nothing else. Each visitor's record is kept for 90 days. Daily totals with no visitor in them (how many people came, from where, which pages) are kept for about 13 months. Cloudflare, which hosts the site, sees your internet address and browser details in order to serve pages and block attacks, and keeps its own short-lived logs.
When you're signed in, your visits are linked to your account. So I can look after you properly, the visit record above is connected to your account while you're signed in: when you first found the site and how, which pages and features you use, the recordings and library posts you open, and when you were last here. If you're online, I can see that you are and which page you're on. I use this to understand what you need and to follow up personally. It's never sold, never shared for advertising, and you can see it all by downloading your data from your Profile.
When you sign in. You give your email address. I send a sign-in link to it and, once you click it, the site sets a session cookie so it knows it's you. The cookie holds a random token and nothing else; on my side, the matching record holds your email, when you signed in and the kind of browser you used. Sign-in links expire after 15 minutes and work once; sessions end after 30 days or when you sign out. The first time you sign in, the site creates a free account for your email.
When you sign in with Google. If you press "Continue with Google", Google asks you whether to tell the site who you are, and if you say yes it gives me your name, your email address and a number that stands for your Google account. That is all I receive, and only if Google has confirmed the email address as yours. I never see or hold the password you use with Google, and nothing about your Google account beyond those three things. The first time, the site creates a free account for that email, or signs you into the account that email already has; there is never a second account. On the way in I ask you for the rest myself: your birthday, that you're 18 or older, and that you agree to the terms and this policy, and I keep the time you said so. Your birthday comes from Google only if you press "Read it from my Google account" on that sheet, which asks Google separately; Google then gives me the month and day, and the year if it holds one, and I keep only the date, never anything else from your Google profile. The site asks Google for nothing after you're in, so it holds no lasting key to your Google account. To take the site off your Google account, delete your account from your Profile, or remove "Healing Tarot Readings" at myaccount.google.com/permissions; either way you can still sign in with an email link.
When you join a membership. Stripe takes your card and bills you. I receive your email, your name if you give one, a Stripe customer number, your tier and whether the payment went through. I never see your card number. Stripe also receives your internet address and browser details for its fraud checks, under its own privacy policy.
When you buy and book a reading. Stripe takes your payment; the site keeps what you bought, what you have left to use, the time you pick, your time zone and any moves or cancellations, with your email, for as long as you have an account (purchase records longer, for accounts and tax). For a Reiki reading, your agreement to the written disclosure is recorded with the date and time, and California law asks me to keep it for three years. The reading itself happens in a private video room on this site, run by LiveKit. Your bookings appear, with your first name and email, in a private calendar feed that only I subscribe to. If I have connected my own calendar (Apple iCloud or Google), each booking is also written into it as an event with your first name, the kind of reading and the link to its room, never your email, phone or question; it moves and disappears with the booking.
When you give a gift. Your name as you want it on the gift, the person's name and email, your message, the day it should arrive and your time zone (so it arrives at 8 in the morning your time), and your email from Stripe for the receipt. I use the person's email only to send them the gift and, if they redeem it, the receipt of what it became; they're not added to any list. If you were signed in, the gift is linked to your account.
When you receive a gift. The gift, who it came from and their message are kept with your account once you redeem it, with any gift balance and how it was used.
When you send me a thank-you. The amount, your name or no name, your note, whether it was during a live, and your email from Stripe for the receipt (never shown to anyone). During a live I may show your name and note to the people watching on the site; never the amount or your email.
When you leave a review. Your rating, your words, the name you choose, whether I may publish it, which reading it's about, and the date. Only what you allowed is ever shown, and never your email. After a reading I email you once to ask; you can switch that note off in your Profile or with the link at the bottom of it.
When you ask me a question. Your question, anything you add to it, and my answer (in writing, as a voice note or a video) are kept with your account so you can come back to them. Voice notes and videos are stored privately and played only to you and me.
When you use the Oracle. Your question goes to the AI provider (section 3), which writes the reply. Signed in, the reading is saved under My readings in your Sanctuary, with your follow-up questions, your notes and any check-in you answer later, until you delete it. I read members' Oracle conversations. I look at them to understand what's on your mind, to follow up with you personally, and to make the Oracle read more like me. Not signed in, your reading is kept on the server for 24 hours (so a follow-up question works), and I may see it during that time, without your name attached. So the daily limit works, the server keeps a count for the day against your account, or against a scrambled form of your internet address when you haven't signed in; the count is deleted after 24 hours. Separately, a record of each reading's topic and cards, with no question text and no name, is kept for 400 days to show what people ask about. Your browser also tells the Oracle your time zone, so it knows what time it is for you; for members the time zone is kept with what the Oracle remembers.
What the Oracle remembers about members. If you're signed in, the Oracle remembers you unless you switch that off in your Profile. After each conversation it notes, from what you wrote, the things that help it look after you: the name you go by, the people you mention and who they are to you, what you're going through and how it turns out, how you like to be read (gently, or straight and objective), small things you chose to tell it, and when you last talked. That lets it follow up ("Last time you were deciding whether to reach out to your sister. Did you?"). It never keeps health conditions or diagnoses, sexuality, religion, or what you wrote about harming yourself; if you write about that, it keeps only that you had a hard day on that date, so it can be gentle with you, and nothing about what you said. It keeps nothing from its own replies as fact about you. You can see everything it remembers under "What the Oracle remembers" in your Profile, forget any single item, or forget everything at once; switching memory off stops it remembering anything new. I can see what the Oracle remembers about you too, the same way I can see your readings. Deleting your account deletes it, and your data export includes it. Visitors who aren't signed in are not remembered.
When you fill in your Profile. Name, your birthday, whether you read reversals, the tone you prefer, notification preferences and, if you choose one, a picture: one of the site's icons, or a photo you upload. A photo is made small and square in your browser before it is sent, kept in the site's private storage with no public address, and shown only to signed-in members (beside your name in the Community) and to me. No machine looks at it. You can swap it or remove it in your Profile at any time; removing it deletes the file, and so does deleting your account.
Your birthday. When your Sanctuary opens I ask for the month and day of your birthday; the year is up to you. It gives your sun sign, which picks the horoscope shown on your Home and in the "Your sign" page and, unless you switch it off in your Profile, the one sent in the morning email. I can also see whose birthday is coming up in the next month, only so I can wish them well in the Community if I like; nothing is sent on its own, and I don't promise birthday messages. If you give the year, your Chinese year animal and life-path number are worked out when the page opens and not stored. Your birthday is kept with your account and never shown to other members.
When you post or message. Forum posts and comments, messages to me through the direct line, and anything you attach. Posts are visible to other members of the tier they're posted to, under the Community name you choose, with your membership badge unless you switch it off. Reactions, polls you vote in, cards you pull for someone, and reports you make are kept with your account; who reported a post is seen only by me.
When you watch a live on this site. If you comment as a guest, the name you chose, your comments, and a coded number made from a random id your browser keeps (so I can pause or block someone without knowing who they are). A guest's first comment passes a Cloudflare Turnstile check that you're a person, which Cloudflare runs. If you're signed in, your first name and membership level show beside your comments, never your email. Comments are kept for 90 days for moderation and so a live can be replayed with its chat. Hearts are counted in the moment and not kept. Nothing you write on my site goes to TikTok, YouTube or any other platform.
When you send a gift on a live or a video. The gift, when, which live or video, the name shown, and your account. When you add money, Stripe takes the payment in a window on this page (Stripe's own form, which may offer Apple Pay or Google Pay); I get your email, the amount and Stripe's reference, never your card. When you say you're 18 or older, I keep that you said so and when.
When you join me on a live. Your video and voice go out live to everyone watching, on my site and on the platforms I stream to (TikTok, YouTube, Facebook, Instagram), and are recorded, and may be clipped and posted. I keep a record of your agreement (the words you agreed to, the time, your internet address and browser) for three years. The camera check before you go on stays in your browser.
The site's music. Whether you turned the music off, the volume and where the track was are kept in your own browser (local and session storage), not sent to me.
When your words are checked. Anything you write that other people will read (Community posts and comments, your Community name and Profile name, reviews, gift and thank-you notes, live chat) first goes through a short automatic check for swearing, slurs, links, other people's private details and selling. When that check passes and the words need a closer look, they go to an AI model through OpenRouter (section 3), which answers with one word for the kind of problem it sees, or none. The model never decides alone to keep a kind post out: anything it is unsure about waits for me to read. The site keeps a log line of each decision (what kind, which check, how long it took), without your words. If what you write sounds like you might harm yourself, your post still goes up in the members' rooms, you see the 988 lines privately, and I'm told (in my admin, and by an email that doesn't contain your words, at most once a day).
When I add a recording for you. A title, a date, notes and a link to a private video of your own reading, visible only to you and me.
When a reading with me is recorded. Only if everyone on the call agreed (section 2, live gatherings). The video is kept in private storage with no public address; the site plays it only to you (and to me) after checking it's you. Your voice and mine are also recorded as separate sound files, so the site can write down what was said: the words are turned into text by Cloudflare's speech-to-text service (Workers AI), and an AI model (through OpenRouter, as for the Oracle) drafts a short letter from me about the reading. I read it, change what I want, and decide whether to send it; you get it by email and it sits with the recording in your Sanctuary. The sound files, the text of the reading and the letter are private, never public, and never used to train AI models. If you ticked the separate box "Allow Rosemary's words from this reading (never mine) to help teach the Oracle", my side of the text (only mine, with names, places, numbers, health and anything else that could point at you taken out) may also become lines the Oracle learns from, which I approve one by one. Your words are never used for that.
When you join a live gathering (once video calls are switched on). Your audio and video pass through LiveKit for the length of the call. A gathering is recorded only if everyone present has agreed, and the screen shows when recording is on.
When you email me or subscribe. Your email address, your name if you give it, and what you write. Marketing emails go only to people who asked for them, and every one carries an unsubscribe link. Receipts, sign-in links and "Rosemary replied" notices are sent whether or not you're subscribed, because they're part of the service.
I don't ask for your location, phone number or gender, and the site never asks your browser for your position.
3. Who else sees it
I use a few companies to run the site. Each one sees only what it needs for its job, under its own privacy policy and a contract with me.
| Company | What it does | What it sees |
|---|---|---|
| Cloudflare | Hosts the site and stores its data | Everything the site stores; your internet address and browser details in its logs |
| Stripe | Takes payments and runs membership billing | Card details (which never reach me), name, email, internet address, billing history |
| OpenRouter, and the AI model providers it routes to | Produce the Oracle's readings, note what the Oracle should remember, and check words before other people read them | Your Oracle question, the drawn cards, your local time and time zone, and, for members unless memory is switched off, what the Oracle remembers about you and short summaries of your last readings. After each conversation your own words go once more to a model that notes what to remember. For the check described in section 2, the text of the post, comment, name, review or note, with no name or email attached. I route with the setting that keeps your words out of model training (data collection denied), so providers that would train on them are excluded. |
| Brevo | Sends email | Email address, name, which emails were sent, and whether they were opened or clicked [confirm whether open tracking stays on] |
| LiveKit (when switched on) | Carries live video and audio, and records a reading when everyone agreed | Audio and video during a call; a recording only if everyone agreed, written straight into my private storage |
| Cloudflare Workers AI | Turns the sound of a recorded reading into text, for my letter about it | The two voices of a recorded reading; Cloudflare says it does not train on what it processes [counsel to confirm the current terms] |
| LiveKit (when switched on) | Carries live video and audio | Audio and video during a call; a recording only if everyone agreed |
| Google (sign-in, if you choose it) | Confirms who you are when you press "Continue with Google" | That you signed in to this site with your Google account, and when; Google gives me your name, email and a Google account number, and your birthday only if you ask it to |
| Apple iCloud or Google Calendar (when I connect my own calendar) | My own calendar, so you can't book a time I'm busy and your booking lands in my diary | The time of your booking, your first name and the kind of reading; nothing else about you |
| Zernio (when switched on) | Publishes my posts to my social accounts and brings comments and messages from those accounts into my inbox | Only what the social platform already shares with my account |
Nobody else gets your information, with three exceptions: if the law requires it; if it's needed to protect someone's safety; or if the business changes hands, in which case the new owner takes on this policy.
4. Cookies and your browser's storage
The site itself sets one cookie, the session cookie, and only after you sign in. It's marked HttpOnly and Secure, which means scripts and other sites can't read it, and it's signed so it can't be forged. Signing out deletes it. I set no analytics or advertising cookies, and there's no cookie banner, because nothing of mine tracks you.
One thing on the site may come from another company and set its own cookies under its own policy: the player that shows a private recording or an answer hosted elsewhere, which belongs to wherever that video is hosted. Cloudflare may also set a short-lived cookie to tell people from bots.
The site also keeps a few small preferences in your browser's own storage, such as which tab you had open or whether you turned reversals on. These stay on your device and are never sent to me.
5. How long I keep things
| What | How long |
|---|---|
| Visit records (pages, features, where you came from, country, device; no internet address) | 90 days |
| Daily totals with no visitor in them | About 13 months |
| Oracle question log (topic, cards and cost only, no question text, no name) | About 13 months |
| Today's card by email: your place on the list | Until you switch it off in Profile or delete your account |
| Sign-in link | 15 minutes, or until used |
| Session | 30 days, or until you sign out |
| Sign-in attempt counters, by internet address | 15 minutes |
| Oracle daily counters | 24 hours |
| Saved Oracle readings, notes and check-ins | Until you delete them or your account |
| What the Oracle remembers about a member | Until you forget it in your Profile or delete your account (lists are capped: 25 people, 12 open situations, 30 settled ones, 15 notes) |
| Member record (email, tier, status, Stripe customer number) | While you're a member, then [MEMBER RECORD RETENTION] |
| Your birthday and the sign it gives (kept with your profile and your member record) | While you have an account; deleted with it |
| Your Google account number, if you signed in with Google, and the time you confirmed you're 18 and agreed to the terms | With your member record, while you have an account; deleted with it |
| Your profile picture (an icon choice on your member record, or a photo file in private storage) | Until you remove it in your Profile or delete your account; the file is deleted either way |
| Forum posts, comments and messages | Until you delete them or your account; section 6 says what deletion does |
| Private reading recordings | Until I remove them or you delete your account. The video file in storage is deleted when I remove it |
| The sound files and written-down words of a recorded reading, and my letter about it | As long as the recording: they are deleted with it, or when you delete your account [Counsel: or a shorter fixed period for the transcript, e.g. 90 days after the letter is sent] |
| Your choice in the "help teach the Oracle" box | Three years, as a record of what you agreed to; you can change it any time |
| My words that the Oracle learned from your reading (only if you ticked the box) | Until you change your mind, I remove the recording, or you delete your account |
| Counts of thumbs and "did it play out" per line the Oracle used | Kept as numbers only; nothing about who pressed them |
| Gifts (who bought, who for, the message, how it was used) | [PAYMENT RECORD RETENTION], as a payment record; a gift balance stays until it is used or paid out |
| Thank-yous | [PAYMENT RECORD RETENTION], as a payment record |
| Reviews | Until you ask me to take yours down or delete your account; a declined review and its reason for [REVIEW RETENTION] |
| Reiki disclosure acknowledgment | Three years (California Business and Professions Code §2053.6) |
| Your agreement to the membership terms at checkout | Three years (California's automatic renewal law) |
| Your agreement to a recording, when a reading or gathering is recorded | Three years; kept even if you delete your account, as proof of consent |
| Payment records | [PAYMENT RECORD RETENTION], for tax and dispute purposes; held by Stripe |
| Emails you send me | Until the matter is closed, then deleted within [EMAIL RETENTION] |
6. Your choices and rights
You can see and change your Profile at any time, including your picture: Profile → Your picture → Remove my picture deletes a photo the moment you tap it. You can cancel membership in one click from Sanctuary → Membership. You can unsubscribe from marketing email with the link at the bottom of any message. You can delete any reading, note, post or comment you made.
You can delete your whole account from your Profile, or by emailing [CONTACT EMAIL]. Deleting removes your member record, profile, saved readings, recordings (with their files, sound files, written-down words and my letters, and any of my words they taught the Oracle), messages and direct-line history, cancels any membership, and takes your name off your forum posts (the posts themselves are either removed or left under "a former member", your choice at the time). What stays: payment records held by Stripe for the time the law requires, a Reiki acknowledgment for three years, and anything I need to keep to deal with a dispute or a legal duty.
You can ask for a copy of your data, ask me to correct something, or ask what I hold. Email [CONTACT EMAIL]. I'll answer within 30 days, and I won't treat you differently for asking. I'll check it's you by sending a link to the email on the account.
7. California residents
Under the California Consumer Privacy Act you have the right to know what personal information I collect and why, to have it deleted, to correct it, and not to be treated differently for using those rights. Sections 2, 3 and 5 are the notice at collection. I do not sell personal information and I do not share it for cross-context behavioral advertising, so there is nothing to opt out of; if your browser sends a Global Privacy Control signal, nothing changes, because nothing is sold. I don't use or disclose sensitive personal information for anything beyond providing the service. Under the "Shine the Light" law (Civil Code §1798.83), I don't disclose personal information to third parties for their own direct marketing. The site doesn't respond to "Do Not Track" signals because it doesn't track you across sites in the first place. To use any of these rights, email [CONTACT EMAIL]; you may also authorize someone to ask on your behalf.
[Counsel: confirm whether the business meets a CCPA threshold. The rights above are offered either way.]
8. Visitors outside the United States
The site is run from California, and your information is stored and processed in the United States. If you're in the European Union, the United Kingdom or Switzerland: I handle your information to provide what you asked for (contract), because you agreed (consent, for marketing email), for the Oracle's memory of members (part of the member service, on by default, which you can switch off or erase at any time) [Counsel to confirm the basis for EU and UK members: legitimate interests, or consent with memory off by default for them], and to keep the site safe (legitimate interests). You have the rights in section 6, plus the right to object, to restrict processing, to take your data elsewhere, and to complain to your data-protection authority. Transfers to the US rely on standard contractual clauses in the processors' contracts. [Counsel to confirm the posture: serve everyone and comply, or restrict purchases by country.]
9. Children
The site is for adults. I don't knowingly collect information from anyone under 18. If you believe a child has given me information, email [CONTACT EMAIL] and I'll delete it.
10. Keeping it safe
The site runs over HTTPS only. Sessions use a signed, HttpOnly cookie. To slow down anyone guessing, the server counts sign-in attempts by internet address for fifteen minutes at a time. Card numbers never touch my server. When I connect my own calendar, the site reads only when I'm busy and writes the bookings; the password Apple issues for it (an app-specific password, never my Apple password) or Google's access token is stored encrypted, and deleted the moment I disconnect. Admin access is limited to me and the person who maintains the site for me, under confidentiality. If a breach ever affects your information, I'll tell you and the authorities as California law requires (Civil Code §1798.82).
11. Changes
If this policy changes, the date at the top changes with it, and members get an email for anything material. Older versions are available on request.
12. Contact
Healing Tarot Readings ([LEGAL NAME]) · [POSTAL ADDRESS], [CITY], [STATE] · [CONTACT EMAIL]