Privacy Policy

Last updated: 18 July 2026

This Privacy Policy explains how personal data is handled when you use the Taroli mobile application, its reading service, and the related public legal pages (together, the “Service”). The publisher and data controller is identified in the Contact section.

1. What stays on your device

Taroli does not create user accounts or keep a publisher-operated cloud database of your journal. Your saved readings, selected cards, generated interpretations, follow-up questions and answers, language, companion choice, onboarding status, and other app preferences are stored locally on your device.

Taroli disables its own participation in operating-system cloud backup for this local app data. Your operating system may still support a direct device-to-device transfer outside our control. Clearing the app data for Taroli or deleting the App normally deletes the local content, and we cannot restore it.

The App also creates a random installation identifier. It is not based on your name, email address, store account, or advertising identifier. It is stored locally and used to protect the reading service from excessive use.

2. Data processed to provide AI readings

When you request an AI-generated reading or follow-up explanation, Taroli sends the information needed to produce it to our backend. Depending on the feature, this can include:

The request also carries ordinary network information, including your IP address. The backend uses the IP address and a one-way hash of the installation identifier for abuse prevention and rate limiting. These counters are held in temporary server memory for approximately one hour. Taroli does not save reading request bodies or generated responses in a backend database, and application logs record operational results and timing rather than reading content.

Reading data is sent through our backend to OpenAI to generate the requested response. Requests set OpenAI's store option to false. OpenAI may nevertheless retain request and response content in abuse-monitoring logs for up to 30 days under its standard API controls, unless a shorter legally applicable retention control is in place. See OpenAI's API data controls.

Do not include names, contact details, health records, financial details, or other unnecessary sensitive information in a follow-up question.

3. Analytics, configuration, and diagnostics

Taroli uses the following Google Firebase services:

Taroli does not intentionally put tarot reading text, follow-up questions, generated interpretations, names, or contact details into analytics events or crash-report messages. Google describes the information and retention used by these services in Privacy and Security in Firebase.

4. Purchases and subscriptions

Purchases are processed by Apple App Store or Google Play. Taroli does not receive or store your payment-card details.

RevenueCat processes a pseudonymous app-user identifier, product and entitlement identifiers, purchase history, subscription status, renewal and expiry information, and store receipt data so Taroli can provide and restore premium access. We do not connect RevenueCat's identifier to a name, email address, or account in Taroli. See RevenueCat's privacy information.

Apple and Google process purchases under their own accounts, terms, and privacy policies. We may receive transaction and financial reports that must be retained for accounting, tax, fraud prevention, and legal compliance.

5. Contact and service-access data

If you contact us, we process your email address, message, and any information you choose to provide so we can answer you and maintain necessary support or legal records.

Google Cloud hosts the backend and legal pages for Taroli. Like most hosted services, it may process request metadata such as IP address, request time, requested URL, response status, and device or browser information for delivery, security, and operational logging. Reading request bodies are not intentionally included in our operational logs.

6. Why we process data

Where the General Data Protection Regulation (“GDPR”) applies, we rely on:

We do not sell personal data. We do not use personal data for third-party advertising, and Taroli does not make automated decisions that produce legal or similarly significant effects.

7. Service providers and disclosures

We disclose data only as needed to:

These providers process data under their own terms and, where applicable, data-processing agreements with us.

8. International transfers

Some providers may process data outside Poland or the European Economic Area, including in the United States. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses, or another lawful safeguard used by the relevant provider. You may contact us for more information about applicable safeguards.

9. Retention and deletion

When retention ends, data is deleted or anonymized unless continued storage is legally required.

10. Security

We use reasonable technical and organizational safeguards, including encrypted network transport, limited data collection, pseudonymous identifiers, hashing for installation-based rate limits, and avoiding reading-content logging in production. No device, transmission, or storage system can be guaranteed completely secure.

11. Your rights

Depending on applicable law, you may have rights to access, correct, erase, restrict, or receive your personal data, and to object to processing based on legitimate interests. You may also lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) or the competent authority in your country.

You control local data by clearing the app data for Taroli or deleting the App. For data processed by us or our service providers, contact us using the privacy address below. Because Taroli has no account and most remote identifiers are pseudonymous, we may need information sufficient to locate a record, and in some cases we may be unable to connect anonymous data to you.

12. Age requirement

The Service is intended only for people aged 18 or older. We do not knowingly offer it to or collect personal data from children.

13. Changes

We may update this Policy when the Service or legal requirements change. We will publish the revised version, update the date above, and provide additional notice where required by law.

Contact

Andrei Malaev