Privacy Notice

Controller: Paweł Brzozowski, operating Tarotle. Privacy contact: support@tarotle.com. Tarotle is a personal hobby project operated by Paweł Brzozowski.

Your private question and context stay in this browser. We send only the selected general topic, canonical spread, cards and language through our server and OpenRouter to the model provider to fulfil your reading request (contract/requested service). We request zero-data-retention routing and disabled provider data collection. OVHcloud hosts our server in Poland (EU). Keyed pseudonymous browser/network identifiers enforce the 24-hour free limit (legitimate interest in abuse prevention). If you use a promotion code, keyed pseudonymous browser/network identifiers and a signed entitlement are stored to enforce one use (legitimate interest in abuse prevention). Optional server-side aggregate analytics runs only after consent. Support processes the email and message you send (requested service and legitimate interest); support messages are forwarded to the operator's mailbox to be answered. If you request reading delivery, the reading and your email pass through our server and our own SMTP mail server hosted with OVHcloud (no separate mail-sending company), then the recipient's mail provider. The application does not keep the recipient address in its records, and we do not subscribe you to marketing; the mail server's delivery log records the address and delivery status for up to 30 days. Our server also keeps technical mail and security logs, which can include IP addresses and, for requested emails and support messages, email addresses; we use them for delivery troubleshooting, security and abuse prevention (legitimate interest) and keep them for up to 30 days. The AI routing and model providers may process data outside the EEA; contact support@tarotle.com for available information or a copy of applicable transfer safeguards. We do not sell data or make legal or similarly significant automated decisions. When analytics is allowed, our server briefly processes the IP address and browser user agent to make a keyed visitor hash; raw IP addresses and user agents are not kept in analytics records.

Reading metadata and email-delivery reservations: 30 days; the recipient email is not stored in the reservation. Server mail and security logs: up to 30 days. Free-use identifiers: 48 hours after consumption, deleted on a five-minute cleanup schedule. Promotion records: 30 days, deleted on the same five-minute schedule. Analytics visitor hashes: 35 days; aggregates: 396 days (13 months). Open support tickets: 365 days; closed: 90 days. Browser reading history and private notes remain until you clear them. Cookies: free quota 48 hours, chosen language 365 days, privacy decision 180 days, promotion entitlement and promotion browser identifier up to 30 days. Encrypted disaster-recovery backups are kept for up to 7 days, with a daily expiry sweep allowing up to 1 additional day. Restores run current deletion rules and reapply later erasure requests before reopening the site.

You may request access, correction, deletion, restriction, portability, or object to legitimate-interest processing; withdraw analytics consent at any time; and complain to the Polish data protection authority (UODO) or your local authority. Email support@tarotle.com. We may need to verify the browser or email connected with the request. We normally respond within one month.