Last updated: 2026-10-16
This document reflects every data-collecting integration actually shipped in the app as of this date: Mistral AI for AI insight (live), Google AdMob for ads (live ad units; iOS App ID still Google's test ID until the Apple Developer account exists), PostHog for analytics (live), and RevenueCat for subscriptions (live — purchases go through real App Store/Google Play billing). Update this document again as that connection status changes. It is hosted at a stable public URL and linked from the app's settings screen, the store listing, and the paywall (see app/(tabs)/settingsscreen.tsx and components/PaywallModal.tsx).
Real Tarot is an entertainment and self-reflection app. It is not a source of medical, legal, financial, or psychological advice.
The following is stored locally on your device, using your operating system's storage, and is not transmitted anywhere unless stated otherwise below:
You can clear your reading history at any time from the History screen. Uninstalling the app deletes all locally stored data on the device.
History export. In Settings you can save your reading history (and a few settings: language, theme, font, reminder time) to an encrypted file and restore it later, for example on a new phone. The file is created only when you ask, and you choose where it goes (the system share sheet); we do not receive it. The file is encrypted, which keeps it from being read casually or opened by other programs, but it is not a substitute for keeping it private: store and share it as you would any personal file. Importing a file you received from someone else only adds readings to your history after the app has checked that the file is valid.
Device backup. On Android, the operating system may include the app's local data (for example your reading history and settings) in your device's automatic backup to your own Google account (Google Drive), if you have device backup turned on. That backup is created and stored by Google under your Google account, not by us, and we cannot access or delete it. It lets your history come back if you reinstall the app or move to a new phone. To remove it, delete the app's backup in your Google account settings (Google One / Drive → Backups) or turn device backup off. "Delete all my data" in Settings clears the data on your device but does not delete an existing backup copy held by Google.
Personal details you choose to give. In the first-run setup and in Settings you may optionally give your first name, your birth date, the form of address you prefer (feminine, masculine or neutral) and the topics you are interested in. All of this is optional, is stored only on your device, can be changed or removed in Settings at any time, and is erased by "Delete all my data" (they are also part of the Android device backup described above, which that button cannot delete). Of the birth date, only the zodiac sign derived from it is ever sent anywhere — the date itself never leaves your device. Your first name, your zodiac sign and your form of address are sent together with the reading data to our proxy server and on to our AI provider (Mistral AI) when you ask for an AI analysis, a week or month review or a chat answer, so that the text can address you personally and use correct word endings; they travel the same path and are handled in the same way as the reading data described below. Your interests are used only inside the app to choose which suggested questions are shown first and are not sent.
the cards in that reading (names, orientation, and the position each card is in), the spread name, your chosen category, and your interface language are sent to our proxy server (a Cloudflare Worker we operate) and then to our AI provider, Mistral AI (a company based in France, in the EU), to generate the personalized interpretation you asked for. This specific data is processed to fulfil the analysis you explicitly requested (GDPR Art. 6(1)(b), for EU/EEA/UK users). Separately, an anonymous, randomly generated per-install device id (utils/deviceId.ts — on Android this is Settings.Secure.ANDROIDID, scoped to this app; it is not your name, email, or any account identifier, since the app has no accounts) is sent to our proxy so it can enforce a daily free-usage limit and prevent abuse. This id is processed under our legitimate interest in preventing abuse of a free, metered feature (GDPR Art. 6(1)(f)). The device id is never sent to Mistral — Mistral only receives the reading content described above. Shared "Tarot + Dreams" subscription. On Android the app also sends our proxy Google Play's app set ID, an identifier that Google Play services give all apps of one developer on one device and that you can reset by clearing Google Play services data. Our other app, Real Dreams, sends the same value from the same device, so a "Tarot + Dreams" subscription bought in either app works in both on that device. We store only the app set ID, the app's name and the anonymous device id of each app, with the date of the last update. It is not linked to your name, email or Google account, is never sent to Mistral, and is deleted after 400 days without use. We process it to recognise a subscription bought in either app: for subscribers to provide what they paid for (GDPR Art. 6(1)(b)), for everyone else under our legitimate interest in making that work without accounts or logins (GDPR Art. 6(1)(f)). We have disabled Mistral's setting that would otherwise let it use API traffic to train its models — your reading content is not used for that purpose. Mistral's own documentation states that, without this opt-out disabled and without their separate Zero Data Retention option enabled (which we do not currently have), it keeps request and response content for a limited time — up to 30 days — for abuse-prevention purposes; we do not claim your reading content is not stored at all, only that it is not used to train Mistral's models. See Mistral's Privacy Policy and Commercial Terms of Service for Mistral's current, authoritative wording on retention and processing — we do not restate this as a permanent guarantee because Mistral can change it without notice to us. A short notice describing this data flow is shown once, in the app's initial disclaimer, before you can use the app. Week and month review (Real Tarot+). When a subscriber taps the review of the last week or month — never automatically — the readings from that period are sent the same way: for each reading its date, spread name, chosen category, and the cards with their positions and orientation, up to 40 readings, plus your interface language. The AI texts of earlier insights and any identifiers other than the anonymous device id are not included. The device id and Real Tarot+ status are checked by our proxy only (a review is limited to a few per day); Mistral receives only the reading content. Everything above about Mistral's handling applies to the review too. Chat about a reading. After an AI analysis you can ask the tarot reader follow-up questions — only when you write one and tap send. Each question is sent with the reading (card names, positions, orientation, spread, category), the AI analysis you already received, up to the last eight lines of the conversation and your interface language, through our proxy to Mistral AI, the same way as an analysis. Whatever you type is sent, so please do not write personal data such as names or contact details. The conversation is saved only on your device, together with the reading in your history, and is included in a history backup file you create yourself; our server and the proxy do not store the text. The proxy keeps only counters: the anonymous device id with a daily question count, and a daily count per network address, kept as a short one-way hash of the address (not the address itself), to stop abuse. If you tap "Report this answer" under a reply, we receive the reason you chose and a short hash of the reply, not its text, stored with the anonymous device id and the date and deleted after 90 days. A question that clearly expresses thoughts of self-harm is answered by our proxy with a fixed supportive text: it is not sent to the AI provider, neither now nor in the later questions of that conversation. "Delete all my data" erases the saved conversations with your history. Everything above about Mistral's handling and the age requirement applies to the chat too. "Delete all my data" in Settings clears the locally cached copy of the device id, but on Android the underlying value (Settings.Secure.ANDROIDID) is an OS-level identifier scoped to this app and does not actually change until the device is factory reset — so a new insight request after using "Delete all my data" will read the same id back from the OS rather than generate a new one. On iOS, the identifier (identifierForVendor) can change if Real Tarot becomes the only app installed from its vendor and is then reinstalled, but "Delete all my data" alone does not reset it either. To reduce how often this happens, identical readings (same cards, orientations, positions, category, and language) reuse a response cached on your device instead of contacting the proxy again — see utils/aiInsight.ts.
unlock one extra AI insight past the daily limit) or an interstitial ad after a shuffle animation; Real Tarot+ subscribers never see ads. AdMob may collect your advertising identifier (IDFA on iOS / advertising ID on Android), IP address, and general device information to select and measure ads; ads currently requested by this app are non-personalized, and AdMob's own privacy policy governs its processing. If you are in the European Economic Area, the United Kingdom, or Switzerland, the app first shows Google's consent form (Google User Messaging Platform, "UMP") and does not request ads until you have answered it; you can review or change your answer at any time under Settings → "Ad privacy settings" (shown only in those regions, and only while ads are enabled). Outside those regions no consent form is shown. On iOS, this triggers Apple's App Tracking Transparency prompt only if that changes to personalized ads in the future — it does not today.
completed, paywall viewed, subscription started) are collected to understand how the app is used and improve it. Events include which spread/category/deck-skin option you interacted with, never the actual card names drawn or the content of an AI insight. Events are tied to an anonymous installation identifier, not your name or email.
purchase is processed entirely by the App Store or Google Play — we never see or store your payment details. RevenueCat receives your purchase receipt and an anonymous app-user id to validate the purchase, keep your subscription status in sync across devices, and power "Restore Purchases"; see RevenueCat's own privacy policy for how it processes that data.
your anonymous device id to our proxy server so we can count how many days in a row you came back. The server keeps only that device id, the date of your last check-in and the length of the streak, and uses them to give free readers a few bonus chat questions (3 days in a row: +1, 7 days: +2). A streak row is deleted automatically after 60 days without a check-in, and "Delete all my data" gives the app a new device id, after which the old row is no longer linked to you.
in distress, the chat answers with a fixed supportive message and a helpline number for your country. The country is taken from the network connection by our server provider (Cloudflare) or, as a fallback, from your phone's region setting (a two-letter code the app sends with the question). It is used only to choose that phone number and is not stored.
once per language per day and is identical for everyone; it is generated without any of your data (only the app language is sent) and nothing about you is stored with it. You can report it with the flag next to it.
For the processing described above, Night Orbit Studio (the developer of Real Tarot) is the controller. Mistral AI, Google (AdMob), Cloudflare (our proxy server), PostHog, and RevenueCat act as processors/subprocessors, each under their own terms and privacy policy. Mistral AI is based in France (EU), so AI-insight processing itself does not involve a transfer outside the EU/EEA; some of the other providers may process data outside your country, including outside the EU/EEA/UK — where that applies, they rely on their own safeguards (such as Standard Contractual Clauses) — see each provider's own documentation for details, since we do not control or independently verify their specific transfer mechanism.
Real Tarot is entertainment content about tarot reading and is not designed for, or directed at, children — it is not listed as a children's or "Designed for Families" app on any store. We do not knowingly collect personal information from children under 13 (or the applicable age of digital consent). The app has no accounts and asks for no email; the only personal detail it can hold is a first name you choose to type in (see "Personal details you choose to give" above), which is optional. Separately, our AI provider's own terms require that minors only use products built on their API with adequate parental or guardian consent — we do not currently have a dedicated consent flow for this beyond the general disclosure in the app's initial disclaimer and this policy, a known gap the developer is tracking (see ACTION_PLAN.md).
The app has no user accounts, so there is nothing tied to your identity to request or delete by name — only the on-device data described above and the anonymous identifiers used for AI-insight rate-limiting, advertising, analytics, and subscription status. Use "Delete all my data" in Settings to erase your reading history and current draw at any time. On Android, the anonymous id used for the AI-insight daily limit is tied to your device/app installation at the operating-system level (not something our app generates) — it is not reset by "Delete all my data" or by uninstalling and reinstalling the app, only by a full factory reset of the device; this is intentional, to keep the free-usage limit meaningful. On iOS and web, that id is reset the same way as the rest of your local data. Our Cloudflare Worker proxy stores, in a Cloudflare D1 database, only the anonymous device id together with that day's insight count and rewarded-ad bonus count (for the free-usage limit), and a short-lived (a few minutes) cached flag of whether that device has an active Real Tarot+ subscription — not reading content. Daily counter rows are deleted automatically once their day has passed; you do not need to separately request deletion of them. To stop analytics or advertising identifiers from being associated with your device going forward, use your OS-level ad-tracking controls (e.g. "Limit Ad Tracking"/App Tracking Transparency on iOS, "Opt out of Ads Personalization" on Android) and uninstall the app to clear PostHog's local installation identifier. Data already sent to Mistral AI, Google AdMob, PostHog, or RevenueCat is governed by each provider's own retention policy and privacy policy, linked from this document once finalized.
We will update this document as integrations change (e.g. when real AdMob/PostHog/ RevenueCat account credentials are configured, or new features are added), and will update the "Last updated" date above accordingly.