Privacy Policy
What we collect when you use Taroting, why, who helps us process it, and the choices and rights you have.
Who we are
Taroting (“we”, “us”) is the controller of your personal information. That means we decide how and why it is used, and we are responsible for it. You can reach us about anything in this policy at support@taro-ting.com.
This policy covers the Taroting website and your Taroting account. It works alongside our Terms of Service.
What we collect
What you give us
- Account details: your email address, the name you want us to call you, your password (we only store a scrambled hash of it, never the password itself), your birth year, your time zone, and your theme and card-art preferences.
- What you write: the questions you ask in readings, your journal moods and reflections, your answers to lesson check questions, and your messages to the mentors.
- Messages to us: anything you send to support@taro-ting.com.
What we record as you use Taroting
- Your activity: your quiz answers and archetype, the cards you draw, the readings generated for you, your daily card and streak, lesson progress, the cards in your collection, packs you open, your Duplex history, and how many readings and messages you've used each day.
- Mentor chats: your messages, the mentors' replies, and a short running summary of each conversation (see section 4).
- Subscription: your plan, Stripe customer and subscription IDs, subscription status, renewal date and whether you've used the free trial. We never receive your full card number.
- How you found us: the first time you arrive, we note the campaign tags in the link (UTM parameters), ad click IDs (such as Meta's
fbclidor Google'sgclid), the referring website, the page you landed on and when. If you sign up, this is saved with your account. - Technical data: your IP address, browser and device type, pages requested and times, which our hosting provider logs for security and reliability; and sign-in sessions and rate-limit counters that keep accounts safe.
- Cookies, as described in section 6.
We don't ask for sensitive information such as health details. Your journal and chats are yours to write, so they may include personal things if you choose to share them. We use that content only to provide Taroting to you, never to profile you for advertising.
How we use it, and our legal bases
We use your information only for the purposes below. If you are in the UK or the European Economic Area, the law asks us to name a legal basis for each one.
| Purpose | Information used | Legal basis |
|---|---|---|
| Run your account and the features you use: readings, journal, lessons, collection, mentors | Account details, your activity and content | Contract (providing the service you asked for) |
| Generate AI readings and mentor replies | Your question or message, the cards drawn, and the context described in section 4 | Contract |
| Spot signs of crisis and show support resources | Reading questions and mentor messages | Legitimate interests (keeping people safe) and, in an emergency, vital interests |
| Take payments and manage your subscription | Subscription and billing records (held by Stripe) | Contract; legal obligation (tax and accounting records) |
| Check you are 18 or older | Birth year | Legal obligation and legitimate interests |
| Send password resets and essential service email | Email address | Contract |
| Keep Taroting secure and prevent fraud and abuse (for example rate limits) | Technical data, sessions, usage counts | Legitimate interests |
| Understand which campaigns and pages work | Attribution data, analytics cookies | Consent where required; otherwise legitimate interests |
| Measure our ads on Meta | Pixel and Conversions API events | Consent where required; otherwise legitimate interests, with an opt-out |
| Answer your emails and requests | What you send us | Legitimate interests; legal obligation for privacy requests |
We don't make decisions about you that have legal or similarly significant effects using automated processing alone. Readings and mentor replies are generated automatically, but they are reflections for you to consider, not decisions about you.
AI processing by Anthropic
Readings and mentor replies are written by Claude models from Anthropic, which acts as our service provider (processor). When you ask for a reading or send a mentor a message, we send Anthropic only what it needs to reply:
- For a reading: your question (if you asked one), the cards drawn and their positions, the topic or spread you chose, your archetype, and which cards and openings have come up in your recent readings (so readings don't repeat themselves).
- For a mentor: your message, the last few messages of that conversation, a short summary of your earlier conversation with that mentor, your display name, your archetype and the cards from your last few readings.
- For safety and memory: reading questions and mentor messages may be checked by a smaller Claude model for signs of crisis, and every so often a Claude model rewrites a mentor's conversation summary.
We never send Anthropic your email address, password, birth year or payment details. Under its commercial terms, Anthropic processes this data to provide the service to us, keeps it only for a limited period for safety and abuse monitoring, and does not use it to train its models. Messages flagged as a possible crisis are never sent on to the mentor character. You can read more on our AI & Safety page.
Advertising and analytics, and how to opt out
We advertise Taroting on Facebook and Instagram. To know whether those ads work, we use the Meta Pixel in your browser and Meta's Conversions API from our server. They tell Meta about visits and key actions, such as signing up or starting a trial, together with the _fbp/_fbc identifiers, your IP address and browser details, and sometimes a hashed (scrambled) version of your email address so Meta can match the action to an ad. We use Google Analytics 4 to see, in aggregate, how people use the site.
Where the law requires consent (for example in the UK and EU), these tools only run after you agree. Elsewhere they may run unless you opt out. Either way, you can change your choice at any time:
We honor Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of advertising cookies and of the sale or sharing of your information, and we don't load the Meta Pixel for that browser. You can also adjust ad preferences in your Meta and Google account settings.
Do Not Sell or Share My Personal Information
We don't sell your personal information for money. However, some US state privacy laws (such as California's) treat letting advertising partners like Meta collect information through our site for ad measurement and targeting as a “sale” or “sharing” of personal information, or as “targeted advertising”.
You have the right to opt out of this. You can:
- use the “Your privacy choices” button above or in the footer of every page;
- turn on Global Privacy Control in your browser, which we honor automatically; or
- email support@taro-ting.com with the subject “Do Not Sell or Share”.
In the past 12 months, the categories of personal information we have collected are: identifiers (email address, IP address, cookie IDs, account IDs); commercial information (your subscription); internet activity (pages you visit on Taroting and how you found us); approximate location derived from your IP address and time zone; and the content you write. The only categories that may be “shared” for advertising are identifiers and internet activity, shared with Meta and Google. We don't use or disclose sensitive personal information for any purpose other than providing Taroting to you. We don't knowingly sell or share the personal information of anyone under 16, and Taroting is for adults only.
How long we keep it
| Information | How long |
|---|---|
| Your account and everything in it (profile, readings, journal, lessons, collection, Duplex, mentor chats and summaries, attribution) | Until you delete your account or ask us to. Then it is deleted from our live database straight away and drops out of our database backups within 30 days. |
| Sign-in sessions | 30 days after you were last active, or until you sign out. |
| Password reset links | They expire after a short time and can be used only once. |
| Billing records (held by Stripe) | As long as tax and accounting law requires, usually up to 7 years. These never include your full card number. |
| Server logs (held by Vercel) | A short period, typically days and no more than 30 days. |
| Emails you send us | Up to 2 years after your request is resolved, unless the law requires longer. |
| Cookies | As listed in section 6. |
Your rights, and how to use them
Depending on where you live, you have some or all of these rights. We give everyone the same core choices, wherever they are:
- Access and export: get a copy of your data. Use the download option in Settings, or ask us.
- Correction: fix information that's wrong. Most details can be changed in Settings; email us for anything else.
- Deletion: delete your account and its data. Use the delete option in Settings, or ask us.
- Objection and restriction: object to processing based on our legitimate interests, or ask us to limit how we use your data.
- Withdraw consent and opt out: change your cookie and advertising choices with “Your privacy choices”, at any time. This doesn't affect anything we did before.
- Portability: receive your data in a machine-readable format (the Settings download).
- Non-discrimination: we won't treat you differently, or charge you more, for using any of these rights.
How to make a request
Use Settings for downloads and deletion. For anything else, email support@taro-ting.com from the email address on your account (so we can confirm it's you) and say what you'd like. An authorized agent may make a request for you with your signed permission; we may still ask you to confirm your identity. Requests are free. We reply within one month (or 45 days where US state law sets that deadline), and we'll tell you if we need longer, as the law allows.
Appeals and complaints
If we decline your request, you can appeal by replying to our decision with the word “Appeal”; someone who wasn't involved in the first decision will review it and reply within the time the law allows. If you're still unhappy, you can contact your state Attorney General (in the US) or complain to your data protection authority (for example the Information Commissioner's Office in the UK, or the supervisory authority where you live in the EU). We'd appreciate the chance to sort it out with you first.
Children
Taroting is only for adults aged 18 and over. We ask for your birth year at sign-up and refuse anyone younger. We don't knowingly collect personal information from children or anyone under 18. If we learn that an account belongs to someone under 18, we delete it and its data. If you think a young person has an account, please tell us at support@taro-ting.com.
Security
- The whole site is served over HTTPS, and browsers are told to always use a secure connection.
- Passwords are stored only as salted scrypt hashes. Sign-in sessions use random tokens kept in secure, HTTP-only cookies, and we store only hashes of those tokens too.
- Payments are handled entirely by Stripe, which is certified to the PCI DSS standard for card data.
- Access to production systems is limited to the people who need it to run Taroting.
No system is perfectly secure, so please use a strong password you don't use anywhere else. If a security incident affects your personal information, we'll tell you and the relevant authorities as the law requires.
International transfers
Our service providers mainly store and process data in the United States, and some operate worldwide. If you are in the UK, EEA or Switzerland, your information may be transferred to countries whose data protection laws differ from yours. When that happens, we rely on safeguards the law recognizes, such as the European Commission's Standard Contractual Clauses (with the UK addendum) or a provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. You can ask us for more information about these safeguards.
Changes to this policy
We'll update this policy when our practices or the law change. The date at the top shows the latest version. If we make a change that materially affects how we use your information, we'll tell you by email or with a notice on the site before it takes effect and, where the law requires, ask for your consent.
Contact us
Email support@taro-ting.com with any question about this policy or your information. More ways to get help are on our Contact page.