☾ The Free Tarot

Privacy Policy

The Free Tarot · Effective 2026-10-12 · Version 1.3 · Effective: 2026-10-12

SUN CHEN (individual operator; privacy contact: support@thefreetarot.com) respects your privacy. This policy explains what data we collect when you use The Free Tarot (https://thefreetarot.com), how we use it, and your rights.

1. Information We Collect

  • Account Data: Email address, optional display name, and a PBKDF2 salted password hash (we never see or store plain-text passwords).
  • Reading History (signed-in users only): Spreads, questions, drawn cards, and in-depth readings. Guest questions are processed in real time and not stored.
  • Subscription Status: Plan status, renewal dates, and order IDs sent by Waffo Pancake. We never receive or store your payment card numbers.
  • Security & Analytics: Session IP and User-Agent, brute-force and daily quota counters, and cookie-free aggregated traffic metrics via Cloudflare Web Analytics.

2. Cookies & Infrastructure Providers

  • Strictly Necessary Cookies: We use only `tarot_sid` (30-day session cookie) and an anonymous guest quota cookie. We use no advertising or tracking cookies.
  • Cloudflare: Provides secure hosting, D1 database, Turnstile security verification, and cloud computing infrastructure (your prompts are never retained for external training).
  • Waffo Pancake (Merchant of Record): PCI-DSS-compliant payment controller handling checkout, tax, invoicing, and subscription management.
  • Resend (email delivery): sends sign-up codes, password-reset codes, and support replies. We share the recipient email address and message content. Privacy policy: https://resend.com/legal/privacy-policy.

3. Data Retention & Your Rights

  • You have the right to access, correct, export, or delete your personal data. Delete individual readings anytime in My Account, or email support@thefreetarot.com to delete your entire account (removed within 30 days).
  • Rate-limit logs expire within 1–7 days; order records are retained for up to 7 years for tax and accounting compliance. We never sell personal data. Version 1.3, effective 2026-10-12.