✦ KARTIYA

PRIVACY POLICY

Kartiya · Tarot of the Veiled Hours · Effective date: 19 June 2026

This Privacy Policy explains what information the Kartiya app ("Kartiya", "we", "us") collects, how we use it, and the choices you have. By using Kartiya, you agree to this Policy.

We built Kartiya to need as little personal information as possible. You can use the app anonymously, with no account. If you choose to create an account, to save and sync your readings across your devices, we collect your email address and password as described below. We do not ask for your name or a social login.

INFORMATION WE COLLECT

A device identifier. The first time you open the app, we generate a random identifier (for example, "kd-…"). It is stored on your device and sent with requests so we can track your daily free readings, your subscription status, and your reading history. It is not your name, phone number, email, or advertising ID, and it is not designed to identify you personally.

Account details (optional). If you create an account, we store your email address and a securely hashed version of your password. We never store your password in plain text. We use them to sign you in, verify your email, let you reset your password, and sync your readings across your devices. None of this is required to use Kartiya anonymously.

Your readings. When you ask for a reading, we receive and store the question you type (if any), the spread you chose, the cards drawn, the reading that was generated, and any follow-up questions and answers, together with timestamps. This lets us show your reading journal and enforce the free-tier limits. If you are signed in, your readings are linked to your account so they appear on any device where you sign in.

Time zone. We send your device's time-zone offset so daily free readings reset at your local midnight rather than at UTC.

Subscription information. If you buy Kartiya Plus, our payments partner (RevenueCat) and the app store process your purchase and tell us your subscription status. We do not receive or store your full payment-card details; those are handled by the app store.

Technical data. Like any internet service, our servers automatically receive technical information such as your IP address and basic request logs, used for security, abuse prevention, and reliability.

We do not use third-party advertising or tracking SDKs, and we do not sell your personal information.

HOW YOUR READINGS ARE GENERATED

To create a reading, we send your question, the chosen spread, and the drawn cards to our servers and to a third-party artificial-intelligence (large language model) provider that generates the text. This request carries no identifier: the provider does not receive your device identifier. The provider processes the content on our behalf to return your reading. Please avoid entering information you would not want processed this way, and do not submit other people's sensitive personal data.

HOW WE USE INFORMATION

We use the information above to: provide readings and save your reading journal; enforce daily free-reading limits; manage subscriptions and restore purchases; operate, secure, debug, and improve the app; and comply with our legal obligations.

WHO WE SHARE IT WITH

We share information only with service providers who help us run the app, and only as needed:

Account verification and password-reset emails are sent from our own self-hosted mail server, not a third-party email provider, and we do not send you marketing email.

We may also disclose information if required by law, or to protect our rights, our users, or the public.

WHERE DATA IS PROCESSED

The app communicates with our servers (at kartiya.wleeaf.dev) and with the providers above, which may be located in countries other than yours. Where required, we rely on appropriate safeguards for any international transfer.

HOW LONG WE KEEP IT

We keep your readings until you delete them, or until they are removed as part of routine maintenance. You can delete individual readings from within the app. Technical logs are kept for a limited period. If you stop using the app, we may delete the associated data after a period of inactivity.

YOUR CHOICES AND RIGHTS

You can delete individual readings at any time from within the app. If you have an account, you can permanently delete it, and all data associated with it (including your synced readings), from within the app under your account settings, or by contacting us. Step-by-step instructions are at https://kartiya.wleeaf.dev/data-deletion.html.

Depending on where you live (for example, under the GDPR or the CCPA/CPRA), you may have rights to access, correct, delete, or port your data, to object to or restrict certain processing, and to withdraw consent. Because we identify your data only by the random device identifier, please contact us from the device in question, or provide that identifier, so we can locate your data. To make a request, contact us at [email protected]. We do not sell or "share" personal information for cross-context behavioural advertising.

CHILDREN

Kartiya is intended for adults (18 and older) and is not directed to children or minors. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with information, contact us and we will delete it.

SECURITY

We use reasonable technical and organisational measures to protect information, including encrypting data in transit between the app and our servers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

CHANGES TO THIS POLICY

We may update this Policy from time to time. We will update the effective date and, where appropriate, notify you in the app.

CONTACT

For privacy questions or requests, contact us at [email protected].