Privacy Policy

We collect only what Arcanoir needs to work: account data, your birth date for calculations, your questions and spreads. We do not sell data, show no ads and do not use your questions to train AI models.

The data controller is Arcanoir, postal address available on request. For any question about your data, write to support@arcanoir.vercel.app.

• Account: the name you gave, your e-mail, a password hash (we never see the password itself) or your Google account identifier if you sign in with Google.
• Profile: birth date, interface language and time zone, if you provided them. The birth date is needed for numerology, Su-Jok and your personal seal.
• Spreads: the question text, the chosen spread, the cards drawn, the date used for the calculation, the AI reading text and journal notes.
• Credits and purchases: balance, history of grants and spends, purchase details — pack, amount, currency, status and Stripe payment identifiers. We never receive your card number.
• Community: the topics and replies you publish, with your name and the date.
• Technical data: IP address, browser and device type, request times and the session cookie — to run and protect the service.
• Visit statistics — only with your consent, anonymised, without cookies.

Questions for a spread sometimes touch on health, relationships or beliefs — these are special categories of data. We process them only because you wrote them yourself, and only to prepare the reading and keep it in your journal. By sending such a question you give your explicit consent to this; you can withdraw it by deleting the spread.

If you prefer not to share details, phrase the question in general terms — the reading will still be useful.

• Account, calculations, AI readings, journal, credit purchases — performance of our contract with you (Art. 6(1)(b) GDPR).
• Payment records — our obligation under tax and accounting law (Art. 6(1)(c)).
• Security, fraud and abuse prevention, community moderation — our legitimate interest (Art. 6(1)(f)).
• Visit statistics — your consent (Art. 6(1)(a)); you can withdraw it at any time.
• Questions touching on health and other special categories — your explicit consent (Art. 9(2)(a)).

When you start an AI reading, we send the Claude model (Anthropic) through Vercel AI Gateway only what the text needs: the question, the spread and its positions, the cards drawn, the language and, if you provided it, your birth date. The model does not receive your name, e-mail or payment data.

Under the provider’s terms, data sent through the API is not used to train models. The provider may keep requests for a limited time to detect abuse.

The AI does not make decisions about you with legal or similarly significant effects: a reading is a text for reflection.

We do not sell data or pass it to advertising networks. It is received only by processors that help the service run, under data processing agreements:

• Vercel Inc. (USA) — site hosting, page delivery, request logs, anonymised visit statistics, and Vercel AI Gateway, which routes requests to the AI model.
• Neon — the Postgres database; data is stored in a data centre in the European Union (Frankfurt, Germany).
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA) — payments and fraud prevention. Stripe receives card data directly and, for that data, acts as an independent controller under its own privacy policy.
• Anthropic PBC (USA) — the Claude model that writes AI readings.
• Google LLC — only if you sign in with Google: we receive your name, e-mail and account identifier from Google.

We disclose data to public authorities only when the law requires it, and only to the extent necessary.

Some processors are in the USA. Transfers there rely on the European Commission’s adequacy decision (EU–US Data Privacy Framework) for certified companies, or on the Standard Contractual Clauses approved by the Commission.

• Account, profile, spreads and notes — for as long as the account exists. After you delete your account we erase them within 30 days, and from backups within 90 days at the latest.
• Spreads made without signing in are not linked to a person; we keep them for no longer than 12 months unless a public link was created for them.
• A public link to a spread works until you turn it off or delete the spread.
• Topics and replies — until you delete them or your account.
• Payment records and credit history — as long as tax and accounting law requires (usually up to 10 years), even after the account is deleted.
• Technical logs — up to 30 days.

You can get a copy of your data, correct inaccurate data, have your data erased, restrict processing, receive your data in a machine-readable format and move it to another service, object to processing based on legitimate interest, and withdraw consent at any time — this does not affect the lawfulness of processing before the withdrawal.

To exercise a right, write to support@arcanoir.vercel.app from the address linked to your account. We will reply within one month; in complex cases this may be extended by two further months — we will tell you in advance.

You also have the right to lodge a complaint with a data protection authority in the country where you live, work, or where you believe the violation took place.

Connections to the site are encrypted (HTTPS), passwords are stored only as hashes, and access to the database is restricted. If a breach occurs that may affect your rights, we will notify the supervisory authority and you within the time limits set by law.

The service is not intended for people under 18, and we do not knowingly collect their data. If you learn that a child has created an account, write to us and we will delete it.

Which cookies we use and how to change your choice is described in the Cookie Policy.

We update this policy when the way we process data changes. The date of the current version is shown at the top of the page; we will announce material changes in advance on the site or by e-mail.

Data questions: support@arcanoir.vercel.app. Postal address: Arcanoir, postal address available on request.