Privacy Policy

This policy covers tarot.ac and every language version of it, together with the country and city portals we publish under the same domain.

This policy is published in every language the site supports. The English text is the original one, and where a translation differs from it the English governs, unless the law of your own country says otherwise.

It does not cover sites we merely link to. Our library points at outside resources, members link to their own pages, and our accounts on Facebook, Instagram, YouTube, TikTok and Threads live on those companies' platforms under their rules. Once you leave tarot.ac, the site you land on decides what happens to your data.

To open an account. A username, an email address and a password. The username is public, because it is how other members find you. The password is stored only as a cryptographic hash, so nobody here can read it, including us.

Optional account details. A telephone number, a date of birth, a country and city, and a profile photo. The date of birth exists because numerology and astrology features are calculated from it, and because our minimum age is sixteen. Leave any of these blank and the account still works.

Your public profile. A first and last name, a description of your practice, a public email address, a public telephone number, and links to your accounts on Facebook, Instagram, TikTok, YouTube, Messenger, WhatsApp, Telegram, Pinterest, Threads and X. Every one of these fields is optional, and every one of them is published when you fill it in.

Listings. If you publish a service, a product, a business entry or an event, we store what you wrote, the price and currency you set, and the images you uploaded.

Learning. Your progress through a course, the answers you give in lesson tests, and what you write in the open reflection questions.

Messages. Emails you send to support, messages you send other members through our contact forms, and the conversations you have with our AI assistant features.

The newsletter. If you subscribe, your email address.

Session data. When you sign in we store a session record that holds your IP address, your browser's user-agent string, the time you were last active, and an identifier kept in a cookie on your device.

Account creation data. When you create an account, by email or with Google, we save one record about the visit you signed up from. It holds your IP address and the country, region, city and time zone that our network provider, Cloudflare, derives from it; the language you were using on the site and the languages your browser says you prefer; your browser's user-agent string, your operating system, whether the device is a mobile one, its screen and window size, whether it supports touch, the time zone your browser is set to and whether it asks for a light or dark colour scheme; and how you reached us, meaning whether you signed up by email or with Google, the address of the page that linked you to the sign-up page, and any campaign tags (UTM parameters) in the sign-up page's address. If your account existed before we started keeping this record, we make it the next time you sign in, or fill it from the IP address and user-agent already held in your session record.

We use this record to see which countries and languages our members come from, so we know which translations and regional content to work on first. We also use it to make the site work on the devices members actually use, to see which channels bring members to us, and to detect abuse and duplicate sign-ups. We do not ask your browser or device for your precise location, we do not fingerprint your device (no canvas, audio or font probing), we do not build an advertising profile from this record, and we set no additional cookie for it.

Server logs. Our servers record requests in the ordinary way, including the address requested, the response, the time and the requesting IP address. We use these to keep the site up and to investigate abuse.

Analytics and measurement. See Cookies, analytics and pixels below for exactly which scripts run and how to stop them.

We do not track your location beyond the country and city level a network address implies, and we do not build advertising profiles of our members ourselves.

You can create an account with Google instead of a password. If you do, Google sends us your Google account identifier, your name, your email address and your profile picture, and we store them so we can recognise you next time.

We ask Google for nothing else. We cannot read your Gmail, your Drive or your contacts. What Google does with the fact that you signed in here is governed by Google's own privacy policy, not by ours.

Tarot Academy is a directory as well as a library, so some of what you enter is meant to be seen.

Public to anyone, including search engines and AI crawlers: your username, your profile page and everything you put on it, the services, goods, businesses and events you publish, and the country or city you are listed under.

Never public: your password, your login email address, your session and log records, your course answers and progress, your support correspondence, and any field you left empty.

Your login email address and your public email address are two different things. We publish the second one only, and only if you enter it.

A public profile can be picked up by search engines and by the crawlers that feed AI assistants. We cannot pull a page back out of someone else's index once it has been copied. If you want a profile or listing taken down, email [email protected] and we will remove it from the site.

European and UK law requires us to name a lawful basis for each purpose. Here they are.

Where we rely on legitimate interests, we have weighed our interest against yours and you may object at any time using the contact details at the end of this page.

Cookies we set ourselves. A session cookie that keeps you signed in, a token used to protect forms against cross-site request forgery, and a record of the language you chose. These are necessary for the site to function and they carry no advertising identifier.

Google Analytics 4. Measurement identifier G-7BC02E5GZ9. It records which pages are read, roughly where in the world the reader is, and which site sent them, using its own cookies.

The Meta Pixel. It reports visits to Meta so we can measure how our posts and campaigns perform, using Meta's cookies.

We want to be straightforward with you about the current state of this: both scripts load on every page today, before any consent banner. We are building a consent control and this section will be rewritten the day it ships. Until then you can refuse them yourself, and these methods work now:

• Block or delete cookies in your browser's settings, or browse in a private window.
• Install Google's official Analytics opt-out add-on.
• Turn on the "Do Not Track" or Global Privacy Control setting in a browser that offers one.
• Adjust what Meta may do with off-platform activity in your Facebook or Instagram account settings.
• Use any reputable content blocker, which will stop both scripts outright.

Blocking all of them leaves the site fully usable. Nothing on tarot.ac requires an advertising cookie to work.

We use a small number of companies to run the service. They act on our instructions and may not use your data for their own purposes.

Besides those, your information reaches:

• Other members and the public, but only the parts you chose to publish.
• Authorities, where a valid legal order compels us, and no further than it compels.
• A buyer or successor, if the company is ever sold or merged, in which case this policy travels with the data and we will tell you before anything changes.

We have never sold personal information for money and we do not intend to start.

We are a United States company, so data you send us is processed in the United States, and some of our providers store it in Europe.

For transfers of European and United Kingdom personal data to the United States, we rely on the European Commission's Standard Contractual Clauses and the UK Addendum to them, together with the technical measures described under Security. You may ask us for a copy of the safeguards that apply to your data.

Your account stays until you close it. Ask us to delete it and we delete the account record and the personal data behind it, keeping only what we must for accounting and legal claims, which we hold for six years and use for nothing else.

Sessions expire on their own and are cleared out with them.

Account creation data stays with your account and is deleted when the account is deleted. The IP address in it is deleted sooner, after twelve months.

Server logs are kept for up to twelve months.

Newsletter subscriptions last until you unsubscribe, after which we keep the fact that you unsubscribed so we do not email you again by mistake.

Anything you published disappears from the site when you delete it or when we delete your account. Copies already made by search engines, AI crawlers or other readers are outside our control.

Wherever you live, you may ask us to show you what we hold, correct it, or delete it, and we will do it.

If you are in the European Economic Area or the United Kingdom, the law spells those rights out: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, objection to direct marketing at any time, and the withdrawal of a consent you gave earlier without affecting what was done before you withdrew it.

To exercise any of them, write to [email protected]. We answer within one month. If your request is unusually complex we may take a further two months, and we will tell you why within the first month. We do not charge for this, and we will not make your account worse because you asked.

We may need to check that the request really comes from you. Usually, sending the request from the email address on the account is enough.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to your national data protection authority, and in the United Kingdom to the Information Commissioner's Office.

Over the past twelve months we have collected the categories of personal information described in Information you give us and Information we collect automatically: identifiers, account and contact details, commercial information about listings, internet activity, approximate location inferred from a network address, and the content you write. We collect it from you and from your device, for the purposes set out above, and we disclose it to the providers listed in Who else sees it.

We do not sell personal information, and we have not in the last twelve months. We also do not knowingly sell or share the personal information of anyone under sixteen.

The Google Analytics and Meta advertising scripts described above may amount to sharing for cross-context behavioural advertising as California defines it. You can stop that yourself with any of the methods in the cookies section, or email [email protected] with the subject "Opt out of sharing" and we will exclude your account from advertising measurement.

Californian residents may also request to know, to delete, and to correct, and may not be treated worse for asking. An authorised agent may act for you if you give them written permission and we can verify it.

You must be at least sixteen to hold an account here. We do not knowingly collect personal data from anyone younger.

If you are a parent or guardian and believe a child under sixteen has created an account, write to [email protected] and we will delete it and the data behind it.

Parts of this library, especially the translations behind its fifty-two languages, are produced with AI assistance and reviewed before publication. That process uses our own content, not yours.

Where a feature invites you to type something to an assistant, the text you type is sent to the AI provider named above so it can answer, and we store the conversation so you can return to it. Please do not put health details, financial details, passwords or anything else sensitive into those boxes. Ask us and we will delete a conversation.

We do not use your private account data to train AI models, and our providers are contractually bound not to train on data we send them through their business interfaces.

Passwords are stored as salted hashes and never in a readable form. Traffic to the site runs over TLS. Access to production systems is limited to the people who need it, and file storage is private by default.

No service can promise perfect security, and we will not pretend otherwise. If a breach ever puts your rights at risk, we will notify you and the relevant authority within the deadlines the law sets.

When this policy changes we update the date at the top of the page. If a change matters to you, for example a new purpose or a new category of recipient, we will say so on the site and, where the law requires it, ask you again.

We keep earlier versions. Ask [email protected] if you want to see the one that applied on a particular date.