Privacy Policy

Who is responsible for your data

The data controller is Claudio Soares, an individual and the developer of Tarot Club. For any privacy matter, including exercising your rights, write to claudio.soares.dev@gmail.com.

Summary

• Your question and your cards are interpreted on the device itself. They are not sent to any server to be interpreted.
• The readings you keep in your journal live in your account, protected so that only you can access them.
• You can export your data or delete your account with its whole history from within the app.
• We do not sell personal data and do not use it to profile you.
• We measure app usage only through anonymous event counts, without reading the content of your questions, cards or notes.

What stays on your phone only

Madame Celeste's interpretation uses an artificial intelligence model that runs on the device. To do so, the app downloads, once, a file of about 1 GB hosted on Hugging Face. During that download, as with any connection, the server receives technical data such as your IP address; no question or card is sent.

On phones that cannot run this model, the app may use the system's own AI (such as Gemini Nano, when available), which also runs on the device, or the base reading with the cards' traditional meanings.

Appearance preferences (theme and card style) and the data needed to work offline are stored on the device only. Read-aloud uses your system's text-to-speech.

What data we process and why

• Account: name, email and password (the password is managed by Firebase Authentication and is not visible to us). Used to create and protect your account. Legal basis: performance of a contract.
• Journal: when a reading is saved, your account stores the spread type, the cards and positions, the question, the interpretation, your notes, favourites and, for readings about someone else, the name and relationship you entered. Used to show your history on any device you sign in to. Legal basis: performance of a contract.
• Saved people (Premium): only the name you give each person. We recommend using a nickname.
• Account preferences: such as the card of the day, reading time, reminders and haptics, reversed cards and full-deck use.
• Purchases and subscription: your Premium status and which items you bought. Payment is handled by Google Play; we do not receive your card details. Legal basis: performance of a contract.
• Crash reports: when the app crashes, Firebase Crashlytics records technical data about the error and the device (model, OS, app version). Used to fix problems. Legal basis: legitimate interest.
• Remote configuration: Firebase Remote Config lets us switch features (for example, ads) on or off without an app update.
• Ads on the free plan: when enabled, ads are served by Google Mobile Ads, which may process the advertising ID, device data and IP address. Before that, the app asks for your consent through Google's User Messaging Platform (UMP). Without consent, ads are not personalised. Legal basis: consent where required, and legitimate interest for non-personalised ads.

App notifications (such as the card-of-the-day reminder) are generated on the device, and you can turn them off at any time.

Who we share data with

We do not sell or rent personal data. It is processed by these providers on our behalf:

• Google (Firebase Authentication, Cloud Firestore, Crashlytics and Remote Config; Google Play Billing; Google Mobile Ads and UMP).
• Hugging Face, only to host the AI model file the app downloads.
• The website's hosting provider, which logs technical access data (such as IP and browser) to deliver pages securely.

These services may store data on servers outside Brazil. In that case, the international transfer follows the safeguards set out in the LGPD, such as contractual clauses adopted by the providers. We may also share data when required by law or by order of a competent authority.

How long we keep it

Account and journal data are kept for as long as the account exists. You can delete a reading at any time. When you delete your account in the app, we erase the profile, the journal and saved people. Provider backups may take an additional period to be erased, according to their policies.

Crash reports are kept by Crashlytics for a limited period (about 90 days). Purchase records may be kept for as long as legal obligations require.

Your rights

Under the LGPD you may request confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and deletion of data processed on the basis of consent.

In the app you can export your data and delete your account without contacting us. For any other request, write to claudio.soares.dev@gmail.com; we reply within 15 days. You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD).

Security

Data travels encrypted and is stored in access-controlled services. The database rules let each account read and change only its own data, and Premium status can only be changed by the billing system. No system is infallible; if a relevant incident occurs, we will notify you and the ANPD as the law requires.

Minimum age

Tarot Club is intended for adults aged 18 and over. We do not knowingly collect data from minors. If you become aware of an account belonging to a minor, write to claudio.soares.dev@gmail.com and it will be deleted.

This website

The clubetarot.com.br website does not use analytics tools or advertising cookies. It may store a technical cookie with the language you chose, only to show the pages in your language.

Changes to this policy

We may update this policy as the app changes. The effective date at the top of the page shows the current version; material changes will be announced in the app before they take effect. If the Portuguese and English versions differ, the Portuguese version prevails.