Privacy Policy

1. Scope and operator

One Card Tarot is operated by Nova in Hong Kong through the website onecardtarot.online (the "Service"). This policy applies to the website, account features, AI readings, history, and paid subscriptions. For privacy questions or requests, contact support@onecardtarot.online.

2. Information we collect

What we collect depends on how you use the Service. You can browse public pages without an account. Signing in, saving readings, or subscribing involves more data.

• Account data. When you sign in with Google, we receive and store your name, email address, profile image (if provided by Google), and account identifiers needed to keep you signed in. We may also store trial start time for the free trial that begins after first login.
• Session data. For signed-in sessions we may store session tokens, approximate IP address, and browser user agent to operate authentication securely.
• Reading and content data. If you use signed-in features, we may store the questions you type, cards drawn (including orientation), AI-generated reading text, spread type, and related metadata (for example model name, latency, or prompt version) so you can view history and we can improve reliability.
• Local device data. Some guest or journal features may store notes or draw-limit state in your browser (for example localStorage). That data stays on your device unless you later sync or submit it through a signed-in feature.
• Payment data. Paid subscriptions are processed by PayPal. We do not store full payment card numbers on our servers. We may store subscription status, plan identifiers, PayPal customer or subscription IDs, and related billing metadata needed to unlock Premium access.
• Technical and analytics data. We and our providers may process IP address, device/browser information, pages viewed, referrer/traffic source, and cookie or similar identifiers.

3. How we use this information

• To create and maintain your account, session, and free trial or Premium access
• To generate AI readings, show history, and operate one-card and three-card features
• To process subscriptions and fulfill paid Premium access
• To secure the Service, prevent abuse, and diagnose errors
• To understand traffic and product usage through analytics tools
• To respond to support and privacy requests

4. AI readings and third-party model providers

When you request an AI reading, the content needed to generate it — typically your question (if provided), card data, and a short summary of recent cards for continuity — is sent to our AI routing provider (currently OpenRouter) and the selected model provider (for example OpenAI for models such as GPT-4o mini). Those providers process that content to return the reading. Do not submit information you are not comfortable sharing with these processors. Readings are for reflection and entertainment, not medical, legal, financial, or mental-health advice.

5. Payments (PayPal)

Subscription checkout and billing are handled by PayPal. PayPal processes your payment details under its own privacy policy. We receive confirmation and subscription events (for example via webhooks) so we can grant or revoke Premium access. You may also use Google login and a free trial where offered on the site.

6. Analytics, cookies, and session replay

We use cookies and similar technologies for essential site functions (such as keeping you signed in) and for measurement:

• Google Analytics — traffic and usage measurement
• Microsoft Clarity — session analytics and interaction insights (which may include page recordings). Avoid typing highly sensitive personal details into on-site fields you would not want captured in analytics tooling
• Hosting and security providers (for example Vercel and, where used, Cloudflare) may set technical cookies or logs needed to deliver and protect the site

You can control cookies through your browser settings. Blocking some cookies may affect sign-in or site features.

7. Third-party services

Depending on features in use, we rely on processors including: Google (sign-in, Analytics, Search Console), OpenRouter and underlying model providers (AI readings), PayPal (subscriptions), Microsoft Clarity (analytics), Vercel (hosting), and database hosting for account and reading storage. Each provider processes data under its own terms and privacy practices. We do not sell your personal information.

8. Retention

• Account and readings — kept while your account remains active, and for a reasonable period afterward if needed for security, disputes, or legal obligations
• Sessions — kept until expiry or sign-out, subject to normal session lifetime settings
• Billing records — subscription metadata may be retained as needed for accounting, fraud prevention, and legal record-keeping; PayPal retains payment records under its own policies
• Analytics — retained according to each analytics provider's configuration and policies

9. Your choices, access, and deletion

You may stop using the Service at any time and sign out of your account. To request access to, correction of, or deletion of personal data we hold about you (including account profile data and stored readings), email support@onecardtarot.online from the email address associated with your account. We do not currently offer a fully automated self-serve deletion portal. We will respond within a reasonable time. Some records may be retained where we must keep them for legal, security, or accounting reasons. Data held only by third parties (for example PayPal payment history or Google account data) must be managed directly with those providers.

10. International processing

The Service is operated from Hong Kong and may use infrastructure and processors in other countries. By using the Service, you understand that your information may be processed outside your country of residence, where privacy laws may differ.

11. Children

The Service is not directed to children under 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

12. Policy updates

Effective date: August 4, 2026. We may update this policy as features, processors, or legal requirements change. The latest version will always be posted on this page with an updated date. Continued use of the Service after changes means you accept the updated policy.