Privacy Policy

Who is responsible for your data

Moonlit Grove (tarotreadings.online) is run by BBN Labs Inc., a Canadian federal corporation that is responsible for your personal information. Our Privacy Officer, the Director of BBN Labs Inc., answers privacy questions and requests at hello@tarotreadings.online. This policy is written with Canada’s PIPEDA, Quebec’s Law 25, the EU and UK GDPR and similar laws in mind.

What we collect

• A guest account. When you first visit, we create a random account ID so your readings and streak can be saved. It isn’t linked to your name.
• Your email, if you choose to save your account. We use it to send you sign-in codes, and receipts or reminders about purchases. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Your name and birthday, if you add them. Both are optional. We use your name to address you in readings, and your birthday to work out your birth cards and sun sign.
• Your readings and journal. The cards you drew, the spread, the focus you chose (such as love or work), the reading text, and any journal notes, ratings or stars you add. These can be personal, so we use them only to show them back to you and to shape your future readings.
• Your progress. Your streak, collection, badges, Stardust balance and history, gifts you send, and notifications.
• Your time zone. Read from your browser so your day, and your free daily card, starts at your own midnight.
• A device ID. A random code created in your browser. We use it only to stop people rewarding themselves through the referral program, and to keep things fair.
• Purchases. What you bought, when, and the amount. Payments are handled by Stripe, which collects your payment details directly. We never see or store your card number.
• Basic technical data. Like any website, our server receives your IP address and browser type when you visit. We use them only to deliver pages, keep the service secure and stop abuse (for example, limiting sign-in attempts).
• Anonymous card counts. We count how many times each card was drawn each day across everyone, to show the day’s most drawn cards. These counts aren’t linked to you.

What we don’t collect

• Your questions. Anything you type as your question is kept only on your device. It is never sent to our server, so we can’t read, store or share it.
• Advertising data. We don’t show ads, we don’t use advertising or social media trackers, and we never sell, rent or trade your personal information.
• Your card details. They go straight to Stripe.

How we use it, and why we’re allowed to

• To run Moonlit Grove for you: your account, readings, journal, streak, purchases and support. This is needed to provide the service you asked for.
• To keep it safe and fair: preventing fraud, referral abuse and attacks. This is our legitimate interest, and yours.
• To send emails you asked for: sign-in codes, receipts, trial and renewal reminders, and a daily card email only if you turn it on. You can turn optional emails off at any time.
• To meet the law: for example, keeping sales records for tax.

Your optional details (name, birthday and journal) are used only because you chose to add them, and you can remove them at any time. We don’t use your data for automated decisions that have legal or similar effects on you. Readings are written by our engine from the cards you choose, purely for reflection.

Cookies and storage on your device

We use only the cookies needed to keep you signed in (including as a guest). There are no advertising or analytics cookies, so there is no cookie banner to click through.

To know how many people visit and which pages they read, we count visits with Umami, an open-source statistics tool that runs on our own server. It sets no cookies, doesn’t follow you to other sites and keeps only anonymous totals, such as the pages viewed, the site that sent you, your browser type and your country.

We also use your browser’s local storage for things that stay on your device: your typed questions, your device ID, the invite code you arrived with, and settings such as sound and haptics. Card art may be stored by our app so it works when you’re offline. Clearing your browser data removes all of these.

Who helps us

We share data only with the service providers we need, and only what they need:

• Stripe processes payments. For some purchases Stripe may act as the seller of record and will then handle your payment and tax data under its own privacy policy.
• Hostinger provides the server our app and database run on, and hosts our email, including the sign-in codes and reminders we send.
• Google, only if you choose to sign in with Google.

We may also disclose information if the law requires it, or to protect someone’s safety. If Moonlit Grove is ever sold or transferred, your data would move only under this policy, and we’d tell you first.

Where your data is stored

Our server is hosted by Hostinger in Boston, in the United States. Hostinger (email), Stripe and Google may process data in other countries, including the United States. When your data leaves your country, including leaving Quebec or the EU or UK, we make sure it stays protected, using the providers’ standard contractual clauses or other recognised safeguards. Laws in those countries may allow authorities there to access it.

How long we keep it

• Your account, readings and journal: until you delete them or your account.
• Shuffled decks for a reading you started but didn’t finish: deleted after 24 hours.
• Sign-in codes: stored scrambled (hashed) and valid for 10 minutes.
• Purchase records: kept for as long as tax law requires (in Canada, generally six years), even after you delete your account, but without your readings or profile.

When you delete your account, we delete your data from our live systems straight away. Copies in server backups are overwritten as backups roll over.

Your rights

Wherever you live, you can:

• See and download your data: from your profile, download a copy of everything we hold about you as a standard file.
• Correct it: edit your name, birthday and settings in your profile, or ask us.
• Delete it: delete your account in your profile. It removes your account and data immediately. Cancel any Oracle Pass first so no further payments are taken.
• Withdraw consent and object: turn off optional emails, remove your birthday or name, or ask us to stop any use you object to.
• Complain: we’d love the chance to fix things first, but you can also contact your privacy regulator, such as the Office of the Privacy Commissioner of Canada, the Commission d’accès à l’information du Québec, your EU data protection authority, or the UK Information Commissioner’s Office.

For anything you can’t do in the app, email hello@tarotreadings.online. We reply within 30 days, and there is no charge.

Adults only

Moonlit Grove is for people aged 18 and over. We don’t knowingly collect information from anyone under 18. If you think a young person has used the service, tell us and we’ll delete their account.

Security

Every connection to Moonlit Grove is encrypted (HTTPS). Sign-in codes are hashed, expire after 10 minutes and allow only a few attempts. Access to our server is limited to BBN Labs Inc.’s administrators. No system is perfectly secure, but if a breach ever put your information at real risk, we would tell you and the relevant regulators as the law requires.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change matters, we’ll tell you in the app or by email before it takes effect.

Contact and privacy officer

Privacy Officer, BBN Labs Inc. (Moonlit Grove)
Email: hello@tarotreadings.online