Privacy

KTarot (https://tarot.kacklingkoven.com) is run by Dean Kusler (“we”). This page says what we keep about you, why, who else sees it, and how to have it deleted. The short version: only what the app needs to work, no ads, no tracking, and nothing sold.

Your account

• Your email address, to log you in and to send the emails below.
• Your username, shown to you in the app.
• Your password, stored only as a one-way hash. Nobody, including us, can read the password itself.
• Your time zone, taken from your device when you write, so readings and streaks fall on the right day.
• When you registered, verified your email and last logged in.
• Your Stars balance, and a record of every change to it (what it was for and when).
• Single-use links for verifying your email (valid for 24 hours) and resetting your password (valid for an hour), kept until they are used or replaced.

What you write

• Your readings: the deck and spread, the cards drawn and which were reversed, the question if you asked one, and the date. If you asked for an interpretation, the text sent to the AI reader and its answer are kept with the reading.
• Your journal entries: the mood emoji, the text, the date, and the reading it’s about, if any.
• Feedback you send us from the app: your message, and to help us find the problem, the page you sent it from, the app version, your browser and screen size, whether you were online, and any errors the app hit in that tab beforehand. The form lists exactly what goes with it. Only we read it.

These are kept on our server so you can reach them from any device you log in on.

On your device

So the app works offline, your readings and journal entries are also kept in your browser’s storage (IndexedDB) on each device you use, along with anything you wrote offline that hasn’t reached the server yet. Logging out deletes them from that device. The browser also keeps:

• a session cookie, which keeps you logged in and expires after a week without a visit;
• your account details (email, username, balance and time zone) so the app can open offline;
• your last choice of deck and spread, and your light or dark mode setting;
• the decks and spreads themselves, which are the same for everyone.

Logging out also clears the session and the account details.

Who else handles it

• Fly.io hosts the app and its database, so everything above is stored on their servers.
• Resend delivers our emails (verifying your address and resetting your password), so they receive your email address and the email’s content.
• OpenRouter and the AI model provider it passes the request to receive the reading’s question, spread and cards when you ask for an interpretation, and nothing else: not your name, email or journal. Card readings without an interpretation never leave our server.

We don’t sell your data, share it with advertisers, or use it to train AI models.

No ads, no tracking

There are no ads, analytics, tracking pixels or third-party scripts. The fonts and code are served from our own site.

Logs

Our server logs errors and the emails it sends (including the address), and our host keeps request logs that include IP addresses. Logs are kept for a short time to run and debug the service. To slow down password guessing, the server briefly remembers how often each IP address tries to log in or register; that is kept in memory only.

How long we keep it, and deleting it

Your account and what you write are kept until you ask us to delete them. Email oracle@kacklingkoven.com from the address you registered with to have your account and everything in it deleted, or to get a copy of your data. You can also ask what we hold about you or have it corrected.

Changes

If this page changes in a way that matters, we’ll say so in the app or by email before it takes effect. Questions go to the contact page.