Privacy Policy
How Sunlit Tarot (sunlittarot.com) handles your personal information. Effective: October 23, 2026
1. Who We Are
Sunlit Tarot is operated by Macaronpop, the controller of your personal information. Contact: support@sunlittarot.com.
2. What We Collect
| Data | When | Stored? |
|---|---|---|
| Your question, chosen reader, topic and spread | When you ask for a reading | No. Used only to write that reading, then discarded |
| IP address | On every request | Only as a keyed hash in short-lived counters that limit free readings and abuse |
| Usage data (pages viewed, button clicks, approximate country, device and browser type) | When you browse, through Google Analytics | Yes, pseudonymous, in Google Analytics |
| Error reports (what broke, browser type) | When something goes wrong | Yes, with personal data removed |
| Email address and account records | If you create an account (when available) | Yes, until you delete your account |
| Order details (order number, product, amount, country) | When you buy something | Yes, as required for accounting |
We do not ask for your real name, phone number, birth date or home address. Please do not include sensitive personal details (for example about health) in your question.
Card payment details are collected by Dodo Payments, our Merchant of Record, not by us.
3. Why We Use It and Legal Bases
- To provide readings and paid products you ask for (performance of a contract)
- To prevent abuse, keep the Service secure and fix errors (legitimate interests)
- To understand how the Service is used and improve it (legitimate interests, or consent where the law requires it)
- To keep payment and tax records (legal obligation)
We do not sell your personal information, do not share it for cross-context behavioral advertising and do not use it for automated decisions with legal or similarly significant effects.
4. AI Processing
To write a reading, we send your question, the cards drawn, the spread, the topic and the chosen reader to Anthropic (the Claude AI model). We do not send your email address or IP address.
Under its commercial terms, Anthropic does not use this data to train its models. We do not keep the text of your question after the reading is written.
5. Service Providers and International Transfers
We use the providers below. Several are in the United States or other countries, so your data may be transferred abroad. Transfers use encrypted connections (HTTPS) and, where the GDPR or similar laws apply, safeguards such as Standard Contractual Clauses.
| Provider (country) | Purpose | Data |
|---|---|---|
| Vercel Inc. (USA) | Website hosting | IP address, request data |
| Anthropic PBC (USA) | Writing readings with AI | Question, cards, topic, reader |
| Supabase Inc. (USA and data region) | Database: rate-limit counters, accounts, orders | Hashed IP counters, account and order data |
| Google LLC (USA) | Google Analytics | Usage data, cookie identifiers |
| Functional Software Inc. / Sentry (USA) | Error monitoring | Error details with personal data removed |
| Resend Inc. (USA) | Sending email (sign-in, receipts, replies), when available | Email address, message contents |
| Dodo Payments (USA, etc.) | Merchant of Record: payments, tax, receipts, fraud prevention | Email address, billing country, order and payment details |
Dodo Payments collects payment details directly as Merchant of Record, and its own privacy policy also applies to that processing.
6. How Long We Keep It
| Data | Retention |
|---|---|
| Question text | Not stored |
| Hashed IP counters | Deleted automatically after the limit window (usually within a few days) |
| Google Analytics data | According to our Google Analytics retention setting, no longer than 14 months |
| Error reports | Up to 90 days |
| Account data | Until you delete your account (completed within 30 days) |
| Order and payment records | 5 years, as required by Korean e-commerce and tax law |
8. Your Rights
Depending on where you live (for example under the GDPR, the UK GDPR, California law, Japan's APPI or Korea's PIPA), you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent at any time.
To use these rights, email support@sunlittarot.com. We reply within 30 days and will not treat you differently for using them. You may also complain to your local data protection authority.
9. Children
The Service is not meant for children under 13 (or the higher minimum age in your country). If we learn that we have collected personal information from such a child, we delete it.
10. Security
We use encrypted connections, keyed hashing of IP addresses, restricted database access and data minimization. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.
11. Changes and Contact
We will post changes on this page and update the effective date; important changes will be announced on the Service. Questions: support@sunlittarot.com.