☽ Deploy Tarot ☾
☽ ✦ ☾

Privacy Policy

The cards know only what you tell them.
We know even less.

The Short Version

Deploy Tarot stores a small amount of state in your browser using cookies. Nothing is sent to a server, logged, sold, or used to train a model. There is no account. There is no profile. There is no tracking. There is barely a database.

What We Store (Cookies)

Two cookies are set in your browser when you draw cards:

tarot_context

Contains your current reading session: the intent you selected, your role, a random seed for card selection, your draw count for the current intent/role, and the previous role you used (if any). This is how the page knows what cards to show on refresh. It expires after one year or when you click "Clear Preferences."

tarot_history

Contains today's date and how many times you have drawn for each role/intent combination today. This is what triggers the punishment system when you draw the same combination repeatedly. It also tracks which role you last used, to detect role switching. Counts reset automatically at midnight. It expires after one year or when you click "Clear Preferences."

Both cookies are HttpOnly, SameSite=Lax, and — in production — Secure. They cannot be read by third-party scripts.

What We Do Not Store

  • Your name, email, or any identifying information
  • Your IP address (beyond what any web server transiently handles)
  • Your reading history on the server side — it lives only in your browser
  • Analytics, telemetry, or event tracking of any kind
  • Advertising identifiers
  • Anything that could be described as a "user profile"

Third Parties

Google Fonts — Deploy Tarot loads typefaces from fonts.googleapis.com and fonts.gstatic.com. This is subject to Google's privacy policy.

Google Analytics — Analytics may be active on this site. If enabled, Google Analytics collects standard anonymous web analytics data: pages visited, session duration, browser type, and approximate location derived from IP address. No personally identifying information is collected. IP addresses are anonymised. You can opt out using the Google Analytics Opt-out Browser Add-on. Analytics is subject to Google's privacy policy.

Buy Me a Coffee — The footer links to buymeacoffee.com. Clicking it takes you to a third-party payment platform governed by their own terms and privacy policy. No data is shared with them unless you click the link.

There is no advertising network. There is no "we may share your data with partners" clause, because there are no undisclosed partners and nothing worth sharing.

Shareable Reading Links

When you copy a reading link, it encodes your intent, role, and a short random seed in the URL. Anyone with the link can see which cards you drew. Do not share your reading link if you are not comfortable with people knowing you drew The Tower reversed for your production hotfix.

Deleting Your Data

Click Clear Preferences to delete both cookies immediately. Alternatively, clear your browser cookies in the usual way. There is nothing stored on the server to delete.

Changes to This Policy

If this policy changes in a material way, we will update it. Given the minimalist nature of what is collected, material changes are unlikely. The cards are not interested in your browsing habits.

The High Priestess keeps her own counsel. We keep yours.