Privacy Policy

This Privacy Policy explains how Taromi ("we", "us", or "our") collects and uses information when you visit or use the Taromi website and its online tarot readings (the "Service"). It applies to visitors, guests, and registered users.

Who We Are

Taromi is operated by Zorka Apps Limited, Hong Kong.

No. 5, 17/F, Strand 50, 50 Bonham Strand, Sheung Wan, Hong Kong

1. Information We Collect

Account information. When you register, we collect your email address and, if you choose a password, a one-way hash of it (never the password itself). If you choose Google sign-in, we receive the profile information Google makes available for that sign-in, such as your name and email address.

Invitations and promo codes. If you create an account through someone's invite link, we record which account invited yours, so that account can be given its reward; it sees only how many invited friends joined and paid, never who. If you redeem a promo code, we record that your account used it. What happens to these records when you delete your account is described in section 4.

Session information. We use a session cookie to keep a guest session or a signed-in account working. The associated session record can include its expiry time and technical details such as IP address and browser user-agent information.

Reading content. We collect the question you ask, the cards drawn in response, the AI-generated interpretation shown to you, and the follow-up questions and answers of the chat on a reading. We store this content with the guest session or account that requested it so the Service can display and revisit the reading. The same applies to what you add yourself: how a reading turned out and your note on it, readings you mark as favourites, your card of the day, the positions of a spread you create, and an intention of the week with the days you mark a step, your one-line notes and the card of the week.

Reader memory, only if you switch it on. On Premium, if you switch on "Remember my past readings", a follow-up question on one of your own readings also gives the AI provider a short summary of up to 5 of your earlier readings from the last 60 days: their dates, spreads and cards, a shortened question and how you said it turned out. Your journal notes are included only if you switch that on as well. You can switch either off at any time.

Voice input, only if you use it. If you tap the microphone in a question field, your browser records a short clip (up to 30 seconds) and sends it to our server, which passes it to an open-source Whisper speech-to-text model run by DeepInfra only to turn it into text. The text appears in the field for you to edit; it becomes part of your reading only if you then send the question. We do not store the recording or its text, and we do not log what was said; we count that voice input was used, how long the clip was and how it ended.

Reminders, only if you switch them on. If you turn on card-of-the-day reminders, your browser gives us a push address from its push service. We store it with your time zone, the reminder time, the language of the reminder and a short description of the browser, so we can send the reminder and show you where reminders are on. Turning a reminder off deletes this record.

Support communications. If you contact us through the Contact & Support page or by email at [email protected], we collect the information you include in that message and our correspondence with you. The Contact page asks you to avoid including sensitive details from a reading in a support message.

Payments. We sell the Taromi Premium subscription directly and use Stripe as our payment processor. When you subscribe, we share your account email address with Stripe to create your customer record, and Stripe collects your payment card and the billing details it needs to take the payment on its own checkout page; we never receive or store your full card number. We keep the Stripe customer and subscription identifiers linked to your account, your plan (monthly or yearly), your subscription status and the end of your current billing period, so we can switch Premium on and off, and a record of each payment (amount, currency, date, refunds and disputes). Stripe charges $9.99 USD a month or $79.99 USD a year on our behalf until you cancel, which you can do at any time from your account page.

Product events. Where analytics is allowed (section 7), we record what happens in the Service on our own servers, such as a page being viewed, a reading being completed or a subscription starting, together with the guest session or account it belongs to and, if you arrived from an ad or a tagged link, the campaign name. A copy goes to our analytics provider (section 7).

Ad clicks. If you arrive from one of our Google ads, the link carries a click identifier (gclid, gbraid or wbraid) and campaign tags. Where ad measurement is allowed (section 7), we keep them with your guest session or account to measure our advertising.

Error reports. When something fails in your browser or on our servers, we record a technical report: the error message and stack trace, the page path (without its query string), your browser and operating system type, and the guest session or account identifier. We do not include your IP address or email address, and fields that could hold personal data are removed before the report is sent.

Session recordings, only if you allow them. With your permission, an analytics script records how you use the site in your browser, with what you type and your readings hidden (section 7).

2. How We Use Information

We use the information above to:

• Provide the Service, including drawing cards and generating an interpretation and follow-up answers for your question;
• Maintain guest sessions, enforce the daily reading allowance, and connect guest readings to an account when a guest registers or signs in;
• Display your reading history, send the emails you ask for (such as a password reset) and the reminders you switch on, and respond to support requests;
• Process Premium subscription payments, apply Premium to your account, and handle cancellations, refunds and payment disputes;
• Give, and where our Terms say so take back, the Premium days of the trial, invitations and promo codes;
• Understand how the Service is used and measure our advertising, as described in section 7;
• Find and fix errors, and investigate abuse, technical problems, and security incidents; and
• Meet applicable legal obligations and protect the Service and its users.

3. How We Share Information

We share information only as needed to run the Service, with these providers:

• DeepInfra and the AI model provider it routes to, which receive your question, the cards drawn and, for a follow-up, the reading it continues and, if you switched it on, the reader memory described in section 1, to generate the interpretation or the answer. DeepInfra is an AI inference platform; the model and its provider can change as we evaluate alternatives. They process this data under their own terms. DeepInfra and the model provider may process this data outside your country, including in the United States and other countries where the model is run;
• DeepInfra, which receives a voice clip only when you use the microphone in a question field, to return its text; we do not ask it to keep the clip;
• Cloudflare, our network provider: every request to the Service passes through it, so it processes your IP address and request details to deliver and protect the Service. Our database backups are also stored with Cloudflare;
• Our hosting provider, whose server runs the Service and its database;
• ZeptoMail (by Zoho), which sends transactional email on our behalf, such as a password-reset message, and processes the recipient address and message content needed to deliver it. We do not send marketing email;
• Zoho Mail, which hosts our support mailbox and so holds the messages you send to it;
• PostHog, which receives the error reports described in section 1 so we can find and fix bugs, and, where analytics is allowed, processes product events and, only if you allow it, session recordings on our behalf (section 7);
• Your browser's push service (for example Google, Apple or Mozilla), which delivers a reminder only if you switched reminders on;
• Google Ads, which our server tells that a visit from one of our ads led to a sign-up, a reading or a first payment (section 7); and
• Google, if you choose to use Google sign-in.

Stripe, our payment processor, receives the information needed to process payments and manage subscription billing for the Service: your account email address, your payment details (which Stripe collects directly) and your subscription history. Stripe processes that information under its own privacy policy.

Sharing a reading. A reading is private until you choose to share it. When you do, we create a link to a read-only page and share images that show the cards and the reading's main thought to anyone who has the link; they never show your question unless you switch on "Include my question". You can stop sharing at any time from the reading, and the link stops working immediately.

We may also disclose information where required by law or when reasonably necessary to protect users, the Service, or our rights. We do not sell personal information for money or provide it to data brokers. Telling Google Ads that a visit from its ad led to a sign-up, a reading or a payment may count as "sharing" personal information for cross-context behavioral advertising under some U.S. state privacy laws. You can opt out of it at any time on the "Your Privacy Choices" page linked at the bottom of every page, and we treat a Global Privacy Control signal from your browser as that opt-out.

4. Storage and Retention

We retain account, session, question, and reading information for periods that vary by record type and are based on operational, security, and legal needs.

Ad click identifiers are deleted 90 days after the click; campaign names may be kept longer. Your answers about analytics, ad measurement and session recording are kept for 12 months, then we ask again. Session recordings and error reports are kept by PostHog for the limited period set in our account with it.

Readings and other data of a guest session (one without an account) are deleted once the guest has not used the Service for 90 days.

A record of each visit (when it started, the page you landed on, the language, and where it came from: the referring site's domain, campaign tags and whether it came from an ad, never the ad click identifier) is kept with a guest session as long as that session's other data (90 days without use), and with an account for 13 months; after that we keep only daily totals that identify no one (the product events described in section 1 are kept as described there). How you came to a purchase (the earliest and the latest source we know of, without any click identifier) is kept with the payment record as long as your account exists. Withdrawing analytics consent, where we ask for it, deletes your visit records; deleting your account deletes them and the purchase source.

When you delete your account on the account page, we delete at once: your readings with their follow-up chat, notes and share links (shared links stop working), your card-of-day history and reminders, your intentions of the week with their notes, the spreads you created, your sessions on every device (you are signed out everywhere), your email address and sign-in details, including a linked Google identity, your promo-code redemptions and your ad click information. An active Premium subscription is cancelled immediately, with no further charges. We keep a record of each payment you made (amount, currency, date and the payment provider's reference numbers, without your name or email address) for 5 years from the payment date, then delete it. We also delete your customer record at our payment provider, Stripe, which removes your email address there; while a payment dispute about one of your payments is open, that record is kept until the dispute is closed and deleted then. Stripe keeps its own records of the payments themselves under its own privacy policy. Product events stay in our records only as counts that are no longer linked to you, and copies already sent to PostHog carry a random identifier that no longer leads to an account. If you joined through an invite, the inviting account keeps that invitation in its count, no longer linked to you. If your account received the free Premium trial or the Premium days of an invitation, we keep a one-way hash of its email address (not the address itself) after deletion, only so the same address cannot receive them again. Database backups that include deleted data are deleted within 30 days.

You can also delete a single reading, from your journal or from the reading itself. It is deleted together with its follow-up chat, notes and share link. An intention of the week can be deleted on its page at any time, together with its notes.

5. Your Choices and Requests

On the "Your Privacy Choices" page, linked at the bottom of every page, you can change your choices at any time. Everywhere, you can opt out of advertising measurement ("Do not sell or share") and switch session recording on or off. If you are in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, you can also allow or withdraw analytics and ad measurement there. We honor Global Privacy Control: if your browser sends it, we do not report your visits to Google Ads and do not record your sessions.

You can delete your account (on the account page) or a single reading (in your journal or on the reading) yourself, as described in section 4. You may also ask about access to, correction of, or deletion of personal information by emailing [email protected]. We will handle requests in accordance with applicable law and the information we are able to identify and verify.

6. Age Requirement

Taromi is intended for people aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided personal information to the Service, contact [email protected].

7. Cookies, Analytics and Advertising Measurement

Page analytics (Ahrefs). On the production site, Ahrefs page analytics operates only within our opt-in browser analytics mode after you make a new explicit analytics choice in this browser following its introduction; older analytics approvals alone do not enable it, though returning users can opt in again via the site privacy controls. It does not run for our own team's visits or when Global Privacy Control (GPC), Do Not Track (DNT), or do-not-sell signals are active. When enabled, it runs in isolation without accessing the application DOM, cookies, or browser storage, sending Ahrefs only allowlisted public page paths without URL queries or fragments, a fixed site title, browser language, screen dimensions, and ordinary connection metadata including your IP address. It never sends account IDs, question or prompt text, images, reading results, form contents, campaign tags, or full referrers. You can change your choice anytime via the site privacy controls; other existing analytics remain governed by their separate published rules.

Cookies. We use only our own (first-party) cookies, no third-party advertising or analytics cookies:

• a necessary session cookie that keeps a guest session or a signed-in account working; blocking or deleting it can prevent sign-in, guest use or related functions from working;
• a language cookie, if you choose a language;
• a short-lived cookie (up to 7 days) that carries an ad click identifier and campaign tags from the page you landed on to our server, which reads and deletes it;
• a cookie (up to 30 days) that keeps the invite code from an invite link you opened, so the invitation counts if you create an account; our server deletes it at sign-up;
• a cookie that remembers your answer about session recording for 12 months;
• a cookie that remembers your answers to our consent banner (analytics and ad measurement) for 12 months;
• a cookie, for the current browser session, that only says whether the consent banner applies where you are (not your country);
• a cookie (30 minutes, renewed while you browse) holding a random identifier of the current visit, so a visit is counted once and linked to your guest session or account; set only where analytics is allowed and deleted when you sign out; and
• a cookie (90 days) holding a random identifier that we use to compare versions of our pages, set only where analytics is allowed.

Advertising measurement (Google Ads). We do not run a Google tag or any advertising script in the Service. When you arrive from one of our Google ads, our server keeps the click identifier with your guest session or account. If that visit leads to creating an account, to your first reading, or to the first payment of a Premium subscription, our server reports the conversion to Google Ads: the click identifier, the time, the kind of conversion, its value and a reference number (the reading or invoice ID, or a random number for a sign-up). We never send your question, reading content, email address or IP address. Click identifiers are deleted 90 days after the click, the period Google accepts conversions for. We do not report conversions of visitors who opted out on the "Your Privacy Choices" page or whose browser sends a Global Privacy Control signal, of our own team, or of automated traffic.

Product analytics (PostHog). PostHog processes our product analytics on our behalf. Our server sends PostHog a copy of the product events described in section 1, linked to your guest session or account identifier, with the campaign name if there is one. We do not send PostHog your IP address, your email address, the text of your questions, readings, follow-up chat, journal or intention of the week, or ad click identifiers, and IP collection is switched off in our PostHog project.

Visitors in the United States and elsewhere outside the regions below. Our server-side events are our own first-party analytics, processed by PostHog on our behalf. A Global Privacy Control signal from your browser, or the "Do not sell or share" choice on the "Your Privacy Choices" page, turns off the reporting of conversions to Google Ads and session recording; our own analytics continues.

Visitors in the European Economic Area, the United Kingdom and Switzerland. If you visit from the EEA, the UK or Switzerland, or we cannot tell where you are, we ask before measuring anything: analytics and ad measurement are separate choices, and session recording is a third. Until you allow analytics, our server records none of the product events described in section 1 for you and sends none to PostHog; it keeps only what the Service needs to work (your account, readings, payments and limits) and counts of what readings cost and whether they failed, with no link to you. Error reports (section 1) are still sent to PostHog, because we need them to keep the Service working; they carry no IP address or email address. Until you allow ad measurement, we do not keep an ad click identifier or campaign tags and report nothing to Google Ads; if you allow it, we tell Google, with each conversion, that you consented. The legal basis for analytics, ad measurement and session recording is your consent (Article 6(1)(a) GDPR and UK GDPR; the Swiss Federal Act on Data Protection); for what the Service needs to work, it is the performance of our contract with you; for error reports, it is our legitimate interest in a Service that works and is secure (Article 6(1)(f)). You can withdraw your consent at any time on the "Your Privacy Choices" page, as easily as you gave it; withdrawing ad measurement also deletes a click identifier we hold and cancels conversions not yet sent. Withdrawal does not affect processing before it. Data goes to PostHog (analytics and error reports, our processor) and, with your consent, to Google (advertising measurement); both may process it outside your country, including in the United States, under the safeguards they offer for international transfers, such as the EU Standard Contractual Clauses. We work out your region from the country our network provider, Cloudflare, attaches to each request; we do not store your country.

Session recording, only with your consent. We ask before recording. Until you choose "Allow", PostHog's script is not loaded in your browser at all. If you allow it, the script records how you use the site, such as the page layout, clicks, scrolling and the pages you visit, so we can find what is confusing, and keeps an identifier for the recording in your browser's storage. Everything you type is masked, and your question, the interpretation of your cards, the follow-up chat, your journal, your intention of the week and shared readings are hidden from the recording. Account and checkout pages, and the password reset pages, are never recorded. We do not record our own team, or visitors whose browser sends a Global Privacy Control signal. You can change your answer at any time on the "Your Privacy Choices" page.

8. Security

We use reasonable technical and organizational measures designed to protect information under our control, including access controls and HTTP-only session cookies. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Not Professional Advice

Taromi readings, including their AI-generated interpretations, are provided for entertainment and self-reflection only. They are not medical, legal, financial, or psychological advice, and should not be treated as a substitute for consulting a qualified professional.

10. Changes to This Policy

We may update this Privacy Policy as the Service changes. We will publish the updated version here with a revised effective date. If a change materially affects how we use personal information, we may provide additional notice where appropriate.

11. Contact

For privacy questions or requests, contact [email protected].