Privacy Policy

What we collect

When you create an account, we store the email address or phone number you sign in with. If you sign in with Apple and share your name, we store that as your display name.

When you do a reading, we store the question you asked, the cards drawn, and the interpretation. These readings build your galaxy.

If you scan a spread with your camera or choose a photo, the image is sent to identify the cards and is not stored. A profile picture stays on your device.

If you subscribe, we keep a record of your subscription status. Payment itself is handled by Apple, and we never see your card details.

If you turn on daily notifications, we store a push token for your device so we can send them.

If you join the waitlist on reflectatarot.com, we store your email address and the page you joined from. We send you a welcome email, and we'll write again when the app opens. Every email has an unsubscribe link, and using it stops them.

How we use it

We use your data to run Reflecta: to sign you in, write your readings, keep your history and galaxy, manage your subscription, and send the notifications you ask for. We don't sell your data, and we don't share it with advertisers or use it to track you across other apps or websites.

Services we rely on

A few companies process data on our behalf, only to provide the parts of Reflecta listed here:

• Supabase stores your account and readings.
• Anthropic generates reading interpretations and identifies cards in scanned photos. It receives the cards, your question, and any scanned image, and does not use them to train its models.
• RevenueCat and Apple manage subscriptions.
• PostHog provides product analytics.
• Expo delivers push notifications.
• Resend delivers waitlist email.

Analytics

We record how the app is used, such as which screens are opened and which features are used, to understand what to improve. These events are linked to your account. They never include your questions or the text of your readings.

Data storage

Your data is stored on Supabase infrastructure. All connections are encrypted with TLS, and row-level security means your account can only read its own data.

Deleting your data

You can delete your account at any time from your profile in the app. Deleting it permanently removes your readings, galaxy, and personal information. This cannot be undone.

Contact

Questions? Reach us at privacy@reflectatarot.com.