Privacy Policy
Last updated: 29 October 2026
This Privacy Policy explains what information the Cosmic Tarot app ("the app") processes, why, and what choices you have. The app is published by Thoughunch Studio, an individual developer based in Virginia, United States ("we", "us"). Contact: thoughunchgames@gmail.com.
Cosmic Tarot has no user accounts. You do not need to give us your name, email address or phone number to use it.
1. Summary
- Your tarot question and the cards you draw are sent to our server and to an AI provider so that an interpretation can be written. We do not keep them on our server.
- The app creates a random app ID on your device to apply usage limits. It is not linked to your name, email or advertising ID.
- Rewarded ads are provided by Google AdMob, which collects device information such as your advertising ID and IP address.
- Your reading history is stored only on your device, and you can delete it in the app.
- We do not use analytics tools, location, contacts, camera or microphone.
2. Information processed when you request a reading
When you ask for a reading or a follow-up answer, the app sends the following over an encrypted (HTTPS) connection to our server:
- your question, if you typed one (up to 300 characters), and up to three follow-up questions per reading;
- the cards you drew, their positions and whether they are reversed;
- the spread, deck and language you chose;
- for follow-up questions: the earlier interpretation and the earlier follow-up questions and answers, so the AI can answer in context;
- the random app ID described in section 3 and an access key that is the same for every copy of the app.
Our server runs on Cloudflare Workers (Cloudflare, Inc.). It forwards the question, cards and context to Groq, Inc., which runs the AI model that writes the interpretation, and sends the answer back to the app.
Our server does not have a database and does not store your questions or interpretations. It does not write your question or the interpretation to its logs. If the AI provider returns an error, a short technical error message may be logged to help us fix problems.
According to Groq's documentation, Groq does not retain inference requests by default; it may keep request logs for up to 30 days only to troubleshoot reliability problems or investigate suspected abuse. See Groq's own policies for details: https://console.groq.com/docs/your-data
Please do not include names, contact details, health information or other sensitive personal information in your questions. The app works just as well without them.
3. App ID and usage limits
On first launch the app generates a random identifier (for example "d_x8F2…") and stores it on your device. It is sent with every request so that our server can limit how many requests a single installation can make, which protects the service from abuse and keeps its costs under control.
- The app ID is not derived from, and not linked to, your name, email, phone number or Google advertising ID.
- When daily limits are active, our server keeps a request counter for each app ID in Cloudflare's key-value storage. These counters are deleted automatically after 2 days.
- Uninstalling the app or using "Delete data on this device" creates a new app ID next time.
Like any internet service, Cloudflare receives your device's IP address when the app connects. Our code uses the IP address only as a fallback for rate limiting when no app ID is available, and does not store it. Cloudflare processes connection data under its own privacy policy: https://www.cloudflare.com/privacypolicy/
4. Reporting a reading
If an interpretation seems harmful, inappropriate or wrong, you can report it from the reading screen. A report contains the reason you chose, the interpretation text, your question, the cards, spread, deck and language. It is stored on our server for up to 90 days so that we can review it and improve the app, and is then deleted automatically. The app ID is used only to limit the number of reports per day and is not stored with the report.
5. Advertising (Google AdMob)
Some spreads (Three-Card and Celtic Cross) are unlocked by watching a rewarded video ad. Ads are provided by Google AdMob (Google LLC and its affiliates). The Google Mobile Ads SDK in the app automatically collects and shares with Google information such as:
- your device's IP address (which can be used to estimate general location);
- your Android advertising ID and app set ID;
- interactions with ads (for example views and taps) and app/SDK performance and diagnostic information.
Google uses this information for advertising, analytics and fraud prevention, and may show personalised or non-personalised ads depending on your settings, region and consent choices. We do not receive your advertising ID. You can reset or delete your advertising ID, or opt out of personalised ads, in your device's settings (Settings > Privacy > Ads, or Settings > Google > Ads, depending on your device).
More information: https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy
The Daily Card does not require an ad.
6. Information stored on your device
The app stores the following only on your device:
- settings: language, chosen deck, sound on/off, an unused ad reward (if any) and whether you accepted the first-launch notice;
- the random app ID;
- your reading history: up to your 50 most recent readings, including your questions, the cards, the interpretations and follow-up answers.
This information is not uploaded to us, except for the parts that are sent when you request a reading or send a report, as described above. You can delete it at any time in the app (About & Legal > Delete data on this device), by clearing the app's storage in Android settings, or by uninstalling the app.
7. Sharing a reading
When you tap "Share Reading", the app passes the text of the reading to the Android share sheet, and you choose where to send it. We do not receive what you share or who you share it with. The app or person you share with handles it under their own terms.
8. Permissions
The app requests internet access to send readings and load ads. The Google Mobile Ads SDK adds permissions it needs to work: access to the advertising ID, network state, keeping the device awake briefly and running short background tasks, and basic phone state (device type information). These do not give the app access to your contacts, files, location, camera, microphone, calls or messages, and Android does not ask you to approve them.
9. Security
All communication between the app, our server, the AI provider and Google uses encrypted HTTPS/TLS connections. The AI provider's secret key is kept only on our server and is never included in the app. We collect as little information as possible and apply rate limits to protect the service. No method of transmission or storage is completely secure, but we work to protect the information we handle.
10. Retention
| Information | Where | How long |
|---|---|---|
| Questions and interpretations | Not stored on our server | Processed only while the answer is generated |
| AI provider request logs | Groq | None by default; up to 30 days for reliability or abuse investigation (per Groq) |
| Request counters per app ID | Cloudflare key-value storage | Deleted automatically after 2 days |
| Content reports | Cloudflare key-value storage | Deleted automatically after 90 days |
| Settings, app ID, reading history | Your device only | Until you delete them or uninstall the app |
| Advertising data | According to Google's policies |
11. Children
Cosmic Tarot is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect information from children. If you believe a child has used the app and sent us information, contact us and we will help.
12. Your rights and choices
Depending on where you live (for example under the privacy laws of your US state, the Turkish Personal Data Protection Law No. 6698 (KVKK) or the EU/UK GDPR), you may have the right to ask what information we hold about you, to have it corrected or deleted, to object to or restrict its processing, and to complain to a data protection authority.
Because we have no accounts and do not store your questions or readings on our server, in most cases we hold no information that can be linked to you. You can delete everything stored on your device from within the app. For any request or question, contact us at thoughunchgames@gmail.com. For data processed by Google, Cloudflare or Groq, you can also use their own privacy tools.
13. International processing
We are based in the United States. Cloudflare operates a global network, Groq stores data in the United States, and Google processes data in many countries. Your information may therefore be processed outside your country, under the safeguards these providers describe in their policies.
14. Changes to this policy
We may update this Privacy Policy when the app changes. The "Last updated" date above shows the latest version. Significant changes will be announced in the app.
15. Contact
Thoughunch Studio
Email: thoughunchgames@gmail.com
Virginia, United States