Last updated: 2026-09-25
This document reflects every data-collecting integration actually shipped in the app as of this date: Mistral AI for AI insight (live), Google AdMob for ads (live ad units; iOS App ID still Google's test ID until the Apple Developer account exists), PostHog for analytics (live), and RevenueCat for subscriptions (live — purchases go through real App Store/Google Play billing). Update this document again as that connection status changes. It is hosted at a stable public URL and linked from the app's settings screen, the store listing, and the paywall (see app/(tabs)/settingsscreen.tsx and components/PaywallModal.tsx).
Real Tarot is an entertainment and self-reflection app. It is not a source of medical, legal, financial, or psychological advice.
The following is stored locally on your device, using your operating system's storage, and is not transmitted anywhere unless stated otherwise below:
You can clear your reading history at any time from the History screen. Uninstalling the app deletes all locally stored data.
the cards in that reading (names, orientation, and the position each card is in), the spread name, your chosen category, and your interface language are sent to our proxy server (a Cloudflare Worker we operate) and then to our AI provider, Mistral AI (a company based in France, in the EU), to generate the personalized interpretation you asked for. This specific data is processed to fulfil the analysis you explicitly requested (GDPR Art. 6(1)(b), for EU/EEA/UK users). Separately, an anonymous, randomly generated per-install device id (utils/deviceId.ts — on Android this is Settings.Secure.ANDROIDID, scoped to this app; it is not your name, email, or any account identifier, since the app has no accounts) is sent to our proxy so it can enforce a daily free-usage limit and prevent abuse. This id is processed under our legitimate interest in preventing abuse of a free, metered feature (GDPR Art. 6(1)(f)). The device id is never sent to Mistral — Mistral only receives the reading content described above. We have disabled Mistral's setting that would otherwise let it use API traffic to train its models — your reading content is not used for that purpose. Mistral's own documentation states that, without this opt-out disabled and without their separate Zero Data Retention option enabled (which we do not currently have), it keeps request and response content for a limited time — up to 30 days — for abuse-prevention purposes; we do not claim your reading content is not stored at all, only that it is not used to train Mistral's models. See Mistral's Privacy Policy and Commercial Terms of Service for Mistral's current, authoritative wording on retention and processing — we do not restate this as a permanent guarantee because Mistral can change it without notice to us. A short notice describing this data flow is shown once, in the app's initial disclaimer, before you can use the app. "Delete all my data" in Settings clears the locally cached copy of the device id, but on Android the underlying value (Settings.Secure.ANDROIDID) is an OS-level identifier scoped to this app and does not actually change until the device is factory reset — so a new insight request after using "Delete all my data" will read the same id back from the OS rather than generate a new one. On iOS, the identifier (identifierForVendor) can change if Real Tarot becomes the only app installed from its vendor and is then reinstalled, but "Delete all my data" alone does not reset it either. To reduce how often this happens, identical readings (same cards, orientations, positions, category, and language) reuse a response cached on your device instead of contacting the proxy again — see utils/aiInsight.ts.
unlock one extra AI insight past the daily limit) or an interstitial ad after a shuffle animation; Real Tarot+ subscribers never see ads. AdMob may collect your advertising identifier (IDFA on iOS / advertising ID on Android), IP address, and general device information to select and measure ads; ads currently requested by this app are non-personalized, and AdMob's own privacy policy governs its processing. If you are in the European Economic Area, the United Kingdom, or Switzerland, the app first shows Google's consent form (Google User Messaging Platform, "UMP") and does not request ads until you have answered it; you can review or change your answer at any time under Settings → "Ad privacy settings" (shown only in those regions, and only while ads are enabled). Outside those regions no consent form is shown. On iOS, this triggers Apple's App Tracking Transparency prompt only if that changes to personalized ads in the future — it does not today.
completed, paywall viewed, subscription started) are collected to understand how the app is used and improve it. Events include which spread/category/deck-skin option you interacted with, never the actual card names drawn or the content of an AI insight. Events are tied to an anonymous installation identifier, not your name or email.
purchase is processed entirely by the App Store or Google Play — we never see or store your payment details. RevenueCat receives your purchase receipt and an anonymous app-user id to validate the purchase, keep your subscription status in sync across devices, and power "Restore Purchases"; see RevenueCat's own privacy policy for how it processes that data.
For the processing described above, Night Orbit Studio (the developer of Real Tarot) is the controller. Mistral AI, Google (AdMob), Cloudflare (our proxy server), PostHog, and RevenueCat act as processors/subprocessors, each under their own terms and privacy policy. Mistral AI is based in France (EU), so AI-insight processing itself does not involve a transfer outside the EU/EEA; some of the other providers may process data outside your country, including outside the EU/EEA/UK — where that applies, they rely on their own safeguards (such as Standard Contractual Clauses) — see each provider's own documentation for details, since we do not control or independently verify their specific transfer mechanism.
Real Tarot is entertainment content about tarot reading and is not designed for, or directed at, children — it is not listed as a children's or "Designed for Families" app on any store. We do not knowingly collect personal information from children under 13 (or the applicable age of digital consent), and the app collects no accounts, names, emails, or other identifying information from any user regardless of age. Separately, our AI provider's own terms require that minors only use products built on their API with adequate parental or guardian consent — we do not currently have a dedicated consent flow for this beyond the general disclosure in the app's initial disclaimer and this policy, a known gap the developer is tracking (see ACTION_PLAN.md).
The app has no user accounts, so there is nothing tied to your identity to request or delete by name — only the on-device data described above and the anonymous identifiers used for AI-insight rate-limiting, advertising, analytics, and subscription status. Use "Delete all my data" in Settings to erase your reading history and current draw at any time. On Android, the anonymous id used for the AI-insight daily limit is tied to your device/app installation at the operating-system level (not something our app generates) — it is not reset by "Delete all my data" or by uninstalling and reinstalling the app, only by a full factory reset of the device; this is intentional, to keep the free-usage limit meaningful. On iOS and web, that id is reset the same way as the rest of your local data. Our Cloudflare Worker proxy stores, in a Cloudflare D1 database, only the anonymous device id together with that day's insight count and rewarded-ad bonus count (for the free-usage limit), and a short-lived (a few minutes) cached flag of whether that device has an active Real Tarot+ subscription — not reading content. Daily counter rows are deleted automatically once their day has passed; you do not need to separately request deletion of them. To stop analytics or advertising identifiers from being associated with your device going forward, use your OS-level ad-tracking controls (e.g. "Limit Ad Tracking"/App Tracking Transparency on iOS, "Opt out of Ads Personalization" on Android) and uninstall the app to clear PostHog's local installation identifier. Data already sent to Mistral AI, Google AdMob, PostHog, or RevenueCat is governed by each provider's own retention policy and privacy policy, linked from this document once finalized.
support@nightorbitstudio.com
We will update this document as integrations change (e.g. when real AdMob/PostHog/ RevenueCat account credentials are configured, or new features are added), and will update the "Last updated" date above accordingly.