Privacy Policy

Effective Date: August 26, 2026 · Last Updated: August 26, 2026

This Privacy Policy explains how Ora Tarot (“Ora Tarot,” “Ora,” “we,” “us,” or “our”) collects, uses, stores, discloses, and otherwise processes personal information when you access or use the Ora Tarot mobile application and related services (collectively, the “Services”).

Ora Tarot is jointly operated by:
Kate Lushnikova and Polina Lushnikova
Individual co-operators
Russian Federation
Privacy contact: support@oratarot.app

For the processing described in this Privacy Policy, the Operators act as controllers to the extent they jointly determine the purposes and means of processing. Where applicable law requires a local privacy representative, we will provide the representative’s current contact details in this Privacy Policy.

By using the Services, you acknowledge that you have read this Privacy Policy.

1. Scope of This Privacy Policy

This Privacy Policy applies to personal information processed in connection with the Ora Tarot iOS application, including information processed when you:

  • create or manage an account;
  • sign in using email, Apple, or Google;
  • create your personal profile or Personal Code;
  • request tarot readings or interact with AI-powered features;
  • use voice input;
  • purchase or manage a subscription;
  • receive notifications or marketing communications;
  • contact us for support; or
  • otherwise interact with the Services.

Ora Tarot is intended for users 16 years of age or older.

2. Personal Information We Collect

2.1 Account and Authentication Information

When you create or use an Ora Tarot account, we may collect:

  • name;
  • username;
  • email address;
  • account identifier or user ID;
  • authentication information and authentication tokens;
  • information received through Sign in with Apple;
  • information received through Google Sign-In; and
  • other information necessary to create, authenticate, secure, and maintain your account.

If you use Apple or Google to sign in, those providers may provide us with certain account information in accordance with your settings and their respective privacy practices.

We do not require or intend to store your Apple ID or Google account password.

2.2 Profile and Personalization Information

To provide personalized features, including the Personal Code and personalized tarot experiences, we may collect:

  • name;
  • date of birth;
  • gender;
  • country;
  • preferred language;
  • place of birth; and
  • other profile preferences you choose to provide.

We use this information to generate, customize, and personalize features within Ora Tarot.

2.3 Tarot Readings, AI Conversations, and User Content

When you request a tarot reading or interact with AI-powered features, we may process:

  • questions entered in free-form text;
  • selected reading categories;
  • tarot cards selected, drawn, or associated with a reading;
  • comments or additional context you provide;
  • conversation history;
  • previous readings;
  • AI-generated responses;
  • information from your profile relevant to personalization; and
  • other content you voluntarily submit through the Services.

Because Ora Tarot allows free-form questions, the content you submit may reveal personal or sensitive information about you or other individuals.

Please do not provide information that is unnecessary for your reading, including passwords, payment-card information, government identification numbers, or other highly confidential information.

Ora Tarot does not require you to provide medical records, financial account credentials, government identifiers, or similarly sensitive information in order to use its tarot features.

2.4 Reading History

Ora Tarot may retain your tarot reading and AI conversation history for up to six (6) months, unless:

  • you delete the relevant content earlier;
  • you delete your account;
  • a shorter retention period is required by law; or
  • limited retention is required for security, fraud prevention, dispute resolution, or compliance with legal obligations.

Reading history may be used to provide context for subsequent readings and make responses more relevant to you.

2.5 Voice Input

Ora Tarot may allow you to provide questions through voice input.

If you enable this feature, Ora Tarot will request permission to access your device microphone. Audio or voice data may be processed for the purpose of converting your speech into text and providing the feature you requested.

Voice input may be processed by third-party speech-to-text infrastructure solely to convert speech into text and provide the feature you request. We do not use voice input for third-party advertising or to train our own generative AI models. We configure service providers and processing settings to minimize data use and retention where reasonably available.

Ora Tarot does not access your microphone unless microphone access has been permitted through your device settings and is required for a feature you choose to use.

2.6 Subscription and Purchase Information

Ora Tarot may offer paid subscriptions or premium features through the Apple App Store.

Payments are processed by Apple. Ora Tarot does not receive or store your full payment-card number or full payment credentials.

We may receive or process information relating to your purchase and subscription, such as:

  • subscription status;
  • product or subscription purchased;
  • purchase, renewal, expiration, cancellation, or restoration status;
  • transaction or receipt information;
  • subscription entitlement information;
  • App User ID or similar subscription identifier; and
  • other information required to verify and manage access to premium features.

We currently use RevenueCat to assist with subscription and entitlement management.

2.7 Device, Technical, and Usage Information

When you use the Services, certain technical information may be collected automatically, including:

  • IP address;
  • device type;
  • device or application identifiers;
  • operating system and version;
  • application version;
  • language;
  • locale;
  • time zone;
  • login and session information;
  • dates and times of access;
  • interactions with features;
  • usage events;
  • subscription-related events;
  • performance data;
  • error information; and
  • crash or diagnostic information.

We may use analytics and diagnostic technologies to understand how Ora Tarot operates and how users interact with its features.

Ora may use operational analytics, monitoring, and diagnostics providers to understand service performance, investigate errors, and improve reliability. We do not currently use third-party advertising trackers for cross-context behavioral advertising.

2.8 Approximate Location Information

We may infer a general location from information such as an IP address, country selection, language, or locale where necessary for security, localization, analytics, or legal compliance.

Ora Tarot does not currently request access to your device’s precise GPS location.

A place of birth that you manually enter into the Services is treated as profile information and is not obtained through your device location services.

2.9 Communications and Support Information

If you contact us, we may collect:

  • your name;
  • email address;
  • account identifier;
  • the content of your request;
  • attachments or additional information you choose to provide; and
  • information necessary to investigate and respond to your request.

2.10 Marketing Information

If you choose to receive marketing emails or other promotional communications, we may process your contact information and information about your communication preferences.

We may use service providers to deliver authentication, transactional, support, and marketing communications. Such providers may process contact, delivery, and message metadata only as reasonably necessary to provide those communications.

Where required by law, we will obtain your consent before sending marketing communications.

You may unsubscribe from marketing emails using the unsubscribe mechanism provided in the communication or by contacting us.

3. How We Collect Personal Information

Directly from You

For example, when you create an account, enter profile information, ask a tarot question, use voice input, or contact us.

Automatically

Certain technical, device, usage, diagnostic, and subscription information may be collected automatically when you interact with Ora Tarot.

From Third Parties

We may receive information from third-party providers that support the Services, including:

  • Apple;
  • Google;
  • Supabase;
  • RevenueCat; and
  • other service providers described in this Privacy Policy.

4. How We Use Personal Information

4.1 Providing the Services

To:

  • create and maintain your account;
  • authenticate you;
  • provide tarot readings;
  • generate AI responses;
  • provide your Personal Code;
  • maintain reading history;
  • provide premium features;
  • process voice input;
  • synchronize and maintain your account; and
  • provide other requested features.

4.2 Personalizing Ora Tarot

We may use profile information, prior readings, conversation history, and your interactions with the Services to make tarot readings and AI-generated responses more contextually relevant and personalized.

This personalization is intended to improve your experience with Ora Tarot.

4.3 Operating and Improving Ora Tarot

We may analyze how users interact with the Services to:

  • understand which features are used;
  • identify popular reading categories;
  • evaluate product performance;
  • identify errors or usability issues;
  • develop new features;
  • improve existing features;
  • conduct aggregate product analytics; and
  • improve the overall functionality and user experience of Ora Tarot.

This type of product improvement is separate from training generative AI models on your private conversations.

4.4 Managing Subscriptions

We use purchase and subscription information to:

  • verify purchases;
  • determine subscription status;
  • unlock premium features;
  • restore purchases;
  • manage subscription entitlements; and
  • prevent subscription-related fraud or abuse.

4.5 Communications

We may use your contact information to:

  • respond to support requests;
  • provide service-related notices;
  • communicate important changes to the Services;
  • send security notices;
  • send transactional messages; and
  • where permitted, send marketing communications.

4.6 Notifications

With your permission, Ora Tarot may send push notifications, including:

  • Daily Card notifications;
  • reminders;
  • product notifications;
  • personalized notifications; and
  • other communications relating to the Services.

Push notifications are delivered through Apple notification services and, where applicable, supporting notification-routing infrastructure. Notification providers may process device or push tokens and delivery metadata necessary to route notifications.

You can disable push notifications through your iOS settings.

4.7 Security and Fraud Prevention

We may process information to:

  • authenticate users;
  • secure accounts;
  • prevent unauthorized access;
  • detect fraud, abuse, or security threats;
  • investigate technical incidents; and
  • protect Ora Tarot, our users, and third parties.

4.8 Legal Compliance

We may process or retain information where reasonably necessary to:

  • comply with applicable law;
  • respond to valid legal requests;
  • establish, exercise, or defend legal claims;
  • enforce applicable agreements; or
  • protect legal rights and safety.

5. Artificial Intelligence and Qwen

Ora Tarot uses artificial intelligence to generate or assist in generating personalized tarot interpretations and conversational responses.

Our current planned AI infrastructure includes Qwen models provided through Alibaba Cloud Model Studio.

To generate a response, information transmitted for AI processing may include:

  • your question or prompt;
  • relevant tarot cards;
  • the category or context of the reading;
  • your first name or chosen name where relevant to personalization;
  • relevant previous messages or readings;
  • relevant profile information; and
  • technical information necessary to process the request.

We seek to limit the information transmitted to AI providers to information reasonably necessary to provide the requested feature.

We do not intentionally provide AI providers with your payment-card information, account password, or other authentication credentials.

AI Model Training

Ora Tarot does not currently use private tarot questions, conversations, or reading history to train its own generative AI model.

We may analyze aggregated or appropriately de-identified information about use of Ora Tarot in order to understand product performance and improve the Services.

Our AI service providers may process information under their applicable service terms and data-processing arrangements. If our AI provider or our use of AI materially changes, we may update this Privacy Policy accordingly.

AI Outputs

AI-generated outputs may be inaccurate, incomplete, unexpected, or inappropriate.

Ora Tarot and its AI-generated content are intended for entertainment, personal reflection, and informational purposes. They are not a substitute for professional medical, mental-health, legal, financial, or other professional advice.

You should not rely on a tarot reading or AI-generated response to make decisions where professional advice is appropriate.

6. Sensitive Information

Because users may submit free-form questions, information entered into Ora Tarot may sometimes reveal sensitive information, including information concerning personal relationships, health, beliefs, sexuality, financial circumstances, or other private matters.

We do not require users to provide sensitive information in order to create an account.

Where applicable law requires a specific legal basis or explicit consent for processing certain categories of sensitive information, we will process such information only as permitted by applicable law.

Please do not submit sensitive information about another person unless you have the right to do so.

7. Legal Bases for Processing in the EEA and United Kingdom

If the GDPR, UK GDPR, or similar laws apply to our processing of your personal information, we rely on one or more of the following legal bases.

Performance of a Contract

Where processing is necessary to provide the Services you request, including:

  • creating and maintaining your account;
  • authenticating you;
  • providing readings;
  • providing AI-generated responses;
  • personalizing requested features;
  • maintaining reading history;
  • managing subscriptions; and
  • providing customer support.

Consent

Where we ask you to consent to particular processing, which may include:

  • microphone access;
  • certain notifications;
  • marketing communications;
  • certain optional analytics or tracking technologies; and
  • processing for which applicable law specifically requires consent.

You may withdraw consent at any time, although withdrawal does not affect processing already lawfully carried out.

Legitimate Interests

Where necessary for our legitimate interests, provided those interests are not overridden by your rights and interests, including:

  • maintaining and securing the Services;
  • detecting abuse or fraud;
  • troubleshooting;
  • understanding service performance;
  • improving Ora Tarot;
  • conducting limited internal analytics; and
  • protecting our legal rights.

Legal Obligations

Where processing is necessary to comply with a legal obligation applicable to us.

Legal Claims and Other Applicable Grounds

Where permitted by law, we may also process information where necessary to establish, exercise, or defend legal claims or under another legal basis recognized by applicable law.

8. How We Disclose Personal Information

We do not sell lists of your personal information.

We may disclose personal information to the following categories of recipients where reasonably necessary.

8.1 Supabase

We use Supabase as part of our backend infrastructure.

Depending on the final technical configuration, Supabase may process information including:

  • account information;
  • authentication information;
  • user identifiers;
  • profile information;
  • tarot reading history;
  • AI conversation history;
  • application data; and
  • technical information.

Supabase may process data in infrastructure regions selected for Ora. Where this results in an international transfer, the safeguards described in Section 10 apply.

8.2 Alibaba Cloud / Qwen

We may disclose information required to generate AI-powered responses to Alibaba Cloud Model Studio and Qwen models, as described in Section 5.

8.3 RevenueCat

We use RevenueCat to manage subscriptions and premium entitlements.

RevenueCat may process information such as:

  • App User ID or similar identifiers;
  • purchase history;
  • subscription status;
  • Apple receipt-related information;
  • product information;
  • device or operating-system information; and
  • related subscription metadata.

8.4 Apple

Apple may process information in connection with:

  • App Store distribution;
  • Sign in with Apple;
  • subscriptions;
  • in-app purchases;
  • payment processing;
  • purchase restoration; and
  • device-level permissions and notifications.

Apple’s processing of information under its own control is governed by Apple’s applicable privacy practices.

8.5 Google

If you use Google Sign-In, Google may process authentication-related information in accordance with Google’s own privacy practices.

8.6 Voice and Speech Processing Providers

If you use voice input, information may be disclosed to a speech-to-text or voice-processing service provider solely as necessary to provide the requested functionality.

The specific speech-to-text provider and processing configuration may change as our technical infrastructure evolves. We require providers processing personal information on our behalf to handle it consistently with applicable data-protection requirements and our contractual arrangements.

8.7 Analytics and Diagnostics Providers

We may use service providers to assist with analytics, application performance, error monitoring, or crash reporting.

These may include operational monitoring, analytics, application-performance, error-monitoring, or crash-diagnostics providers used to maintain and improve the Services.

8.8 Communications Providers

We may use third-party providers for:

  • email delivery;
  • support communications;
  • push notifications; and
  • marketing communications.

These providers may include email-delivery and support-communication services, Apple notification services, and other communications infrastructure used to deliver messages you request or have agreed to receive.

8.9 Professional Advisers and Legal Authorities

We may disclose information to lawyers, accountants, consultants, regulators, courts, government authorities, or law-enforcement authorities where reasonably necessary or legally required.

8.10 Business Transfers

If Ora Tarot or substantially all assets relating to the Services are transferred, reorganized, incorporated into a company, financed, merged, acquired, or sold, personal information may be disclosed or transferred as part of that transaction, subject to applicable law.

9. Sale, Sharing, and Targeted Advertising

Ora Tarot does not currently sell personal information.

Ora Tarot does not currently share personal information for third-party cross-context behavioral advertising and does not currently display third-party advertising within the application.

If we introduce advertising, advertising attribution, or cross-context behavioral advertising in the future, we will update this Privacy Policy and provide any notices, consent mechanisms, or opt-out controls required by applicable law.

Where Apple’s App Tracking Transparency framework applies, we will request any permission required by Apple before engaging in tracking that requires such permission.

10. International Data Transfers

Ora Tarot may be available to users worldwide.

Our service providers may process personal information in countries other than the country in which you reside. Data-protection laws in those countries may differ from the laws applicable in your jurisdiction.

Where required by applicable law, we will use appropriate mechanisms for international transfers of personal information, which may include:

  • adequacy decisions;
  • Standard Contractual Clauses;
  • the UK International Data Transfer Addendum or other approved UK mechanisms;
  • contractual safeguards; or
  • another transfer mechanism permitted by applicable law.

The exact locations in which data is processed may depend on the infrastructure regions and service providers selected for Ora Tarot.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Account Information

Account and profile information is generally retained while your Ora Tarot account remains active.

Deleting the Ora Tarot application from your device does not delete your Ora Tarot account.

Reading and Conversation History

Tarot reading and AI conversation history is generally retained for up to six (6) months, unless deleted earlier by you or in connection with account deletion.

Subscription Information

Certain subscription, transaction, or entitlement records may be retained for the period necessary to:

  • administer subscriptions;
  • verify purchases;
  • maintain accounting records;
  • prevent fraud;
  • resolve disputes; or
  • comply with applicable legal obligations.

Support Information

Support communications may be retained for a reasonable period necessary to resolve your request, maintain support records, protect legal rights, and comply with legal obligations.

Marketing Information

Marketing information may be retained until you unsubscribe or withdraw your consent, subject to limited retention where necessary to maintain a suppression list and ensure that your preference is respected.

Analytics and Aggregated Information

Aggregated or de-identified information that can no longer reasonably identify you may be retained for longer periods for analytics, research, security, and product-development purposes.

Backups

When information is deleted from active systems, residual copies may temporarily remain in secure backup systems until those backups are overwritten or deleted in accordance with the applicable backup-retention schedule.

We do not use backup copies to continue ordinary processing of information that has been deleted from active systems.

12. Account and Data Deletion

You may initiate deletion of your Ora Tarot account directly within the application.

When you delete your account, we will delete or de-identify personal information associated with the account from our active systems, subject to:

  • limited backup retention;
  • information we are legally required to retain;
  • information necessary to prevent fraud or abuse;
  • information necessary to establish, exercise, or defend legal claims; and
  • other limited exceptions permitted by applicable law.

Deleting an account is different from deleting the Ora Tarot application from your iPhone.

Uninstalling the application does not automatically delete your account or associated server-side information.

Where technically applicable, account deletion may also require us to instruct relevant service providers to delete or disassociate information held on our behalf.

13. Your Privacy Rights

Depending on where you live, you may have rights relating to your personal information.

These may include the right to:

  • request access to personal information we hold about you;
  • obtain a copy of certain personal information;
  • correct inaccurate or incomplete personal information;
  • request deletion of personal information;
  • restrict certain processing;
  • object to certain processing;
  • withdraw consent;
  • receive certain information in a portable format;
  • opt out of certain sales, sharing, targeted advertising, or profiling where applicable;
  • limit certain uses of sensitive personal information where applicable; and
  • lodge a complaint with a competent data-protection authority.

You may exercise available rights by contacting: support@oratarot.app

We may need to verify your identity before completing certain requests.

We will not discriminate against you for exercising privacy rights provided by applicable law.

Some rights may be subject to exceptions or limitations under applicable law.

14. EEA and UK Privacy Rights

If you are located in the European Economic Area or United Kingdom and applicable law grants you these rights, you may have the right to:

  • access your personal data;
  • rectify inaccurate personal data;
  • erase your personal data;
  • restrict processing;
  • object to processing based on legitimate interests;
  • receive certain personal data in a portable format;
  • withdraw consent at any time where processing relies on consent; and
  • lodge a complaint with your local supervisory authority.

Where applicable, you may also object to direct marketing at any time.

Our controller details are provided at the beginning of this Privacy Policy.

If we are legally required to appoint an EEA representative, we will publish that representative’s current contact details here before the requirement applies.

If we are legally required to appoint a UK representative, we will publish that representative’s current contact details here before the requirement applies.

15. California Privacy Notice

This section applies only to the extent that the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to Ora Tarot and to a particular processing activity.

Depending on applicable law, California residents may have rights to:

  • know the categories and specific pieces of personal information collected;
  • know the categories of sources from which personal information is collected;
  • know the business or commercial purposes for collection, use, sale, or sharing;
  • know categories of third parties to whom information is disclosed;
  • request deletion;
  • request correction;
  • opt out of the sale or sharing of personal information;
  • limit certain uses or disclosures of sensitive personal information; and
  • receive equal service and pricing without unlawful discrimination for exercising privacy rights.

No Current Sale or Sharing for Cross-Context Behavioral Advertising

Ora Tarot does not currently sell personal information or share personal information for cross-context behavioral advertising as those terms are defined by the CCPA.

If our practices change, we will provide the notices and controls required by applicable law.

Requests may be submitted to: support@oratarot.app

16. Users in Other Jurisdictions

Users in jurisdictions outside the EEA, United Kingdom, and California may have additional rights under applicable privacy and data-protection laws.

Where such laws apply to Ora Tarot, we will honor applicable rights and legal obligations.

We may provide additional jurisdiction-specific notices where necessary.

17. Children and Minimum Age

Ora Tarot is intended only for individuals who are at least 16 years old.

You may not create an Ora Tarot account or use the Services if you are under 16.

Because Ora Tarot collects a date of birth, we may use the date of birth you provide to determine whether you meet the minimum age requirement.

If the information provided during registration indicates that you are under 16, you will not be permitted to create or continue using an Ora Tarot account.

We do not knowingly collect personal information from children under 16.

If we learn that we have collected personal information from a person under 16 in violation of this policy or applicable law, we will take appropriate steps to delete the information and terminate or restrict the relevant account.

If you believe a person under 16 has provided personal information to Ora Tarot, please contact: support@oratarot.app

Users aged 16 or 17 should use the Services only where permitted under applicable law and with parent or guardian involvement where required by local law.

18. Permissions

Depending on the features you choose to use, Ora Tarot may request certain device permissions.

Microphone

Microphone permission may be requested if you use voice input.

You may deny or revoke microphone permission through iOS settings. If microphone permission is disabled, voice-input functionality may not be available, but other features of Ora Tarot may remain available.

Notifications

Ora Tarot may request permission to send push notifications.

You may change notification permissions through iOS settings.

Location

Ora Tarot does not currently request access to precise device location.

Camera, Photos, and Contacts

Ora Tarot does not currently require access to your camera, photo library, or contacts for its core functionality.

If this changes, we will request applicable device permission and update our privacy disclosures where required.

19. Data Security

We use reasonable administrative, organizational, and technical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These safeguards may include measures such as:

  • access controls;
  • authentication mechanisms;
  • encrypted transmission;
  • secure cloud infrastructure;
  • restricted administrative access; and
  • monitoring intended to identify security incidents.

However, no electronic transmission or storage system can be guaranteed to be completely secure.

You are responsible for maintaining the confidentiality of your account credentials and for notifying us if you believe your account has been compromised.

20. Automated Processing and Profiling

Ora Tarot uses automated systems and artificial intelligence to generate tarot interpretations and personalized responses.

Such processing is used to provide entertainment, personalization, and self-reflection features.

Ora Tarot does not currently use automated decision-making to make decisions that produce legal effects or similarly significant effects concerning you.

21. Third-Party Services

Certain features of Ora Tarot depend on third-party service providers.

These providers may process information on our behalf or, in certain circumstances, under their own privacy policies and legal responsibilities.

Our currently planned or used providers include:

  • Apple — application distribution, Sign in with Apple, subscriptions, and payments;
  • Google — authentication through Google Sign-In;
  • Supabase — backend infrastructure, authentication, database, and data storage;
  • RevenueCat — subscription and entitlement management;
  • Alibaba Cloud Model Studio / Qwen — AI processing and response generation;
  • speech-to-text providers used for optional voice input;
  • operational analytics, monitoring, and diagnostics providers;
  • Apple notification services and any supporting notification-routing infrastructure used by Ora; and
  • email-delivery and support-communication providers.

We require service providers that process personal information on our behalf to handle information consistently with applicable data-protection requirements and our contractual arrangements with them.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including where we:

  • introduce new features;
  • change our technology or service providers;
  • change our data-processing practices;
  • introduce advertising or new analytics technologies;
  • expand the Services; or
  • need to comply with changes in applicable law.

When we make changes, we will update the “Last Updated” date at the top of this Privacy Policy.

If changes materially affect your privacy rights or how we use personal information, we will provide additional notice or obtain consent where required by applicable law.

23. Contact Us

If you have questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact:

Ora Tarot
Operated by: Kate Lushnikova and Polina Lushnikova
Country: Russian Federation
Privacy email: support@oratarot.app
Website: https://oratarot.app