Privacy Policy

We value your trust and strive to make StarTarot.online safe and transparent. This document explains in detail what data we collect, how we use it, and what rights you have.

This document was last updated on 24 October 2026. If we make changes, we will notify users through the available channels.

What data we collect

• Contact details — the name and email address you provide when registering or filling in a contact form.
• Astro profile — date, time and place of birth, if you use personal horoscopes, a natal chart or compatibility readings.
• Other people’s data — when you save a profile for synastry, compatibility or a partner bodygraph, you give us another person’s date, time and place of birth, along with the label you recognize them by.
• Readings and requests — your question for a spread, a dream description, the calculation input and the text of the answer are kept in your account history. The same applies to support requests and actions in your account.
• Purchases — your plan, the remaining request balance and records of completed transactions: what was bought and when.
• Technical information — IP address, country, device type, browser language and cookies. We keep the IP address and country with your account so we can show the payment options available in your region.
• How you reached us — where you came to the site from: the tags of an advertising link, the address of the referring page, or a “direct visit” marker. To connect that visit with a later sign-up, we store an identifier called st_cid in your browser for 30 days, on our domain only. We do not pass it to third parties and do not use it for advertising on other sites. If you install our Android app from a Google Play link, the app reads that link’s tags once after installation, sends them to us and keeps the identifier it receives on your device for 30 days, to connect the installation with a later sign-up.
• Mobile app and notifications — when you use our mobile app, we additionally process a technical push-notification token of your device, the platform (iOS/Android), time zone, interface language and app version. This data is used solely to deliver the notifications you have enabled and to send them at an appropriate local time.
• Photo of a spread — a picture you take in the app is sent only to recognize the cards. It is not stored on our servers or in your history — only the card names and their positions remain.
• Journal and memory — if you enable the “How did yesterday go?” block on the Today page, we store your note and derive short conclusions about your circumstances so that recommendations account for your situation. The feature requires your explicit consent and can be switched off at any time. Note text is kept for a limited period (30 days by default), after which only the conclusions remain. Any conclusion can be edited or deleted, and the whole memory can be erased in your account. We do not store health, religious, political or sex-life data in this memory. Questions you ask the AI astrologer go into the same memory under the same consent; the messages of the conversation are kept for 90 days. Any single message or conclusion can be deleted.
• Your current city — if you tell us the city you live in, we store its name and approximate coordinates rounded to about ten kilometres — enough for a weather forecast and sunrise times, and not enough to pinpoint where you are. We never request device location: you type the city yourself. It is optional and can be removed at any time under “What I remember about you”.

On what basis we process your data

We process personal data only where we have a lawful basis for it.

• Performance of a contract — registration, access to readings, handling payments and answering requests. The service cannot work without this data.
• Your consent — the journal and memory, your current city, push notifications and analytics cookies. Consent is given separately and can be withdrawn at any time — this does not affect the lawfulness of processing before withdrawal.
• Legitimate interest — keeping the service secure, preventing abuse, anonymized statistics and measuring which channels bring visitors — including storing the st_cid identifier in your browser and its counterpart in the Android app.
• Legal obligation — keeping payment records and responding to lawful requests from the authorities.

How we use your information

1. To provide the services you have chosen and create personalized recommendations.
2. To maintain your account, respond to questions, and send important notifications.
3. For analytics and interface improvements: we review anonymized metrics and usage scenarios.
4. To comply with legal requirements, for example to store documents related to payments and requests.
5. To send push notifications you have enabled in the mobile app — morning reminders, notices that automatically generated content is ready, and astro-calendar events — and to create that content automatically on your schedule.
6. To measure which advertising campaigns bring visitors if you arrived through an advertising link.

Emails from us

We send two kinds of email: service emails, which are always sent, and StarTarot promotional emails, which you receive only with your consent.

• Service emails — confirming your address, resetting your password, security notices (for example about account deletion), replies from support and a welcome email after you confirm your address. They are sent regardless of your email settings. The basis is performance of the contract and our legitimate interest.
• Promotional emails — StarTarot emails such as forecasts, highlights, service news and offers. They concern only StarTarot’s own services: there is no third-party advertising in them, and we do not send emails on behalf of others. They are sent only with your consent (Art. 6(1)(a) GDPR) and are off by default. Consent is given only actively: with the “Send me StarTarot emails: forecasts, highlights, service news and offers” checkbox at sign-up, which is left unticked, with a single switch in your account or app settings, or with “Yes” on the offer on the site and in the app. Consent counts only for a confirmed address. We do not send promotional emails merely because you have an account.
• Unsubscribing — at any time. Every promotional email carries a List-Unsubscribe header, which mail apps (Gmail, Apple Mail and others) show as an “Unsubscribe” button that works in one click. The link in every promotional email opens a page where you unsubscribe with one button, without signing in. You can also switch promotional emails off in your account or app settings. A link in an email can only switch them off; to switch them back on, use the settings.
• Opens and clicks — our email delivery service Brevo records, for all our emails including service ones, whether an email was opened (through a tiny invisible image) and which links were clicked (links pass through Brevo’s redirect address). On our plan this cannot be switched off for individual emails. We keep these events in the send log and do not use opens for any decision. You can block open tracking by turning off automatic loading of remote images in your mail app.
• What we keep — your current choice; a consent log — when promotional emails were switched on or off, from where (sign-up form, account, app, offer, link in an email) and which version of the wording you saw; a send log — which email, when, its delivery status and the open and click events — for no longer than 400 days; the language and time zone of your emails, so that they arrive in your language during the day, between 08:00 and 20:00 your local time. We do not record IP addresses in the consent log. To see whether promotional emails are useful, we measure their effect: clicks, visits and purchases within 7 days after an email; for this, a small control group of recipients may not receive a particular email. The basis for this measurement is our legitimate interest in knowing whether our emails are useful and not sending useless ones (Art. 6(1)(f) GDPR).
• Do-not-email list — if an email to your address bounces, if it is reported as spam or if the address unsubscribes, we keep a pseudonymised fingerprint (hash) of the address computed with a secret key that is kept outside the database — not the address itself — so that we do not write to it again, even after the account is deleted. The basis is our legitimate interest in not emailing people who have unsubscribed, complained or whose address does not accept mail (Art. 6(1)(f) GDPR). We keep the entry for as long as that purpose requires; an entry for a temporary delivery failure is kept for 30 days. Your email preferences and consent log are deleted together with the account.
• Who sends them — StarTarot.online, Tauro gatvė 12, 01114 Vilnius, Lithuania. Emails go out through our email delivery service, Brevo (Sendinblue SAS, France, EU). Questions about emails can be sent to the contacts at the end of this document.

Who we share data with

We do not sell your data and do not share it for someone else’s advertising. Some work is done by contractors — they act under a contract, strictly on our instructions, and may not use the data for their own purposes:

• AI model providers — writing the readings and recognizing a photographed spread;
• payment services — taking payment on the website;
• app stores — purchases inside the mobile app;
• a cloud notification service — delivering push messages to your device;
• a web analytics service (Google Analytics) — anonymized visit statistics, only with your consent;
• an error-monitoring service — technical crash reports, without the content of your requests;
• a weather forecast service — the request goes from our server by city coordinates, without your name, account or device identifier;
• an email delivery service and our hosting provider.

Some of these contractors are located outside the European Economic Area, so data may be transferred to third countries. Such transfers rely on standard contractual clauses, which oblige the recipient to provide a comparable level of protection.

We will name the specific providers on request — just write to the address below.

Our core principles

Age of our users

The service is intended for adults. It is not directed at children and we do not knowingly collect data from anyone under 18.

If we learn that an account was created by a child, we will delete it together with the data. Parents and guardians can report such an account using the contacts below.

Your rights

• To obtain information about what personal data we store and how we process it.
• To request correction of inaccurate data or its update.
• To request deletion of personal data once it is no longer needed to provide services or handle requests.
• To restrict processing and to object to it, including the use of data for marketing purposes.
• To receive a copy of your data in a machine-readable format and pass it to another controller.
• To withdraw consent you gave earlier — this does not affect the lawfulness of processing before withdrawal.
• To delete your account yourself — see the “Account deletion” section for how.
• To lodge a complaint with the data protection authority in your country of residence.

To exercise your rights, write to us at the email address below. We reply within one month; if a request is complex the deadline may be extended, and we will tell you so and explain why.

Account deletion

You can delete your StarTarot account at any time, with or without the app. Deletion is permanent and cannot be undone.

In the mobile app: Account → Delete account. We ask for confirmation twice, after which the account is deleted immediately.

On the website: the “Delete account” page (startarot.online/delete-account). Sign in and confirm by typing your own address. No app needed.

If you no longer have access to the account: write to help@startarot.online from the address it is registered to. We reply within 30 days.

• Deleted: your profile, birth data and saved people, reading history, journal entries and memory, the remaining request balance, push tokens and newsletter subscriptions.
• Kept by us in anonymised form: records of payment transactions (amounts, dates, payment identifiers), which accounting law requires us to retain, and your correspondence with support, which is not tied to the account. The payment providers (Google Play, the App Store, Stripe) keep their own records independently of us.
• If a subscription from the App Store or Google Play is still running when you delete, we offer to keep the option of restoring it. Only with your consent do we keep an irreversible fingerprint of your address and the purchase identifier, so that returning with the same address restores the access you paid for and you are not charged twice. We cannot recover your address from the fingerprint. We keep this for as long as the paid period lasts and erase it shortly after it ends.
• One-time welcome bonuses (the sign-up bonus and the bonus for joining with a friend’s code) are given once per mailbox. So that a deleted account cannot claim them again, after deletion we keep an irreversible fingerprint of your address in a normalised form (for example, without the dots and “+” tags of Gmail addresses) — without your name, without the address itself and without any other account data. We cannot recover your address from it; it is used only to check whether the bonus has already been given. The legal basis is our legitimate interest in protecting the bonus programme from abuse. We keep it for as long as the bonus programme runs.

A card subscription bought on the website is cancelled by us when you delete the account. A Google Play or App Store subscription we cannot cancel for you — do it in your store settings, or billing continues.

Go to account deletion

Data retention periods

We keep your data while you use the service. When you delete your account, your profile, birth data, reading history and memory records are deleted with it. Records of payment transactions remain with the payment providers and in accounting documents for the periods required by law — usually up to 5 years.

Analytics-related cookies have a lifespan from 30 days to 13 months. The st_cid identifier, which shows the channel you came from, is kept for 30 days and renewed on each visit; a copy held in browser storage lasts the same 30 days, is renewed by the same visit and expires together with the cookie. You can delete them earlier in your browser settings. The Android app keeps the identifier from a Google Play link for 30 days after installation without renewing it; uninstalling the app or clearing its data deletes it at once.

Device push tokens are stored only while notifications are enabled: they are removed when you turn notifications off, sign out, or delete your account, and become invalid when the app is uninstalled.

Security and data transfers

We use HTTPS, multi-level access to the admin panel, regular backups, and anomaly monitoring. When we engage third parties (for example, payment systems), we sign confidentiality agreements and require them to meet data processing standards.

To produce your reading, the data you enter — your question for a spread, a dream description, birth details — is sent over an encrypted connection to an AI model. This data is not used to train models. We do not pass on your name, email, or payment details.

If you send a photo of your spread from the mobile app, it is sent solely to recognize the cards. The photo is not stored on our servers or in your history — we keep only the recognition result: the card names and their positions.

If a security incident occurs that affects your data, we will notify you and, where required, the relevant regulators in accordance with applicable law.

Contact details

If you have any questions about how we process data, please contact us — we will be happy to help.