Privacy Policy

We value your trust and strive to make StarTarot.online safe and transparent. This document explains in detail what data we collect, how we use it, and what rights you have.

This document was last updated on 13 September 2026. If we make changes, we will notify users through the available channels.

What data we collect

• Contact details — the name and email address you provide when registering or filling in a contact form.
• Astro profile — date, time and place of birth, if you use personal horoscopes, a natal chart or compatibility readings.
• Other people’s data — when you save a profile for synastry, compatibility or a partner bodygraph, you give us another person’s date, time and place of birth, along with the label you recognize them by.
• Readings and requests — your question for a spread, a dream description, the calculation input and the text of the answer are kept in your account history. The same applies to support requests and actions in your account.
• Purchases — your plan, the remaining request balance and records of completed transactions: what was bought and when.
• Technical information — IP address, country, device type, browser language and cookies. We keep the IP address and country with your account so we can show the payment options available in your region.
• How you reached us — where you came to the site from: the tags of an advertising link, the address of the referring page, or a “direct visit” marker. To connect that visit with a later sign-up, we store an identifier called st_cid in your browser for 30 days, on our domain only. We do not pass it to third parties and do not use it for advertising on other sites. If you install our Android app from a Google Play link, the app reads that link’s tags once after installation, sends them to us and keeps the identifier it receives on your device for 30 days, to connect the installation with a later sign-up.
• Mobile app and notifications — when you use our mobile app, we additionally process a technical push-notification token of your device, the platform (iOS/Android), time zone, interface language and app version. This data is used solely to deliver the notifications you have enabled and to send them at an appropriate local time.
• Photo of a spread — a picture you take in the app is sent only to recognize the cards. It is not stored on our servers or in your history — only the card names and their positions remain.
• Journal and memory — if you enable the “How did yesterday go?” block on the Today page, we store your note and derive short conclusions about your circumstances so that recommendations account for your situation. The feature requires your explicit consent and can be switched off at any time. Note text is kept for a limited period (30 days by default), after which only the conclusions remain. Any conclusion can be edited or deleted, and the whole memory can be erased in your account. We do not store health, religious, political or sex-life data in this memory. Questions you ask the AI astrologer go into the same memory under the same consent; the messages of the conversation are kept for 90 days. Any single message or conclusion can be deleted.
• Your current city — if you tell us the city you live in, we store its name and approximate coordinates rounded to about ten kilometres — enough for a weather forecast and sunrise times, and not enough to pinpoint where you are. We never request device location: you type the city yourself. It is optional and can be removed at any time under “What I remember about you”.

On what basis we process your data

We process personal data only where we have a lawful basis for it.

• Performance of a contract — registration, access to readings, handling payments and answering requests. The service cannot work without this data.
• Your consent — the journal and memory, your current city, push notifications and analytics cookies. Consent is given separately and can be withdrawn at any time — this does not affect the lawfulness of processing before withdrawal.
• Legitimate interest — keeping the service secure, preventing abuse, anonymized statistics and measuring which channels bring visitors — including storing the st_cid identifier in your browser and its counterpart in the Android app.
• Legal obligation — keeping payment records and responding to lawful requests from the authorities.

How we use your information

1. To provide the services you have chosen and create personalized recommendations.
2. To maintain your account, respond to questions, and send important notifications.
3. For analytics and interface improvements: we review anonymized metrics and usage scenarios.
4. To comply with legal requirements, for example to store documents related to payments and requests.
5. To send push notifications you have enabled in the mobile app — morning reminders, notices that automatically generated content is ready, and astro-calendar events — and to create that content automatically on your schedule.
6. To measure which advertising campaigns bring visitors if you arrived through an advertising link.

Who we share data with

We do not sell your data and do not share it for someone else’s advertising. Some work is done by contractors — they act under a contract, strictly on our instructions, and may not use the data for their own purposes:

• AI model providers — writing the readings and recognizing a photographed spread;
• payment services — taking payment on the website;
• app stores — purchases inside the mobile app;
• a cloud notification service — delivering push messages to your device;
• a web analytics service (Google Analytics) — anonymized visit statistics, only with your consent;
• an error-monitoring service — technical crash reports, without the content of your requests;
• a weather forecast service — the request goes from our server by city coordinates, without your name, account or device identifier;
• an email delivery service and our hosting provider.

Some of these contractors are located outside the European Economic Area, so data may be transferred to third countries. Such transfers rely on standard contractual clauses, which oblige the recipient to provide a comparable level of protection.

We will name the specific providers on request — just write to the address below.

Our core principles

Age of our users

The service is intended for adults. It is not directed at children and we do not knowingly collect data from anyone under 18.

If we learn that an account was created by a child, we will delete it together with the data. Parents and guardians can report such an account using the contacts below.

Your rights

• To obtain information about what personal data we store and how we process it.
• To request correction of inaccurate data or its update.
• To request deletion of personal data once it is no longer needed to provide services or handle requests.
• To restrict processing and to object to it, including the use of data for marketing purposes.
• To receive a copy of your data in a machine-readable format and pass it to another controller.
• To withdraw consent you gave earlier — this does not affect the lawfulness of processing before withdrawal.
• To delete your account yourself — see the “Account deletion” section for how.
• To lodge a complaint with the data protection authority in your country of residence.

To exercise your rights, write to us at the email address below. We reply within one month; if a request is complex the deadline may be extended, and we will tell you so and explain why.

Account deletion

You can delete your StarTarot account at any time, with or without the app. Deletion is permanent and cannot be undone.

In the mobile app: Account → Delete account. We ask for confirmation twice, after which the account is deleted immediately.

On the website: the “Delete account” page (startarot.online/delete-account). Sign in and confirm by typing your own address. No app needed.

If you no longer have access to the account: write to help@startarot.online from the address it is registered to. We reply within 30 days.

• Deleted: your profile, birth data and saved people, reading history, journal entries and memory, the remaining request balance, push tokens and newsletter subscriptions.
• Kept by us in anonymised form: records of payment transactions (amounts, dates, payment identifiers), which accounting law requires us to retain, and your correspondence with support, which is not tied to the account. The payment providers (Google Play, the App Store, Stripe) keep their own records independently of us.
• If a subscription from the App Store or Google Play is still running when you delete, we offer to keep the option of restoring it. Only with your consent do we keep an irreversible fingerprint of your address and the purchase identifier, so that returning with the same address restores the access you paid for and you are not charged twice. We cannot recover your address from the fingerprint. We keep this for as long as the paid period lasts and erase it shortly after it ends.

A card subscription bought on the website is cancelled by us when you delete the account. A Google Play or App Store subscription we cannot cancel for you — do it in your store settings, or billing continues.

Go to account deletion

Data retention periods

We keep your data while you use the service. When you delete your account, your profile, birth data, reading history and memory records are deleted with it. Records of payment transactions remain with the payment providers and in accounting documents for the periods required by law — usually up to 5 years.

Analytics-related cookies have a lifespan from 30 days to 13 months. The st_cid identifier, which shows the channel you came from, is kept for 30 days and renewed on each visit; a copy held in browser storage lasts the same 30 days, is renewed by the same visit and expires together with the cookie. You can delete them earlier in your browser settings. The Android app keeps the identifier from a Google Play link for 30 days after installation without renewing it; uninstalling the app or clearing its data deletes it at once.

Device push tokens are stored only while notifications are enabled: they are removed when you turn notifications off, sign out, or delete your account, and become invalid when the app is uninstalled.

Security and data transfers

We use HTTPS, multi-level access to the admin panel, regular backups, and anomaly monitoring. When we engage third parties (for example, payment systems), we sign confidentiality agreements and require them to meet data processing standards.

To produce your reading, the data you enter — your question for a spread, a dream description, birth details — is sent over an encrypted connection to an AI model. This data is not used to train models. We do not pass on your name, email, or payment details.

If you send a photo of your spread from the mobile app, it is sent solely to recognize the cards. The photo is not stored on our servers or in your history — we keep only the recognition result: the card names and their positions.

If a security incident occurs that affects your data, we will notify you and, where required, the relevant regulators in accordance with applicable law.

Contact details

If you have any questions about how we process data, please contact us — we will be happy to help.