Privacy Policy

By default the app is built to keep your practice private. The following never leave your iPhone and are never sent to us:

• Your questions and the cards you draw.
• Readings generated on Free and Seeker tiers (written entirely on-device).
• Your Journal — saved only in local storage on your device.

We keep no server-side history of your readings, questions, or journal.

An account is optional and only needed for purchases, claiming or generating decks, and syncing your subscription. If you sign in with Apple, we receive and store an Apple user identifier and, if you share it, your email address and display name — used solely to identify your account, apply your subscription, and credit your token balance. We do not receive your Apple password.

If you register with an email address and password, we send that address a confirmation link and you cannot sign in until it is used — this is how we establish the address belongs to you. We use your address only for these service messages about your own account (confirming it, and anything we must tell you about a purchase or the account itself). We do not send marketing email and we do not sell or share your address.

If you choose an online-AI reading, the app sends the drawn cards, their positions, and your typed question to our AI provider (Google, via the Gemini API) to generate that single interpretation. This is clearly labelled in the app. We do not send anything else, and we do not store the reading as history.

When you generate custom deck art, the style description and any change requests you write are sent to our servers and to the AI image providers we use to render the art. Because every card keeps a browsable, restorable version history, the generation prompt and the resulting images are retained with the card. For legal-compliance and safety, a copy of each raw generated image is retained privately alongside its moderation result. Generated images may be shown publicly if you list a deck in the marketplace.

When an AI provider's safety filter rejects one of our generation prompts, we keep that prompt, the provider's reason, and the corrected prompt we sent instead for up to 30 days, so we can improve the wording our systems use and reduce failed generations. This applies to reading-video prompts too, which our servers write from your cards. These records are automatically deleted after 30 days, are never shown to anyone else, and are not used to build a profile of you.

To render a reading video, the question, the drawn cards and the written reading are sent to our servers so the film can be scripted and narrated. That content is held only while the job runs and is erased the moment it finishes, whether it succeeded or failed. The finished video is stored for 30 days so you can download it, and is then deleted along with the file itself.

If you publish a video to the gallery, it becomes public: anyone can watch it, and its link can be shared and previewed anywhere. What becomes public is the video, the caption you write, your display name, and the spread and deck the reading used — your question and the written interpretation are not published and are still not stored. A published video is kept for as long as it stays published, rather than for 30 days. Unpublishing returns it to the 30-day schedule, counted from then.

We record how many times a published video has been watched and who has liked it. The view count is a plain total with nothing identifying attached; a like is stored against your account so the star can be shown filled in and so you can undo it.

Subscriptions and token packs are processed by Apple through In-App Purchase. Apple handles the payment; we never see your card details. Our server verifies Apple's signed purchase receipt and records your subscription tier, token balance, and a transaction ledger (amounts and dates) so purchases apply to your account and can be restored.

• Account details (Apple user id, and email / display name if shared), and whether the address has been confirmed.
• Your token balance, subscription tier and expiry, and a transaction ledger.
• Decks you create or own: card images, generation prompts, and version history.
• Apple in-app purchase transaction identifiers (to prevent double-crediting).

We do not store your readings, questions, or Journal on our servers. The one exception is a reading video you deliberately publish to the gallery, which is covered in section 5.

We share data only with the processors needed to run these features:

• Apple — Sign in with Apple and In-App Purchase.
• Google — the Gemini API for online readings, deck-prompt processing, and language translation.
• Image generation and hosting — AI image providers to render deck art, and cloud storage (Cloudflare R2) to host the images.
• Infrastructure — our hosting and database providers, which store the account and deck data described above.

These providers process data on our behalf under their own terms; we do not sell your personal data.

We do not run third-party advertising or cross-app tracking, and we do not analyse the content of your readings. The app does not ask for the App Tracking Transparency permission because it does not track you.

Tarot Sanctum is rated 13+ and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

You can use the app without an account. Online readings can be turned off entirely in the app (More → Readings) so no reading data ever leaves your device. Depending on your region (including under the GDPR and CCPA), you may have the right to access, correct, or delete the personal data we hold, and to request a copy of it. To exercise any of these rights, or to delete your account and associated server-side data, email us at info@milearc.com.

We keep account, deck, and transaction data for as long as your account exists or as required for legal, tax, and safety obligations, and delete it on request as described above. Data in transit is encrypted, and access to stored data is restricted. No system is perfectly secure, but we take reasonable measures to protect your information.

We may update this policy as the app evolves. Material changes will be reflected here with a new “last updated” date.

Questions about this policy or your data? Email info@milearc.com.