Privacy Policy

Last updated: July 26, 2026

This Privacy Policy explains how Tarotoo (“we,” “us,” or “our”) processes personal information when you use tarotoo.com (the “Website”), Tarotoo mobile applications (the “Apps”), or contact us. Together, these are the “Services.”

Tarotoo is operated by Yaroslav Kyrychenko, who is the controller of personal information processed through the Services.

Yaroslav Kyrychenko
Dobrovolchykh Batalioniv 11
Bila Tserkva, Kyiv Region 09113
Ukraine
Email: [email protected]

1. Information We Process

Information you provide

Depending on the feature you use, you may provide:

• reading information, such as your question, message, selected cards or other selections, name, date of birth, zodiac sign, or a photo;
• communications you send to us, including your email address and the contents of your support request or other message;
• your email address and subscription preferences if you ask to receive newsletters or promotional emails; and
• information connected with an App purchase or subscription, such as a transaction, purchase, or subscription identifier and its current status.

You do not need to create a Tarotoo account to use the Services. Please do not include unnecessary sensitive or confidential information, or personal information about another person unless you are authorized to provide it.

Providing information is generally optional, but we may be unable to generate a requested reading, respond to you, or provide a purchased feature without the information needed for that purpose.

Information collected automatically

When you use the Website, our systems and service providers may process technical information such as your IP address, date and time of access, requested URL, response status, referring page, browser or device type, language or locale, and cookie-consent choices. If you consent to analytics cookies, Google Analytics also collects information about how visitors use the Website.

When you use an App, Apple, Google, or the relevant app store may independently collect device, diagnostic, purchase, and usage information under its own privacy terms. Tarotoo does not currently use third-party advertising or analytics SDKs in the Apps.

2. AI Features and Reading History

When you use an AI-powered feature, the information you submit and relevant reading selections are transmitted to OpenAI, our AI service provider, so that it can generate the requested response. Depending on how the Service is technically delivered, this transmission may occur directly from the App or through Tarotoo’s systems.

Tarotoo does not require user accounts and does not retain prompts or generated responses as a server-side reading history. Reading history on the Website is not stored by Tarotoo. If an App offers reading history, it is stored locally on your device and can be removed through the App or by uninstalling it.

Tarotoo does not use your prompts or responses to train its own AI models. OpenAI states that data submitted through its API is not used to train OpenAI models by default unless the customer opts in; Tarotoo keeps optional data sharing disabled. OpenAI may retain API content and related metadata for up to 30 days for abuse monitoring, subject to its applicable data controls and legal or security exceptions. For more information, see OpenAI’s API data controls.

AI-generated readings are provided for entertainment and self-reflection. Tarotoo does not use automated processing to make decisions that produce legal or similarly significant effects about you.

3. Why We Process Information

We process personal information for the following purposes and, where applicable, on the following legal bases:

• Providing the Services: to generate requested readings, operate App features, and manage purchases or subscriptions. This is necessary to perform our contract with you or to take steps at your request.
• Support and communications: to respond to questions, requests, and feedback. This is based on performing our contract or our legitimate interest in supporting and improving the Services.
• Optional marketing: to send a newsletter or promotional email that you requested. This is based on your consent, which you may withdraw at any time.
• Security and reliability: to prevent abuse, protect the Services, diagnose errors, and maintain technical operations. This is based on our legitimate interests in operating secure and reliable Services.
• Website analytics: to understand Website use and improve performance. We use Google Analytics only after you consent where consent is required.
• Legal compliance: to keep records, respond to lawful requests, enforce our terms, and establish or defend legal claims. This is based on legal obligations or our legitimate interests.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before you withdrew consent.

4. Website Cookies and Similar Technologies

This section applies to the Website, not the Apps. The Website uses a small number of cookies and similar browser-storage technologies:

Essential technologies are used because they are necessary for security or to remember your privacy choices. Google Analytics technologies are blocked until you consent through the cookie banner. You may accept or decline analytics cookies and later change your choice using the “Consent Preferences” link in the Website footer. The Termly cookie banner also provides access to a more detailed, automatically updated Cookie Policy.

Tarotoo does not currently place Google Ads, DoubleClick, or other advertising cookies on the Website. In Google Analytics, event-level data is set to be retained for 2 months and user-level data for 14 months. Google may retain aggregated reports that are not affected by those settings. You can learn more in Google’s Privacy Policy.

5. How We Disclose Information

We disclose information only as needed for the purposes described in this Policy, including to the following providers:

• OpenAI, to process AI requests and generate responses;
• DigitalOcean, for origin-server hosting;
• Cloudflare, for content delivery, caching, security, and protection against malicious traffic;
• Private Email, for hosting and delivering email communications;
• Termly, for managing cookie notices and consent preferences;
• Google Analytics, for consent-based Website analytics; and
• Apple App Store and Google Play, for App distribution, purchases, subscriptions, and related administration.

These providers may process information on our behalf under contractual restrictions. Some providers, including app stores, may also process information as independent controllers under their own privacy policies.

We may also disclose information when required by law, to protect the rights and safety of users or others, to investigate misuse, or in connection with a merger, acquisition, reorganization, or sale of all or part of the business. We do not sell personal information or share it for cross-context behavioral advertising.

6. App Purchases and Affiliate Links

Payments for App purchases and subscriptions are processed by Apple or Google. Tarotoo does not receive your full payment-card details. We may receive a purchase or subscription identifier, product information, transaction status, renewal or expiration information, and related records needed to provide purchased features and handle support.

The Services may contain affiliate links. A link may include a referral identifier, and Tarotoo may receive a conversion or commission report if you make a qualifying purchase. After you follow an external link, the destination site and any affiliate partner process information under their own privacy policies and may act as independent controllers. For more information about Tarotoo’s affiliate relationships see our Affiliate & Revenue Disclosure.

7. How Long We Keep Information

We keep personal information only for the periods described below or as otherwise required for legal, security, accounting, or dispute-resolution purposes:

• AI readings: Tarotoo does not keep prompts or responses as a server-side reading history. OpenAI may retain API content and related metadata for up to 30 days for abuse monitoring, subject to its data controls and legal or security exceptions.
• Local App history: kept on your device until you delete it through the App, clear the App’s data, or uninstall the App.
• Origin-server logs: Tarotoo’s Nginx access and error logs are normally kept for approximately 15 days, unless a specific security incident or legal obligation requires longer retention.
• Google Analytics: event-level data is set to 2 months and user-level data to 14 months; aggregated reports may remain available for longer.
• Cookies and browser storage: retained for the periods shown in Section 4, unless you delete them sooner.
• Support and other communications: kept until the request is resolved and afterward only while reasonably needed for follow-up, dispute records, or applicable legal limitation periods.
• Marketing subscriptions: kept until you unsubscribe or withdraw consent. We may keep a limited suppression record afterward so that we can honor your opt-out.
• Purchase and subscription records: kept for as long as needed to provide purchased features and meet tax, accounting, fraud-prevention, and legal requirements.

We may retain information for longer where required by law, necessary to establish or defend legal claims, or needed to investigate a security incident.

Where a provider processes information for its own purposes as an independent controller, that provider determines its retention period under its own privacy policy.

8. International Data Transfers

Tarotoo is based in Ukraine, and our service providers may process information in the United States and other countries where privacy laws may differ from those in your country. Where required, we use appropriate transfer safeguards, such as adequacy decisions, standard contractual clauses, the UK Addendum, or other lawful contractual mechanisms.

9. Security

We use reasonable technical and organizational measures designed to protect personal information, including encrypted transmission, access controls, security services, and limited retention. No online service can guarantee absolute security, so please use care when choosing what information to submit.

10. Your Privacy Rights and Choices

Depending on where you live, you may have the right to:

• request access to and a copy of your personal information;
• correct inaccurate or incomplete information;
• request deletion of your information;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent at any time; and
• appeal or complain to your local data-protection authority.

Residents of certain U.S. states may also have rights to know, correct, delete, or obtain a copy of personal information and to opt out of certain uses. Tarotoo does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable privacy right.

To make a request, email [email protected]. We may need to verify your request. Because local App reading history remains on your device and is not linked to an account, Tarotoo may not be able to access or delete that data remotely; you can delete it through the App, clear the App’s data, or uninstall the App.

You can change Website analytics consent at any time through the “Consent Preferences” link in the Website footer. You can manage App subscriptions through your Apple App Store or Google Play account.

You can opt out of marketing emails at any time by using the unsubscribe option in the email or contacting [email protected].

11. Children

The Services are intended only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided personal information through the Services, contact us at [email protected].

12. External Services

The Services may link to third-party websites, stores, or services. Their privacy practices are governed by their own notices, and this Privacy Policy does not apply to information they process independently.

13. Changes to This Policy

We may update this Privacy Policy when our practices, providers, or legal obligations change. We will post the updated version here and change the “Last updated” date. If a change materially affects how we process personal information, we will provide additional notice where required.

14. Contact Us

If you have questions or want to exercise a privacy right, contact:

Yaroslav Kyrychenko
Dobrovolchykh Batalioniv 11
Bila Tserkva, Kyiv Region 09113
Ukraine
Email: [email protected]