Privacy Policy

1. Information We Collect

• Account information (via Google Sign-In): your Google user ID, display name, email address, and profile picture URL. We only request the basic openid, email, and profile scopes — we never read your Gmail, contacts, files, or any other Google service data.
• Email & password accounts: if you register with email, we store your email address and a salted, irreversible hash of your password (plain passwords cannot be recovered).
• Reading content: the question you submit, the cards drawn, the AI-generated interpretation text, and the timestamp. This is associated with your account to power the reading history feature.
• Usage data: your daily number of readings, used to enforce free/paid quotas.
• Technical information: your IP address, recorded with readings for provenance and security.
• Subscription data: payments are processed by Stripe; we store only the plan tier, subscription status, and Stripe customer/subscription identifiers. We never store full card numbers.

2. How We Use Information

• To create and verify your account and keep you signed in;
• To provide scripture readings and save your reading history;
• To enforce free/paid quotas and spread permissions;
• To process subscriptions and payments;
• To keep the service secure and prevent abuse;
• We do not sell your personal information and do not use it for advertising.

3. AI Processing of Reading Content

To generate interpretations, the question you submit and the cards drawn are sent to OpenAI via its API for text generation. OpenAI processes that request content under its own privacy policy. Please avoid including sensitive personal information in your question that you would not want processed.

4. Third-Party Services

5. Cookies

We only use essential cookies: a sign-in session cookie (keeps you logged in, ~30 days), a language-preference cookie (remembers your chosen display language, ~1 year), one-time OAuth state/language cookies (expire within 10 minutes), and an anonymous client identifier (quota control for signed-out users). We do not use advertising or tracking cookies.

6. Data Retention & Deletion

Account and reading records are retained until you request deletion. Email the contact address below to request account deletion; we will delete your account, readings, and usage data within 30 days (except records we must keep by law). You can also revoke this App's access at any time from your Google Account security settings.

7. Data Security

Data is hosted on Cloudflare infrastructure; passwords are stored as salted PBKDF2 hashes, never in plain text; all traffic uses HTTPS; credentials and secrets are loaded only from environment variables / secret management and are never committed to the repository.

8. Your Rights

You may access, correct, export, or delete the personal information associated with your account, revoke Google authorization, or close your account. To exercise these rights, contact us via the email below and we will respond within a reasonable period.

9. Children's Privacy

The App is not directed to children under 13 and we do not knowingly collect their personal information. If we learn such information has been collected, we will delete it promptly.

10. Changes to This Policy

If we make material changes, we will update this page and the "Last updated" date. Continued use of the App after changes means you accept the updated policy.

11. Contact Us

For any questions, requests, or complaints about this privacy policy, contact:joechenst@gmail.com