Lyvu Tarot
EN
Privacy Policy

Privacy Policy

Last Updated: March 2026

1. Data Controller & Contact Information

Lyvu Tarot ("the Application", "we", "us") is a digital platform dedicated to contemplative personal reflection, archetypal inquiry, and symbolic tarot and astrological study. We process personal information in strict compliance with the General Data Protection Regulation (GDPR - EU 2016/679) and applicable data protection legislation.

Data Controller:

Lyvu Tarot (Digital application operated by the project owner)

Privacy Inquiries & User Rights:

Users may exercise data protection rights at any time (including complete data and account deletion) directly within the application via the User Profile controls, or by contacting the project via official channels.

2. Categories of Personal Data Collected

  • Authentication Data (User Accounts): When creating an account or logging in (via email/password or Google Sign-In powered by Firebase Authentication), we process your email address, display name, and unique user identifier (UID).
  • Journal Notes, Reflections & Saved Readings: Your contemplative journal entries, personal reflection notes, saved tarot spread records, and card collection progress are persisted securely in Cloud Firestore scoped exclusively to your authenticated UID.
  • Compatibility & Synastry Input Data: When utilizing the astrological compatibility feature, you voluntarily submit: individual names or pseudonyms, birth dates, optional birth times, calculated zodiac placements (Sun, Moon, Rising), and Life Path numbers. These parameters are used solely to synthesize your relationship analysis and are never repurposed for profiling.
  • Tarot & Horoscope Inquiry Inputs: User-entered reflection inquiries (up to 500 characters), selected tarot cards, orientations (upright/reversed), spread types, chosen zodiac signs, calendar date keys, and device IANA timezones.
  • Technical Telemetry, Security & Rate Limiting: Client IP addresses (processed strictly in transient memory or short-lived rate-limiting caches with automatic 60-second TTL to mitigate DDoS and quota exhaustion) and UI preferences (selected language stored locally in browser localStorage).

3. Processing via Artificial Intelligence (Google Gemini API)

Guided tarot syntheses, relationship synastry analyses, and daily horoscopes utilize the Google Gemini API via secure, server-proxied endpoints. Only the data strictly necessary to fulfill your request is transmitted to Gemini: your inquiry text, drawn cards, submitted birth/astrological parameters, and requested date/period.

Your inquiries are never sold to data brokers or used for targeted advertising. Transmissions do not contain payment credentials or passwords.

4. Purposes & Legal Bases for Processing

Contractual Performance & Service Delivery (Art. 6(1)(b) GDPR): Managing user accounts, persisting personal journal reflections, and delivering the tarot readings, horoscopes, and synastry reports actively requested by the user.

Legitimate Interests (Art. 6(1)(f) GDPR): Maintaining server infrastructure security, preventing abuse and denial-of-service attempts, enforcing rate limits, and securing backend resources.

User Consent (Art. 6(1)(a) GDPR): Voluntary submission of optional personal or third-party birth details for synastry and compatibility calculations.

5. Recipients, International Transfers & Retention Periods

  • Service Providers (Data Processors): Google Cloud Platform / Firebase (hosting, Firestore database, authentication), Google Gemini API (natural language synthesis), and Upstash (distributed rate-limiting cache).
  • International Transfers: Where cloud infrastructure is hosted outside the European Economic Area (e.g., United States), transfers are governed by standard contractual clauses (SCCs) approved by the European Commission.
  • Retention Periods: Account and journal data are retained indefinitely until the user initiates account or entry deletion. Transient rate-limiting records expire automatically within 60 seconds. Client localStorage cache can be cleared by the user at any time.

6. Complete Account & Data Deletion (Right to Erasure)

In accordance with Article 17 of the GDPR (Right to Erasure), you have full self-service capability to immediately and permanently delete all your stored data:

Automated In-App Deletion Procedure:

  1. Sign in to your Lyvu Tarot account.
  2. Navigate to "Journal & Profile" and select the "Profile" tab.
  3. Locate "Delete Account & Data" and confirm the deletion dialog.

This procedure recursively deletes the user root document and all subcollections (diary entries, saved readings, card collection) in Cloud Firestore, revokes the Firebase Authentication account, and purges scoped local browser storage.

Alternatively, or to exercise any other rights under Articles 15-22 of the GDPR (access, rectification, restriction, portability, objection), you may submit a request to the contact specified in Section 1.

7. Third-Party Links & Affiliate Notice

The Application contains outbound links to third-party marketplaces and study materials for recommended literature and decks. Some product links may be affiliate links (labeled accordingly in the UI): if you purchase through an affiliate link, Lyvu Tarot may receive a commission at no additional cost to you. We do not control and are not responsible for the privacy practices of external third-party sites.

Important Entertainment & Reflection Notice

Lyvu Tarot, its AI reflections, tarot interpretations, and horoscopes are provided exclusively for entertainment, personal reflection, and educational purposes. They do not constitute and must never replace professional medical, psychological, legal, or financial advice. Users hold full personal agency and responsibility for their decisions.