Privacy policy

Who we are

Brutal Tarot sells a subscription to personalized tarot readings at brutaltruthtarot.com. We decide what personal data is collected here and why, which under GDPR makes us the data controller for it.

The fastest way to reach a human about anything on this page is contact@brutaltruthtarot.com.

What we collect, and why

Only what a reading needs, plus what it takes to bill you and keep the service working.

• —Your email address — it is your account. It is how you sign in, and where readings are delivered.
• —Your first name, age range and gender — these change how a reading is written. They come from the intake form and are optional to keep accurate.
• —Your birth date, if you add it — used only to add astrological texture to readings. Nothing else reads it.
• —Your timezone — detected from your browser so scheduled readings arrive in your morning rather than the middle of your night. You can override it in your profile.
• —The questions you ask and the readings we generate — the product itself, stored so your archive and journal persist.
• —A hashed form of your IP address at signup — a one-way fingerprint used to rate-limit free readings. We do not store the address itself.
• —How you arrived — referrer and campaign tags, so we know which ads are worth running.

What we never collect

Card numbers. Billing runs entirely through Whop as merchant of record; your card details go to Whop's checkout and never touch our servers or our database. We can see that a payment succeeded or failed, and nothing more.

We do not ask for, and have no use for, your address, phone number, or government identifiers.

Who else sees it

Only the services needed to run this. Each gets the minimum that lets it do its job, and none of them are permitted to use your data for their own purposes.

• —Supabase — hosts the database your account, readings and journal live in.
• —Anthropic — the reading engine. Your question and profile context are processed there to compose the reading, under Anthropic's API terms, and are not used to train models.
• —Resend — delivers your readings and daily cards by email, and reports whether they arrived.
• —Whop — the merchant of record. Whop holds your payment details and its own account for you, under Whop's privacy policy.
• —Meta — if you arrived from an ad. See the section below.
• —Vercel — serves the site and processes requests in transit.

Advertising and the Meta pixel

This site carries the Meta pixel, and we also send Meta a server-side copy of the same events. Meta uses them to report whether an ad worked and to find people like the ones it worked on.

What Meta receives about you is: which pages you saw, whether you took a free reading, and whether you subscribed. Where an event carries your email, it is hashed with SHA-256 before it leaves us — Meta can match it against an account it already has, but cannot read it.

You can stop the browser half with any tracker blocker, and control how Meta uses what it already holds in your Meta ad settings. Blocking it does not change the product in any way.

Cookies

We use a small number, all functional or analytical, and none sold on.

• —A session cookie, set when you sign in — without it we cannot tell it is you.
• —A first-party anonymous id, so we can see how far people get through the funnel without knowing who they are.
• —Meta's _fbp and _fbc cookies, set by the pixel described above.

Email you can stop

Every scheduled email — the daily card, the follow-up sequence — carries a one-click unsubscribe, both as a link and as a header your mail client can act on directly. Turning it off takes effect immediately and needs no account.

Emails about something you bought are different: a receipt, a notice that your trial is about to convert, or a warning that your card was declined will still be sent, because not sending them would be worse for you than sending them.

How long we keep it

Your readings and journal stay for as long as you have an account — that archive is most of what a membership is for. Funnel and delivery records are kept for up to two years so we can measure the business over time.

Ask us to delete your account and we delete it: the profile, the readings, the journal, the notes. Write to contact@brutaltruthtarot.com from the address on the account and we complete it within 30 days. Whop holds its own billing records under its own retention rules, and we cannot delete those for you.

Your rights over it

Wherever you are, you can ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. If you are in the UK or EU you also have the right to object to processing and to complain to your local data protection authority; if you are in California you have the right to know what is collected and to ask us not to sell or share it — we do not sell personal data, and never have.

All of it goes through the same inbox: contact@brutaltruthtarot.com. We answer within 30 days and do not charge for it.

Where your data is processed

Our database and servers run in the United States, and the services listed above are US-based. If you are outside the US, using this site means your data is processed there, under the standard contractual clauses those providers operate on.

Children

This is an 18+ service and we do not knowingly collect anything from under-18s. If you believe a child has created an account, write to us and we will delete it.

Changes

If this policy changes in a way that affects what we do with your data, we will email account holders rather than quietly reposting the page. The date above always reflects the current version.