Privacy Policy

1. Core Principles: Local & Ephemeral

Taroh is built around client-side execution and data minimization:

• On-Device Reflection: Your preferences, streaks, and reading journal entries are stored strictly in your browser's local storage (localStorage). They are never transmitted to our databases.
• Zero Permanent Question Storage: When you submit a question for a tailored reading, it is held in server memory only long enough to synthesize your reading. We do not maintain a permanent database of querent questions.
• No Account Required: You do not need to register, provide your email, or create a password to consult Taroh.

2. Data We Process

To provide tailored interpretations and prevent automated service abuse, we process:

• Inquiry Content: The text of your question, the spread type, the cards and orientations drawn, and your chosen language.
• Ephemeral Connection Data: An anonymous, randomized device token and hashed IP address used strictly to enforce daily free-reading allowances and prevent DDoS attacks.

3. Third-Party Service Providers (Data Processors)

Taroh utilizes trusted technical infrastructure partners to operate:

• Google Gemini (Generative Language API): Synthesizes customized card interpretations in real time. Under our enterprise API configuration, querent queries are not logged to train models or subjected to human review. No IP address or user profile is sent to Google.
• Upstash Redis: Stores ephemeral rate-limiting counters and free-reading allowances. Data is stored as salted cryptographic hashes; no plaintext questions are stored in Redis.
• Stripe: Processes commercial transactions when paid passes or memberships are purchased. Full credit card data is handled exclusively by Stripe (SAQ A PCI compliance). Taroh never sees or stores card numbers.

4. Cookies & Local Storage

Taroh does not use commercial marketing cookies, advertising trackers, or cross-site fingerprinting scripts. We utilize standard browser localStorage strictly to persist your on-device ritual state (audio volume, theme, journal entries, and offline cache).

To see how many people visit and which pages they open, Taroh uses Vercel Web Analytics. It sets no cookies, does not follow you to other sites, and counts page views only in aggregate. No question you ask and no card you draw is part of it.

5. Age Restriction (18+)

Taroh is intended solely for adults aged 18 and older. We do not knowingly collect personal data from minors. If you believe a minor has accessed the service, please contact us for immediate resolution.

6. Contact

For any questions regarding this Privacy Policy, please email us at: privacy@taroh.app.