Privacy Policy / Datenschutzerklärung

Aurum Tarot

Last updated: June 20, 2026

1. Data Controller (Verantwortlicher)

Eduard Bruch

Kleinfeld 28c, 21149 Hamburg, Germany

2. Data We Collect

2.1 On-Device Data

Aurum Tarot stores the following data locally on your device using SwiftData and UserDefaults. This data never leaves your device unless you explicitly request an AI interpretation (see 2.3):

Tarot reading history (cards drawn, spread type, date)
Journal entries and personal notes
Your question, intention, mood, or goal (if entered)
Onboarding personalization (your first name, zodiac sign, and chosen focus area)
App preferences (theme, notification settings, reversed cards toggle)

On-device storage is strictly necessary for the functioning of the app (§ 25(2) Nr. 2 TTDSG). This data is retained until you delete it via "Delete All My Data" in Settings or by uninstalling the app.

2.2 Subscription Data

If you purchase a subscription, the transaction is processed by Apple through the App Store. We use RevenueCat, Inc. (USA) as a data processor to verify your subscription status. RevenueCat receives a pseudonymous app user ID and transaction metadata. We do not have access to your payment information. RevenueCat retains this data for the duration of your subscription and as required by applicable tax and accounting laws. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Data transfer to the USA is secured under the EU-U.S. Data Privacy Framework (adequacy decision of July 10, 2023). See RevenueCat's Privacy Policy.

2.3 AI-Powered Interpretations (Premium Feature)

Aurum Tarot offers optional AI-powered tarot interpretations as a premium feature. When you request an AI interpretation, the following data is sent to our server for processing:

Card names, positions, and orientation (upright/reversed)
Your question, intention, mood, or goal (if entered)
For follow-up questions, the recent conversation context of that reading
Your first name and zodiac sign, and your device language — used to personalize and translate the response
A pseudonymous identifier used to verify your subscription status and apply rate limits

This data is processed by our Cloudflare Worker (EU/US infrastructure) which forwards it to DeepSeek, a third-party AI service, to generate the interpretation. Data may be processed on servers located outside the EU/EEA; the transfer takes place only after your explicit, informed consent (Art. 49(1)(a) GDPR).

We minimize the personal data involved. Before your text is sent, a PII scrubber removes email addresses, phone numbers, ID and payment-card-like numbers, and URLs. The only identifying details included are your first name and zodiac sign (used solely to personalize the wording of the response) together with a pseudonymous identifier. We do not send your email or account data, and we do not store your questions or AI responses on our servers — the response is returned directly to your device and saved locally.

Before your first AI interpretation, the app will ask for your explicit consent. You can use all other app features without any data leaving your device. You may withdraw your consent at any time by deleting your data in the app settings. Legal basis: Art. 6(1)(a) GDPR (your explicit consent); transfer of data outside the EU/EEA: Art. 49(1)(a) GDPR (explicit consent).

2.4 Analytics and Tracking

Aurum Tarot does not use any analytics, advertising, or tracking frameworks. No usage data is collected or transmitted.

3. Entertainment Purpose

All content provided by Aurum Tarot — including tarot readings, card meanings, and AI-generated interpretations — is generated for entertainment and self-reflection purposes only. It does not constitute medical, psychological, legal, or financial advice.

4. Legal Basis for Processing

Art. 6(1)(a) GDPR — Consent: AI interpretation data transfer, notification permissions.
Art. 6(1)(b) GDPR — Contract: Subscription processing, core app functionality.
§ 25(2) Nr. 2 TTDSG: Storing app preferences and reading history on your device (strictly necessary for the service).

5. Data Sharing and International Transfers

We do not sell, rent, or share your personal data with third parties for marketing purposes. Third-party services that may receive data:

RevenueCat, Inc. (USA) — subscription verification. Data transfer secured under the EU-U.S. Data Privacy Framework.
Cloudflare, Inc. (USA) — request routing and rate limiting for AI interpretations. Data transfer secured under the EU-U.S. Data Privacy Framework.
DeepSeek — AI interpretation processing, only when you explicitly request an AI reading. Data may be processed on servers outside the EU/EEA; the transfer is based on your explicit consent (Art. 49(1)(a) GDPR).

6. Data Retention

On-device data (readings, journal, preferences): Retained until you delete it via "Delete All My Data" in Settings or by uninstalling the app.
Subscription data (RevenueCat): Retained for the duration of your subscription and as required by applicable tax and accounting laws.
AI interpretation requests: Not stored on our servers. Rate-limiting data (pseudonymous device ID and IP address) expires automatically within 24 hours.

7. California Residents (CCPA)

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. California residents may contact us at support@eduardbruch.com to exercise their rights under the CCPA.

8. Your Rights (GDPR)

Under the GDPR, you have the right to:

Access (Art. 15) — request what data we hold about you
Rectification (Art. 16) — correct inaccurate data
Erasure (Art. 17) — request deletion of your data. Since all data is on-device, you can delete it via the app's settings ("Delete All My Data") or by uninstalling the app.
Restriction (Art. 18) — restrict processing
Data Portability (Art. 20) — receive your data in a portable format
Object (Art. 21) — object to processing
Withdraw Consent (Art. 7(3)) — withdraw consent at any time without affecting the lawfulness of prior processing. You can withdraw AI consent by deleting your data in the app settings.

9. Right to Lodge a Complaint

You may lodge a complaint with the supervisory authority:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit

Ludwig-Erhard-Str. 22, 7. OG

20459 Hamburg

https://datenschutz-hamburg.de

10. Children's Privacy

Aurum Tarot is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16 (GDPR Art. 8) or under 13 (COPPA). If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated to you through the app before they take effect. The updated policy will be reflected on this page with an updated date.

12. Contact

For questions about this privacy policy or your data, contact: support@eduardbruch.com