Privacy, Terms & Support

By accessing or using Velora Tarot you agree to these Terms of Use. If you do not agree, do not use the service. The service is provided “as is” without guarantees of uninterrupted access or guaranteed outcomes from any reading.

Age requirement

You must be at least 18 years old to use Velora Tarot. Fortune-telling content is intended for adults only. By creating an account you confirm that you are 18 or older. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18 we will delete their account and data immediately.

Acceptable use

You are responsible for keeping your account credentials secure. You agree not to create multiple accounts to circumvent free-reading limits, payment flows, sharing bonuses, or any other part of the service. You may not use the service in any way that is unlawful, harmful, or disruptive.

Entertainment disclaimer

All readings are generated by artificial intelligence for personal reflection and entertainment purposes only. Nothing provided by Velora Tarot constitutes or should be relied upon as professional advice of any kind — including medical, psychological, legal, financial, or relationship advice. If you are in crisis, please contact a qualified professional or an emergency service. The app's crisis detection is automated — no human reviews flagged messages. If you are in immediate distress, please call or text one of the following directly: Shout 85258 (UK, text SHOUT to 85258), Samaritans 116 123 (UK, free, 24/7), or 988(US, Suicide & Crisis Lifeline).

Intellectual property

All content, branding, card art, and software are owned by or licensed to Velora Tarot. You may not reproduce or distribute any part of the service without prior written consent.

Suspension and termination

We reserve the right to suspend or delete accounts that breach these terms or that are used fraudulently. We may also modify or discontinue the service at any time with reasonable notice.

Governing law

These terms are governed by the laws of England and Wales. Any disputes are subject to the exclusive jurisdiction of the courts of England and Wales.

For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is:

The supervisory authority for data protection in the UK is the Information Commissioner's Office (ICO). You have the right to lodge a complaint with the ICO if you believe your data has been processed unlawfully (see Your rights).

This Privacy Policy explains what personal data we collect, why we collect it, the legal basis under UK GDPR, how long we keep it, and who we share it with.

Data we collect

Account data — collected when you register or sign in:

• •Email address — to identify your account, send verification and password-reset links
• •Date of birth and 18+ confirmation timestamp — collected when you create an email + password account to enforce the adult-only age gate; social sign-in users must confirm they are 18+ in the consent gate
• •Display name (optional) — from your profile or provided by your OAuth provider (e.g. Apple or Google)
• •Profile picture URL (optional) — provided by a social sign-in provider if available
• •Bcrypt-hashed password — only if you use email + password sign-in; the plain-text password is never stored or transmitted
• •OAuth provider link — provider name and account ID if you sign in via Apple or Google

Reading and usage data — created as you use the service:

• •Reading history — cards drawn, spread type, question asked, and AI-generated interpretation
• •Daily free-reading usage timestamps and any prepaid token balance
• •Optional personalisation profile — name, sun sign, moon sign, birth date, focus areas, life phase, and life context — saved only if you choose to enter it
• •Optional paid-reading context — short free-text details such as your situation, intention, or a person on your mind; used for that reading request and not saved to your profile
• •Your rating feedback on individual readings (thumbs up / down)
• •Support messages submitted via the contact form

Technical / analytics data — collected automatically:

• •Session authentication cookie (necessary for sign-in — not optional)
• •Usage events and a pseudonymous analytics ID via Google Analytics 4 and our first-party analytics table (only if you consent via the cookie banner)
• •Browser local storage entries for in-progress readings and your cookie-consent preference (functional; in-progress reading storage may include card IDs and draft reading content)

Legal basis for processing (UK GDPR)

Data retention

• •Account and reading data — retained for as long as your account is active, or until you request deletion
• •Payment records — retained for up to 7 years to comply with UK tax and financial regulations (even after account deletion)
• •Email verification and password-reset tokens — deleted within 24 hours of use or expiry
• •Support messages — retained for up to 2 years
• •First-party analytics and AI usage logs — retained only for service diagnostics and cost/security monitoring, then deleted or aggregated when no longer needed
• •Google Analytics data — subject to Google's own retention policy (default 14 months); we do not receive personally identifiable information from GA4

Data sharing

We do not sell your data, run advertising networks, or share data for marketing purposes. We share data only as described in the AI & Third-party services section below and as listed here:

• •OpenAI — receives reading content (cards, question, optional personalisation, and optional paid-reading context) to generate the interpretation
• •ElevenLabs — will receive a condensed text summary of your reading only if the optional voice narration feature is launched and enabled
• •Stripe — receives payment details necessary to process web purchases (we never see your card number)
• •Google Play Billing — processes Android app purchases and purchase history for Google Play-distributed builds
• •Resend — receives your email address to send transactional emails (verification, password reset, welcome)
• •Google Analytics — receives pseudonymous usage event data only if you consent via the cookie banner
• •Vercel and our database hosting providers — handle app hosting, serverless functions, storage, and database traffic under processor terms
• •Law enforcement or regulators — only if required by applicable law or a valid court order

We do not transfer your personal data outside the UK/EEA without appropriate safeguards. Where processors are based in the US (OpenAI, Stripe, Google, Vercel, or ElevenLabs if voice is launched) we rely on Standard Contractual Clauses or equivalent transfer mechanisms.

OpenAI (reading interpretation)

Reading content is processed by OpenAI's GPT-4o model to generate your interpretation. OpenAI acts as a data processor on our behalf. OpenAI may process prompt data according to its Privacy Policy and Usage Policies. Per OpenAI's API data usage policy, data submitted via the API is not used to train OpenAI models by default.

What is sent to OpenAI: selected card names and positions, spread type, your question (if any), and your Oracle Memory profile when set (name, sun sign, moon sign, birth date, focus areas, life phase, and life context), plus optional paid-reading context fields when you enter them for a premium reading. Do not enter sensitive personal information such as identification numbers, medical details, or financial data in any free-text field.

Velora Tarot does not make automated decisions that produce legal or similarly significant effects. AI readings are generated for entertainment and personal reflection only.

OpenAI is based in the United States. Transfers are covered by Standard Contractual Clauses as part of OpenAI's API terms.

ElevenLabs (voice narration — coming soon)

Voice narration is a planned future feature and is not currently activein the app. The server route is feature-gated and stays off unless we explicitly enable voice narration. If launched, a brief text summary of your reading will be sent to ElevenLabs to generate audio narration. ElevenLabs' privacy policy is available at elevenlabs.io/privacy.

What will be sent when active: a condensed summary of the reading interpretation only (no name, star sign, or other personal fields). This page will be updated before the feature launches.

Resend (transactional email)

Resend processes your email address to deliver verification links, password reset links, and welcome emails. We do not send marketing emails. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Google Analytics 4 (analytics — consent required)

When you consent via the cookie banner, pseudonymous usage events (e.g. page views, spread type chosen) are sent to Google Analytics 4 and stored in our first-party analytics table. We do not include your email address, name, reading text, payment card details, or other directly identifying information in analytics events. You can opt out at any time in the cookie controls below or via the Google Analytics Opt-out browser add-on. Google's privacy policy: policies.google.com/privacy.

We use a small number of cookies and browser local storage entries. UK law (PECR) requires your consent for non-essential cookies. The cookie banner shown on your first visit lets you choose.

Strictly necessary (no consent required)

Functional local storage (no consent required)

Analytics cookies (consent required)

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights regarding your personal data:

To exercise any right, contact us at privacy@veloratarot.com. We will respond within 30 days as required by UK GDPR. We may ask you to verify your identity before actioning a request.

Web purchases for paid readings and bundles are processed by Stripe, Inc. a PCI-DSS Level 1 certified payment processor. We do not store, see, or process your card number or payment credentials. Payment pages are hosted and secured by Stripe.

Purchases made inside the Google Play-distributed Android app are processed through Google Play Billing. Google Play provides the checkout screen and purchase token; we verify that token to credit the Rune balance on your Velora account.

Prices are shown in GBP (British Pounds Sterling). Premium readings are one-off purchases. Bundles provide a balance of prepaid reading tokens redeemable at any time on your account. Tokens do not expire.

Reading purchases are generally non-refundable once a reading has been generated and delivered, except where applicable consumer law (including the UK Consumer Rights Act 2015) requires otherwise. Unused bundle tokens may be refunded at our discretion within 14 days of purchase. If you believe you were charged incorrectly, contact support@veloratarot.com with the email address linked to your account and any relevant order reference.

For details on how Stripe handles payment data, see Stripe's Privacy Policy and Services Agreement.

Deleting individual readings

You can delete individual readings from your reading history inside the app at any time.

Deleting your personalisation profile

Personalisation data (name, sun sign, moon sign, birth date, focus areas, life phase, and life context) can be cleared at any time from the Personalise page while signed in. Clearing your profile immediately stops it from being included in future reading requests.

Deleting your account (right to erasure)

To delete your account and associated app data — including your email address, reading history, personalisation profile, and any remaining token balance — go to Account and use the “Delete Account” option. Deletion is immediate and permanent. We cannot recover deleted accounts.

Alternatively, email privacy@veloratarot.com with the email address linked to your account. We will complete valid erasure requests within 30 days.

Note: payment transaction records are retained for up to 7 years as required by UK financial regulations, even after account deletion. These records do not contain your reading content or personalisation data.

Revoking third-party access

If you signed in with Google, you can revoke the app's access through your Google Account permissions. If you signed in with Apple, you can manage Sign in with Apple access from your Apple ID settings. Revoking provider access does not delete your Velora Tarot account; use the Delete Account option for full erasure.

Data portability

You can download a machine-readable JSON export of your account, profile, reading, and purchase data from Account. You can also email privacy@veloratarot.com for help with data access or portability requests.

The fastest route is the contact form in your Account. If you prefer email, use the addresses below:

We aim to respond within 2 business days. For data subject requests (access, erasure, portability) we have up to 30 days under UK GDPR.

Supervisory authority

If you are not satisfied with our response to a privacy concern, you have the right to contact the UK's supervisory authority directly: Information Commissioner's Office (ICO) — 0303 123 1113.