Privacy

Last updated 1 October 2026.

Tarot Tutor is a study tool. It needs an account so your progress follows you between devices. It also counts how the site is used, and, only if you allow it, which of our ads brought you here. This page lists what it stores, what it measures, who else touches it, and how to get it back or delete it.

What is stored

• Your email address, so you can sign in and so we can send you account mail.
• Your password, hashed. It is handled by Supabase Auth and never reaches our own code in a readable form. If you sign in with Google instead, no password exists at all.
• Your study progress: which cards you have met, a level and right/wrong count per card and orientation, when each was last seen, which pathways you have worked through, and which badges you have earned.
• Your plan: free or pro, when a trial ends, and when the current billing period ends.
• Identifiers from Stripe if you subscribe: a customer id and a subscription id, so your payment and your account refer to each other.
• Which ad you came from, if you followed a link from one of our ads and then signed up: the campaign tags in that link (utm_source, utm_medium, utm_campaign, utm_content and utm_term). They say which ad it was and nothing about you, and are saved on your account once, when you sign up.

What is measured

We use PostHog to see how the site is used. It records the pages you view, and with each one the page you came from, your browser, your operating system, your language and time zone, your device type and screen size, and an approximate location (such as country and city) that PostHog works out from your IP address. It also records a few moments: signing up, finishing a lesson, finishing a study session, starting a trial and subscribing, with what describes them, such as which lesson it was and how many answers were right, or whether a subscription is monthly or yearly. If you arrived from one of our ads, its campaign tags go with your sign-up.

While you are signed in, these are tied to your account's id, a random string, never your email address or your name. PostHog runs without cookies: it keeps its identifiers in the page's memory and writes nothing to your browser, so while you are signed out each fresh load of the site is a new, anonymous visitor. PostHog sees your IP address when your browser contacts it; we use it only for that approximate location.

Advertising, only if you allow it

We advertise on Meta's platforms, and Meta's pixel is how we learn which of those ads bring people here. It loads only if you choose “Allow marketing cookies” on the banner that asks; until then, nothing of Meta's runs on this site. If you allow it, Meta is told about each page you view outside the app and your account (the home, sign-up, sign-in, password, welcome and legal pages, never a page inside the app or your account) and when you sign up and start a trial. We send it no email address, name or account id; it does receive what its own script gathers from your browser, including its cookies (_fbp, and _fbc if you came from a Meta ad). Meta's use of that is covered by its own privacy policy.

The pixel is not switched on at the moment, so there is nothing to choose.

What is not stored

Nothing about your studying is sold. Your answers and your progress are never sent to Meta, and there is no advertising on the site beyond the pixel above, which needs your permission. We do not store card numbers; see Stripe below.

Who processes it

• Supabase: the database and the authentication behind it.
• Vercel: serves the site and runs its server code.
• MailerSend: sends account email, such as address confirmation, password resets and similar. It is not used for marketing.
• Stripe: takes payment if you subscribe. Card details go to Stripe directly and never pass through Tarot Tutor.
• PostHog: product analytics, as described under “What is measured”.
• Meta: the advertising pixel, only if you allow it.
• Google Fonts: serves the typeface the site is set in. Your browser fetches it from Google directly, so Google sees that request.

Each publishes its own privacy terms. The first five handle data on our behalf in order to run the service; Meta and Google also use what reaches them under their own policies.

Cookies

The site sets two kinds of cookie of its own. The sign-in cookies keep you signed in, and carry a sign-in by Google or by an emailed link through to the end. The theme cookie remembers light or dark if you have chosen one over your device's setting, and lapses after a year. Neither is used for advertising or analytics.

Meta's cookies are set only if you allow marketing cookies, as described above. Your answer to that question is kept in your browser's local storage (tt-consent) so the banner does not ask again, and a study session's results are held briefly in the tab's session storage while they are shown and saved.

Getting your data, or removing it

Email hello@tarottutor.io and ask for a copy of what is stored about you, a correction, or deletion. Deleting your account removes your progress, badges and profile along with it, and those are kept for as long as the account exists.

Some things outlast the account. What PostHog has recorded (see “What is measured”) is keyed to your account's id and is not removed automatically when the account is deleted: it is kept until we delete it, or on request: email the address above and we will. Stripe keeps its record of any payments, as tax and accounting law requires. What Meta's pixel sent, if you allowed it, is held by Meta under its own policy.

Changes

If this page changes in a way that affects you, the date at the top changes with it and account holders are told by email.

Contact

Questions about any of this: hello@tarottutor.io.