App Privacy Policy
What the app collects, why, where it goes, and how you stay in control.
Last updated: September 5, 2026 · Effective from the day the app is available on the App Store
1. Who is responsible for your data
The data controller for the Arcana Origin iOS app (the "App") is Alex Costa, a sole proprietor doing business as Arcana Origin, 1057 Saratoga St, Boston, MA 02128, United States, reachable at [email protected]. The operator works from the European Union; we therefore apply the EU General Data Protection Regulation (GDPR) as our baseline standard for every user of the App, wherever you live, alongside the UK GDPR, the California Consumer Privacy Act and other laws that apply to you. This policy covers the App and this website, arcanaorigin.app, which is a static landing page that sets no cookies, loads no analytics or third-party scripts, and collects nothing unless you choose to email us. The website at arcanaorigin.com has its own Privacy Policy; where you use both, each governs the data it collects, and your account and key balance are shared between them under both.
2. What the app collects
| Data | Where it comes from | Where it lives |
|---|---|---|
| Birth details — name, date of birth, time and place of birth | You type them during onboarding | On your device. Sent to our AI provider only at the moment a reading is generated. Also in your account, if you create one. |
| Persona fields — gender, relationship status | Optional questions during onboarding; you can skip them | On your device, and in your account if you create one. Used only to tailor love and relationship readings. |
| Email address | Only if you sign in, claim free keys, or write to us | In your account (hosted by Cloudflare); with our email provider (Resend) while a sign-in code or receipt is delivered |
| Sign in with Apple identifier and the email (or Apple's private relay address) Apple gives us | Apple, only if you choose Sign in with Apple | In your account |
| Device identifier — a random value we generate | Created by the App and stored in your device's Keychain | Sent with each request so a subscription can be limited to a small number of devices. It is not a hardware or advertising identifier and cannot identify you across other apps. Deleted with your account. |
| Photographs — for the palm, face and tea-leaf Oracle rites | Your camera or photo picker, only when you choose a rite that needs one | Sent once to our AI provider to produce the reading. Not stored on our servers or on your device beyond the reading session. You can decline camera access and use everything else. |
| Location — one reading of your position | Only if you allow it, to match you to the nearest city in our catalogue | Only the matched city name is kept, on your device. Coordinates are never stored or sent to us. You can type a city instead. |
| Readings, journal lines, daily-pulse preferences | Generated by the App or written by you | On your device; also in your account if you create one |
| Purchase record — Apple's signed transaction (product and transaction identifiers) | Apple, when you buy keys or a subscription | With us, to credit your keys and verify a subscription. We never receive your payment method, card number or billing address. |
| Request metadata — IP address, request time, App version | Every request to our servers | In short-lived server logs for security and abuse prevention; IP addresses are truncated before any longer retention |
What the App does not do. It contains no analytics, advertising, attribution or crash-reporting software. It does not read your contacts, calendar or photo library, does not access the microphone, does not track you across other apps or websites, and does not use the Advertising Identifier. Optional notifications (the morning pulse, your Solar Return, an eclipse, the Oracle opening) are scheduled entirely on your device: we run no push-notification service and never receive a device token.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Generating and delivering the readings you ask for; crediting keys you buy; running your subscription | Performance of a contract — Art. 6(1)(b) |
| Optional account, sync between devices, export and deletion | Performance of a contract — Art. 6(1)(b) |
| Persona fields, photographs, location | Your consent — Art. 6(1)(a) — which you may withdraw at any time by skipping the question, declining the permission, or deleting the data |
| Security, abuse prevention, device limits, keeping the service running | Legitimate interests — Art. 6(1)(f) — in protecting the App and its users, balanced against your rights |
| Tax and accounting records of purchases | Legal obligation — Art. 6(1)(c) |
| Answering your emails and complaints | Legitimate interests — Art. 6(1)(f) — and, where relevant, legal obligation |
Special-category data. A face photograph is used only to produce a symbolic reading and is never used to identify you or to create a biometric template; it is discarded after the reading. Relationship status and gender are optional and you can leave them blank. We do not infer health, religious, political or sexual-orientation data, and we do not use any of your data to profile you for advertising.
4. AI processing
Readings are produced partly by deterministic calculations on your device and partly by an AI language model operated by Anthropic (United States). At the moment a reading is generated, the App sends the birth details and, for Oracle rites, the photograph, together with the reading's prompt, to Anthropic through our server. Anthropic processes it under its commercial API terms, does not use it to train its models, and retains it only for the limited period those terms allow for abuse monitoring (currently up to 30 days). The output is symbolic and interpretive; it produces no legal or similarly significant effect on you and is not a decision about you under GDPR Article 22. If you do not want your data processed by an AI system, do not generate readings — the App has no non-AI way to produce them.
5. Who receives your data
We never sell personal data, never share it for advertising, and never give it to data brokers. It goes only to the recipients below, and only for the purpose stated. Anthropic, Apple, Cloudflare and Resend process it under their data-processing terms; Google receives only what you yourself choose to send to our support inbox.
| Processor | What they receive | Purpose |
|---|---|---|
| Anthropic | Birth details, prompt, and for Oracle rites a photograph, at the moment of a reading | AI generation of readings |
| Apple | Everything involved in an in-app purchase; your Apple ID if you use Sign in with Apple | Payment processing, subscriptions, sign-in |
| Cloudflare | Your account data (email, birth details, readings, journal, key balance) and every request to our API | Hosting, the user database, security |
| Resend | Your email address and the message being sent | Delivering sign-in codes and account emails |
| Google (Gmail) | Anything you email to [email protected] | Our support inbox |
We may also disclose data if the law requires it — for example a valid court order — and we will tell you when we are allowed to. If Arcana Origin is ever sold or merged, your data would pass to the new owner under this policy, and you would be notified before that happens.
6. International transfers
Our processors are established in the United States, so if you are in the EEA, UK or Switzerland your data is transferred there. Anthropic, Apple, Cloudflare and Google are certified under the EU–US Data Privacy Framework (and its UK and Swiss extensions); for every transfer we additionally rely on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss clauses. You can ask us for a copy of the safeguards in place.
7. How long we keep it
| Data | Retention |
|---|---|
| Everything stored on your device (birth details, persona fields, readings, journal, preferences) | Until you delete it in the App or delete the App |
| Account (email, birth details, readings, journal) | Until you delete the account — from the App, from the account page on arcanaorigin.com, or by email. Deletion is immediate and irreversible; any backup copies expire within 30 days. |
| Key balance and token | Kept while it holds unused paid keys, so that keys you paid for never expire; otherwise deleted 12 months after last use or on request |
| Photographs for Oracle rites | Not stored. Discarded after the reading session. |
| Purchase records (Apple transaction identifiers) | As long as tax and accounting law requires — normally 7 years — in a form that no longer links to your account once it is deleted |
| Server request logs | 30 days, with IP addresses truncated after 24 hours |
| Support emails | Up to 2 years after the last message, then deleted |
8. Your rights
Wherever you live, you can exercise every right below — we do not limit them to residents of any particular region. Under the GDPR and UK GDPR these are legal rights; elsewhere we honour them as a matter of policy.
- Access and portability — download everything in your account as a JSON file from the App at any time.
- Rectification — edit your birth details and persona fields in the App.
- Erasure — delete your account and every archived reading from the App, from the website's account page, or by emailing us. It happens immediately.
- Withdraw consent — skip or clear the persona fields, decline camera or location access in iOS Settings, or delete a photograph-based reading.
- Object or restrict — object to processing based on our legitimate interests, or ask us to restrict it, by email; we will stop unless we have compelling grounds that override your interests.
- Not to be subject to automated decisions — readings have no legal or similarly significant effect on you (Section 4); if you disagree, you may object by email and we will explain the processing in detail.
- Complain — to your local data-protection authority. In the EU you can find yours at edpb.europa.eu; in Portugal it is the CNPD; in the UK the ICO. We would appreciate the chance to resolve it with you first.
Email requests to [email protected]. We answer within 30 days, free of charge, and may ask you to confirm you control the account concerned. We never discriminate against you for exercising a right.
9. United States residents
California (CCPA / CPRA) and residents of other states with privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas and Oregon) have the right to know what personal information we collect and how we use and share it (this policy), to access, correct and delete it, to obtain a portable copy, to opt out of sale, sharing and targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising any right. We do not sell or share personal information as those terms are defined in the CCPA, do not use it for targeted advertising, and do not use sensitive personal information for anything beyond providing the service you asked for — so there is nothing to opt out of, and we honour Global Privacy Control signals as a matter of course. Exercise any right by email or through the App; an authorised agent may act for you if you give them written permission. We have not sold or shared personal information in the preceding 12 months. Illinois and Texas residents: the App does not create, collect or store biometric identifiers or biometric information; a photograph taken for an Oracle rite is sent once for symbolic interpretation, is never used to identify anyone, and is discarded after the reading.
10. Children
The App is not directed at children and is intended for people aged 16 and over (or the age of digital consent where you live, if higher). We do not knowingly collect personal data from anyone younger. If you believe a child has given us data, email us and we will delete it promptly.
11. Security
Data in transit is encrypted with TLS. Account data at rest is encrypted by our hosting provider. Your device identifier lives in the iOS Keychain. Access to server systems is limited to the operator and protected by multi-factor authentication. No system is perfectly secure; if a breach ever affects your data we will notify you and the relevant authority as the law requires, normally within 72 hours of becoming aware of it.
12. Apple's privacy label, in plain words
The App Store privacy label for Arcana Origin says: Data linked to you — contact info (email) and user content (birth details, readings, journal), only if you create an account; Data not linked to you — purchase history (Apple transaction identifiers) and a diagnostic identifier for device limits; Data used to track you — none. The label is accurate for the current version of the App; whenever the App changes, we update the label and this policy together.
13. Changes
We will update this policy when the App, our processors or the law change. The "Last updated" date shows the current version. For material changes we will notify you in the App, or by email if you have an account, at least 30 days before they take effect.
14. Contact and complaints
Alex Costa (doing business as Arcana Origin)
Attn: Privacy
1057 Saratoga St
Boston, MA 02128
United States
Email: [email protected]