Effective date: 14 February 2026 · Last updated: 14 February 2026
Sharing intimate questions with an oracle requires trust. We take that seriously. This policy explains, in plain language, exactly what data Total Tarot collects, why we collect it, who else sees it, and what rights you have over it.
If anything here feels unclear, reach out to us at guide@totaltarot.app — we'd rather explain than hide behind legalese.
Total Tarot is operated by Voxium AI Ltd, a company registered in England. Voxium AI Ltd is the data controller responsible for your personal data. For any privacy-related questions, you can contact us at guide@totaltarot.app.
We only collect what we need to give you personalised readings and keep the service running. Here's the full picture:
Your email address, display name, and — if you sign in with Google — basic profile details (name and profile picture). We use this to identify your account and personalise your experience.
The questions you ask, the cards drawn for each reading, the oracle domain selected, and the interpretation generated. We store these so you can revisit your reading history and so the oracle can learn your patterns over time.
If you write journal entries or give feedback on readings (resonance voting), we store that to deepen personalisation and improve reading quality.
When you purchase credits or unlock a deck, the payment is handled entirely by a secure third-party payment processor. We never see or store your card number, expiry, or CVV. We only receive confirmation that a payment was successful and the amount.
Anonymised analytics about which pages you visit and features you use. This helps us understand what's working and what needs improvement. We don't use advertising trackers.
Under UK GDPR, we need a lawful basis for processing your personal data. Here's how each applies:
We work with a small number of trusted third-party services to deliver Total Tarot. Here's what each category of provider can see:
Our AI providers generate your readings and analyse your patterns. They receive your question and the cards drawn. Under their commercial API terms, your inputs are not used to train their models.
Our payment processor handles all transactions directly — we never see or store your card number, expiry, or CVV. Their own privacy policy governs how they handle payment data.
Your account data, readings, and journal entries are stored securely with strict access controls — each user's data is isolated so only you can access yours. Our hosting provider delivers the pages you see but doesn't have access to your readings or personal data.
We use anonymised usage analytics to understand which pages are popular and where the experience can be improved. No personal data or reading content is shared with our analytics provider.
Some of the services listed above are based outside the United Kingdom (primarily in the United States). When your data is transferred outside the UK, it is protected by appropriate safeguards including Standard Contractual Clauses and adequacy decisions recognised by the UK government. We only work with providers who maintain strong data protection standards.
Under UK GDPR, you have the following rights over your personal data:
To exercise any of these rights, email guide@totaltarot.app. We aim to respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have not been respected.
We do not use advertising trackers, sell your data, or participate in any ad networks.
Total Tarot is designed for users aged 13 and over. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us at guide@totaltarot.app and we will delete the account promptly.
We take the security of your data seriously. All connections to Total Tarot are encrypted via HTTPS. Your data is stored securely with strict access controls — each user can only access their own readings and account information, enforced at the database level. Payments are handled by a PCI-DSS certified payment processor.
No system is perfectly secure. If a security incident occurs that affects your personal data, we will notify you and the ICO as required by law.
We may update this policy from time to time. For material changes (new data collection, new third-party services, changes to your rights), we will notify you by email before they take effect. For minor clarifications, we will update the “last updated” date at the top of this page.
Questions, concerns, or requests about your data? We're here.
Email: guide@totaltarot.app