Privacy Policy

1. Who we are and what this covers

This Privacy Policy explains how Resonant Era LLC ("Spread Weaver", "we", "us" or "our") handles personal information when you use the Spread Weaver website and app (the "Service"). It should be read with our Terms of Service. If you have a question, contact us at support@spreadweaver.com.

2. What we collect

What	Examples	Where it comes from
Account information	Your email address, a random account ID, sign-in records (one-time codes are used once and expire)	You
Your journal	Questions, cards and positions, reflections, overall impressions, labels, enhanced readings and their sources, collection names and descriptions, custom spread text, photos you add	You, and the readings we create for you
Settings	Theme and accent, card naming, default spread, onboarding answers, reminder settings, whether AI features are on, optional birthday (month and day, no year, used only for the birthday reading idea)	You
Plan and billing	Your plan, subscription status and renewal dates, and records of billing events. Card and payment details go to our payment providers, not to us	You, our billing providers
Usage and limits	Counts of readings and other allowances you have used, timestamps, content-free in-app notices (for example "your reading is ready"), and security records such as when your key was created. While an account is deleted, we keep a keyed fingerprint of its verified email and consumed Free lifetime-trial counts for up to 30 days. If the same verified email registers again in time, the counts move to that active account's normal lifetime usage and the temporary fingerprint is deleted. We make the fingerprint after removing surrounding spaces and treating uppercase and lowercase alike; we do not rewrite provider aliases. It contains no raw email, account ID or journal.	Generated by the Service
Technical information	IP address, browser and device type, and request times, which our hosting and database providers record in their logs. For rate limiting on public forms we keep scrambled (hashed) versions of IP addresses and emails for up to a day, and to limit how many new accounts can be created from one network, a scrambled version of the network address, made with a key that changes every day, for up to two days. It is never linked to your account	Your device
Analytics (only if you allow it)	Fixed action and diagnostic codes, counts, choices and a random browser identifier. Never your words, cards, readings, page addresses, account ID or an error trace	Your browser, only after you allow it
Permission records	What you said yes to, the wording's version and the date. A keyed record of addresses that left the letter, kept so we don't write to them again. We keep these for as long as we send the letter, and delete them if the letter ends	You
Messages to us	Emails you send us, and feedback you send from the app (signed-in accounts), and what they contain	You

We do not ask for your precise location, contacts or microphone. If you add a photo, the photo is processed as described in Section 6, and your browser or device decides what you can pick or take.

Your journal may include things that are deeply personal or sensitive, such as your health, relationships, beliefs or finances. You choose what to write. We keep what you write only after you say yes, and we send it for an enhanced reading only after a separate yes. You can withdraw either in Privacy choices. We use it only to provide the Service to you.

3. How we use information

We use personal information to:

• create and secure your account and sign you in;
• store your journal and show it back to you;
• generate enhanced readings when you ask for them;
• take payments, manage your plan, enforce plan allowances, and prevent repeated Free lifetime trials after same-email account deletion and re-registration;
• send emails that the Service needs, such as sign-in codes, account deletion messages and replies to your messages; daily reminders and follow-up reminders, if you turn them on; and, if you tick the box, a monthly letter. Reminders and the letter never contain your words, and every letter lets you leave in one press;
• keep the Service safe, prevent abuse and fix problems;
• understand, in a content-free way, which parts of the Service are used, so we can improve them; and
• meet legal obligations and protect our rights.

We do not use your personal information for advertising, we do not sell it, and we do not use your journal to train AI models, ours or anyone else's.

4. How your journal is protected

Encryption at rest. The words and photos in your journal are encrypted by our server before they are stored. Each person has their own random data key. Content is encrypted with AES-256-GCM, and your data key is itself protected ("wrapped") by a master key held in a dedicated key management service run by a major cloud provider. The master key never leaves that service. This covers your questions, reflections, impressions, enhanced readings, collection names and descriptions, custom spread text and photos. The providers that host our database and storage also encrypt their disks.

Encrypted in transit. Traffic between your device and our servers, and between our servers and our providers, uses HTTPS (TLS).

The honest limits.

• This is not end-to-end encryption. Our servers hold the keys and decrypt your journal when you use the app, so they can show it to you and, when you ask for an enhanced reading, send it to AI providers. A person or system that controlled our running servers and our key access could read your journal.
• Some information is not encrypted with your personal key. This includes your email address, your plan and subscription status, dates, the type of reading, which spread and deck it used, usage counts, and similar metadata. After account deletion, it also includes the temporary keyed email fingerprint and consumed Free lifetime-trial counts described in Sections 2 and 10.
• No system is perfectly secure, and we cannot guarantee that your information will never be accessed, lost or disclosed.

Who can see your journal. We do not read your journal content except as needed to provide the Service at your request, to investigate security problems or abuse, to meet a legal obligation, or with your permission (for example to help you with a support request). Content stays out of our logs, our analytics and the addresses (URLs) of our pages. Access to production systems is limited to the people who run Spread Weaver. Our database provider's staff, and database dumps and backups, see only encrypted content.

Other safeguards. Your sign-in session is kept in secure, HttpOnly cookies that page scripts cannot read. Access to data is limited by account at the database level. Unsaved drafts on your device are tied to the account that made them and cleared when you sign out. Storage on your device is not encrypted by us (Section 8). We apply rate limits and spending limits to AI features.

5. Enhanced readings

Enhanced features are optional. You can turn them off in Settings, under Privacy and data, or in Privacy choices, on any plan, and still use everything else; turning them off hides and disables all of them. The first time you use any enhanced feature we ask for your agreement once, and it covers all of them: enhanced readings and follow-ups, Insights, the Year in tarot summary, card photos and the Spread Designer. The agreement sheet lists what each one sends, and each feature shows what it sends again where you use it. If we add an enhanced feature that sends something new, or change what one sends, we ask again. If you withdraw and later allow them again, we ask again.

What happens. When you ask for an enhanced reading, our server builds a request and sends it through an AI model routing service to AI models from the developers we choose. The routing service may serve a model from a company that hosts it; we do not choose among those hosts. We set each request so that it is sent only to hosts that the routing service lists as set to zero data retention, with data collection denied. If no such host is available, the request fails rather than going elsewhere. Zero data retention means the host should not keep your request or the reading and should not use them to train AI models. The routing service, not us, checks each host, and we cannot see its agreements with them. One exception: the routing service may check requests for illegal material that exploits children, and may keep a request it flags so that it can review and report it as the law requires.

What is sent. The reading request includes the date, the type of reading, the tradition or deck, the spread (its name and its positions, including any names, prompts and definitions you wrote for a custom spread), the cards you drew with their positions and orientation, our card reference text for those cards, your question, your reflections for each position, and your overall impression.

Follow-up readings. When a reading follows an earlier one, we also send that earlier reading's date, question, cards, an excerpt of your reflections and follow-up notes, and a short excerpt of its enhanced reading, so the new reading can build on it.

What is not sent. We do not send your email address or account ID (we use a random request ID instead), the label you give the person you are reading for, your collection names, your photos, or your other journal entries, apart from the earlier reading a follow-up builds on and the readings you choose for an Insight.

Insights. An Insight is written by AI and sends several of your readings at once. When you choose Create insight, we send the readings you selected (up to 10) in one request, with the same details as above for each, plus your follow-up notes and a short summary of each reading's enhanced readings, under the same zero-data-retention settings. Create insight shows you what will be sent and what it costs before anything is sent, and we never send an Insight's readings unless you choose Create insight, under the agreement you gave for enhanced features.

Spread design. When you choose Spread Designer, your description and chosen size are sent to the AI model with the same zero-data-retention settings. A tweak also sends the current draft. The model may research myths, symbols or traditions on the web. Its search queries go to the search service, which sits outside our zero-data-retention setup. Our software refuses a search that contains your words, but no filter is perfect. Our servers may open public web pages that a search returns, so those websites see our servers, not you. Your request and research sources stay in memory, never logged or sent to analytics. A general research subject may be held encrypted while progress is shown. Designs continue in the background if you leave. The finished draft is held with your personal encryption key for up to 24 hours, becomes unavailable at expiry, and is removed by daily maintenance. We keep an encrypted copy after delivery so an interrupted response can be retried until that expiry. Discarding a held background draft deletes it. Save spread keeps the design in your encrypted account.

Card photos. When you photograph a card to record it, your device first shrinks the photo (to at most 1,024 pixels on its longest side) and re-saves it, which removes hidden details such as location. The photo is then sent, through our servers, to an AI model under the same zero-data-retention settings, which suggests which card it shows. We use the photo only for that suggestion: it is held in memory while the request runs, then discarded. It is never stored, logged or attached to your entry, and the card is only placed when you confirm it. Photos you attach to an entry are separate, and are described under Photos.

Year in tarot summary. When you choose Write my summary on your Year in tarot, we send an AI model, under the same zero-data-retention settings and with web search off, figures about that year: your card of the year and our keywords for it, your most-drawn cards and their keywords, the suits and elements, your longest streak, the readings you did each month, the cards that came back within a week, and the number of readings. On a free plan, only your card of the year and the number of readings are sent. On a paid plan, if you have agreed to enhanced features, we also send short excerpts of your own words from that year's saved readings: from up to 120 readings, spread evenly through the year, at most 400 characters from each, taken from your question, your overall impression and your reflections. We do not send spread or position names, your follow-up notes, your collection names, your email address or your account ID. The summary is written once and kept in your account, encrypted with your personal key like the rest of your journal, until you delete your account; it is replaced only if you ask for a new one.

Patterns. On a paid plan, we write a Patterns overview on your plan's schedule (monthly, every two weeks or weekly). We send an AI model, under the same zero-data-retention settings, figures from your readings in that period: the number of readings and cards drawn, your most-drawn cards and our keywords for them, and your leading suits. We never send your words. It runs only while both keeping your words and enhanced readings are on, and pauses if you withdraw either.

Web searches for readings. Some enhanced readings may send general search queries, through the routing service, to a web search service. That service is outside our zero-data-retention setup and handles queries under its own terms. No other part of your reading goes to it. Our software refuses a search that contains your words, but no filter is perfect.

The searches and the sources used are saved with your reading in your encrypted journal and included in your JSON data export (not in the Markdown export). If that concerns you, you can withdraw permission for enhanced features in Privacy choices.

What we keep. The finished reading, its sources and the search queries are saved to your encrypted journal. We keep operational records, such as which model was used, token counts and cost, with no reading text.

Accuracy. Enhanced readings can be wrong. See our Terms of Service.

6. Photos

You can add photos to journal entries. When you add one, our server checks that it is a supported image (JPEG, PNG or HEIC), re-encodes it as a JPEG no larger than 2048 pixels (which removes embedded information such as camera details and location), encrypts it with your key, and stores it under a random file name in a private storage area that has no public links. Photos are served back to you only through the signed-in app. Photos attached to entries are not sent to AI providers (card photos for recognition are described in Section 5). You can delete a photo at any time, and deleting it removes it from storage.

7. Our service providers

We share personal information with companies that help us run the Service. They may use it only to provide their services to us, under their terms. We describe them by what they do rather than by name. We'll share the current list of providers with you on request (see Section 16). We store your account and journal in the United States. AI requests may be processed in data centres outside the United States, including in Europe and Asia, by the hosts that the routing service lists as set to zero data retention.

Provider	What it does for us	Information involved
A trusted cloud hosting provider	Hosts the website and our server	Everything that passes through the Service in transit, and standard request logs (such as IP address, browser and time)
A managed database and sign-in provider	Database, sign-in and file storage	Your email address, account IDs, and your encrypted journal and photos (ciphertext only), plus metadata
A trusted key management service	Protects the keys that protect your data keys	Your wrapped data key. No journal content
An AI model routing service	Routes AI requests to model developers	The AI request described in Section 5, and usage and cost data
Leading AI model developers, and the companies that host their models	Write enhanced readings, Insights, Patterns and spread designs, and read card photos (through the routing service)	The AI request described in Section 5, sent only to hosts set to zero data retention. These hosts may be outside the United States
A web search service	Runs web searches for some enhanced readings and the Spread Designer (through the routing service)	Only general search queries that our software has checked for your words. Outside zero data retention
An email delivery service	Sends our emails	Your email address and the message (sign-in codes, account deletion messages, replies, daily and follow-up reminders if you turn them on, the monthly letter if you tick the box). Feedback you send from the app is emailed to us with your email address
A subscription management service	Manages subscriptions and plan status	Your random account ID, plan and subscription records
A payment processor	Processes payments	Payment details, billing name, email and address that you enter at checkout, and purchase records
A product analytics service	Optional usage analytics (United States)	Only if you allow it: fixed action and diagnostic codes, counts, choices and a random browser identifier. Never your words, cards, page addresses, account ID or an error trace
An email inbox provider	Holds the email we receive	Your messages to us, and feedback you send from the app with your email address

We may also share information when the law requires it (for example a valid court order), to protect people's safety or our rights, or in a merger, sale or reorganization (in which case we will make sure the new owner honors this Policy or give you notice and a choice). Because your journal is encrypted with keys we manage, a legal request may require us to provide it; we will push back on requests that are overbroad, and where the law allows we will tell you.

8. Analytics, cookies and storage on your device

Analytics. Analytics is off unless you allow it. If you allow it, this browser sends our analytics service fixed action and diagnostic codes, counts, choices and a random browser identifier. It never sends your account ID, your words, your cards, your readings, page addresses, referrers or an error trace, and we ask the service not to add your location. Your IP address reaches the service to deliver each request. We honour Global Privacy Control: if your browser sends it, analytics stays off. The retention limits are 90 days for usage events, 30 days for browser errors and 12 months for anonymous totals. Change your choice in Settings, under Privacy and data, or in Privacy choices. The choice applies to that browser only. Turning analytics off, signing out or changing accounts stops future events and clears this browser's identifier; it does not erase events already received.

Cookies. We use only the cookies needed to run the Service:

• a secure, HttpOnly cookie that keeps you signed in (the cookie's name begins "sb-" and ends "-auth-token"), plus a small marker cookie named "sw.session-model". These last up to about 13 months unless you sign out;
• a session cookie named "sw-shared-computer", only if you choose "This is a shared computer". It holds a marker for the signed-in account and is removed when you sign out.

We do not use advertising cookies or third-party tracking cookies.

Storage on your device. The Service saves preferences (such as theme and accent, and your onboarding answers) in your browser's local storage, and saves your unsaved drafts and a queue of readings waiting to be saved. Without your yes to keeping your words, your words stay on the page and are not saved; drafts keep only cards and spread. The device also keeps a record of your permission choices. If you allow analytics, this browser also keeps a random analytics identifier. Drafts and the queue belong to the signed-in account that created them and are cleared when you sign out. Drafts made before you sign in belong to no account and may stay after you sign out. This storage on your device is not encrypted by us. Deleting your account clears this browser's copy, but not other devices or files you downloaded. If you choose "This is a shared computer", drafts stay in memory only and nothing is queued. You can also clear this data with your browser's settings.

9. Selling, sharing and advertising

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising or targeted advertising, as those terms are used in state privacy laws. We do not show ads and we do not build advertising profiles. We do not track you across other websites or apps.

10. How long we keep information

What	How long
Your account and journal	Until you delete them, or until you choose to stop keeping your words and delete your journal, which removes it after 30 days.
Deleted journal entries	When you delete an entry, you can undo it for about 60 seconds; after that it can't be restored, and we permanently remove the entry, its readings and photos at our next cleanup, usually within minutes.
Deleted photos	Removed from storage when you delete them
Interrupted photo uploads	Removed by our cleanup, normally within a day
Your account, when you delete it	Deletion starts right away (Section 11). We aim to finish the account and journal deletion within 24 hours, and no later than 30 days even if a step has to be retried. The separate free-trial safeguard below remains for its limited period.
Deleted-account free-trial safeguard	For fraud and abuse mitigation, while an account is deleted we keep only a keyed fingerprint of the verified email and consumed Free lifetime-trial counts for up to 30 days. If the same verified email registers again before expiry, we transfer those counts to the active account's normal lifetime usage and delete the temporary fingerprint in the same transaction. The counts reduce the recreated account's remaining Free lifetime allowances and remain consumed while that account is active, even after the temporary record's former deadline. If that account is later deleted, we create a fresh temporary record from all of its accumulated consumed lifetime trials, including transferred counts. We never transfer or revive an already expired record. Expired records stop being eligible for transfer immediately by database time. Physical deletion runs daily and also when that email is checked, so an expired row may remain stored until the next cleanup run rather than disappearing at the exact instant it expires. The temporary record contains no raw email, account ID, journal or operation history.
Deleted-account permission record	When you delete your account, we keep a record of the permissions you gave or withdrew for 6 months, then delete it. It holds what you agreed to, the wording version and the dates, and a coded version of your verified email. It holds none of your journal, and it isn't linked to your account.
Backups	We make a backup of our database each night and keep each one for 7 days. Every backup is stored encrypted. Inside it, your journal has a second layer of protection: it is encrypted with your personal key. Other information listed in Section 4, such as your email address, has the first layer only. Until a backup expires, deleted data in it could be read again if that backup were restored
Security and billing records	Content-free records, such as deletion receipts, security events and billing events, may be kept after your account is gone, for up to 7 years, without your journal and without your email address, as needed for security, accounting, tax and legal reasons. Our payment providers keep payment records as the law requires.
Emails and feedback you send us	As long as needed to help you and to keep a record, then deleted. In-app feedback is stored encrypted with your personal key and is deleted with your account; the copy emailed to us is kept like other email
AI providers	Sent only to hosts set to zero data retention, with data collection denied, so they should not store your request or the reading or use them for training. The routing service may check requests for illegal material that exploits children, and may keep a request it flags to review and report it as the law requires. Operational records (such as cost and token counts) are kept without reading text. Web search providers handle queries under their own terms

11. Your choices and rights

Whatever state or country you live in, you can:

• See and export your data. In Settings, under Privacy and data, you can download your journal as a zip of Markdown files (one per entry and one per custom spread) and your photos as a zip. On the Delete account page (Settings, then Delete account), you can also download a copy of your journal's content as JSON (your entries, readings with the searches and sources the AI used, collections, custom spreads and settings, without internal system details). You can start up to 5 exports in 24 hours. A large journal takes a while; please wait for an export to finish downloading before deleting your account.
• Correct it. You can edit your entries, collections and settings in the app. To change your email address, use Settings, under Account. For anything else, contact us.
• Delete it. In Settings, under Delete account, choose Delete account. For safety, you will confirm with a fresh sign-in code. Deletion is permanent. We delete your encryption key, your journal, photos, collections, custom spreads, account-linked usage records and notices, and your sign-in account, and we cancel your web subscription so it does not renew and ask our subscription management service to delete its record of you. For fraud and abuse mitigation, the keyed email fingerprint and consumed Free lifetime-trial counts described in Section 10 may remain for up to 30 days while the account is deleted; they contain no raw email, account ID or journal. Recreating the same verified email in time moves those counts into the active account and removes the temporary fingerprint. When you delete your account, we keep a record of the permissions you gave or withdrew for 6 months, then delete it. It holds what you agreed to, the wording version and the dates, and a coded version of your verified email. It holds none of your journal, and it isn't linked to your account. We then send a confirmation email. If you cannot sign in, use the account deletion page on our website (it emails you a sign-in link) or email support@spreadweaver.com.
• Turn off enhanced features. In Settings, under Privacy and data, or in Privacy choices, on any plan. Nothing new is sent. Your readings are not removed, and we keep a record that you withdrew.
• Turn off analytics. In Settings, under Privacy and data, or in Privacy choices. Analytics is off unless you allow it.
• Stop emails. Turn off daily reminders in Settings, under Reminders. Remove a follow-up reminder from its reading. Leave the monthly letter from any letter, or in Privacy choices. Account emails, such as sign-in codes, are needed to run the Service.

Privacy laws in some states. Residents of certain states, including California, Colorado, Connecticut, Virginia, Texas, Oregon and others, have additional rights over their personal information, such as to know and access it, correct it, delete it, receive it in a portable form, opt out of its sale, sharing, targeted advertising and certain profiling, limit the use of sensitive information, and appeal a decision about their request. We extend these rights to everyone. We do not sell or share personal information for advertising and we do not use sensitive information to infer characteristics about you, so those opt-outs are not needed. We will not discriminate against you for using your rights. Section 2 lists the categories of personal information we collect and where they come from, Section 3 why we use them, Section 7 the categories of companies we share them with, and Section 10 how long we keep them.

How to make a request. Email support@spreadweaver.com from the email address on your account. We may need to confirm it is you before acting, for example by asking you to sign in. We aim to respond within 45 days, and we will tell you if we need more time. You can ask an authorized agent to make a request for you, with your written permission. If we decline a request, you can appeal by replying to our message, and if you are still unhappy you may contact your state attorney general.

12. Security and data breaches

We use the safeguards described in Section 4 and we limit access to your data. No method of storage or transmission is perfectly secure, so we cannot promise absolute security. If a breach of the security of personal information affects you, we will notify you and the authorities as the law requires, including under Pennsylvania's Breach of Personal Information Notification Act (73 P.S. section 2301 et seq.) and other state laws that apply, without unreasonable delay.

13. Children

The Service is for adults only. You must be 18 or older to use Spread Weaver. We ask you to confirm you're 18 or older. We don't ask for your birth date. We do not knowingly collect personal information from anyone under 18. If you think a minor has created an account, contact us at support@spreadweaver.com and we will delete it. If we learn that a minor has signed up, we will delete the account and its data.

14. Where your information is processed

We operate in the United States, and we store your account and journal in the United States. AI requests may be processed in other countries, as described in Section 7. If you use the Service from outside the United States, you understand that your information will be transferred to, and handled in, the United States and those other countries, which may have different data protection laws from your country. We do not have an office or a representative in the European Union or the United Kingdom.

15. Changes to this Policy

We may update this Policy. We will post the new version here with a new "Last updated" date. If a change is material, we will tell you in advance (for example by email or a notice in the app), and if the law requires your consent we will ask for it.

16. Contact us

• Resonant Era LLC
• support@spreadweaver.com