Privacy Policy

1. Who we are

SYMBOLIC is operated by Marcin Balinski (“SYMBOLIC,” “we,” “us,” or “our”). We are the controller of the personal information described in this policy. For privacy questions or requests, email privacy@symbolictarot.app.

2. Information we collect

Depending on how you use SYMBOLIC, we collect:

• Account and profile information: your email address, account identifier, display name, sign-in provider, and an optional profile photo.
• Personality and self-reflection information:your assessment answers, calculated Big Five personality scores, preferred question category, tarot questions or situations, selected cards, readings, journal entries, follow-up messages, feedback, and other content you choose to enter.
• Friend and shared-reading information:friendships, blocks, invitations, invitation topics, shared readings, participation status, and content exchanged within a joint reading.
• Purchase information: product identifiers, subscription or entitlement status, store, transaction events, and in-app balance history. Apple or Google processes your payment details; we do not receive your full card or bank-account number.
• Device, notification, and usage information:device platform, time zone, push-notification token and delivery status, app screens viewed, taps and feature interactions, app lifecycle events, app-generated identifiers, reading and purchase event metadata, IP address, request timestamps, and technical logs. Session replay is disabled in the current app configuration.
• Communications: your email address and the contents of messages you send us, including support and privacy requests.

We receive this information from you, from your device and use of the Service, from sign-in providers such as Apple, Google, and Firebase Authentication, and from purchase platforms and service providers such as Apple, Google, and RevenueCat.

3. How we use information

We use information to:

• create and secure your account and authenticate you;
• provide, personalize, and save assessments, readings, journals, daily messages, conversations, friendships, and shared readings;
• generate personalized content using artificial-intelligence services;
• process purchases, maintain entitlements and in-app balances, prevent duplicate grants, and restore purchases;
• send requested sign-in emails and optional notifications;
• understand feature usage, troubleshoot errors, protect the Service, prevent abuse, and improve performance and content;
• respond to requests and comply with legal obligations.

We do not sell personal information. We do not use your information for third-party advertising or to track you across apps or websites owned by other companies.

4. Artificial-intelligence processing

SYMBOLIC uses third-party AI providers to generate readings, card explanations, daily messages, relationship insights, and replies. The material sent for a particular request may include your prompt or situation, selected cards, relevant recent reading context, and a derived description of your personality profile. For joint or friend experiences, it may include relevant information from both participants.

Depending on the feature and system configuration, this material is processed by OpenAI or Anthropic on our behalf. Do not enter information you do not want processed for these purposes, including confidential information about another person. SYMBOLIC is a self-reflection service and is not a medical, mental-health, legal, or financial service.

Prompts and generated outputs may also be recorded in PostHog to monitor reliability, cost, and content quality. Input for sensitive joint-reading situations is redacted from these traces; the generated reading may still be recorded because it is the content delivered to both participants.

5. When information is shared

We disclose information only as needed to operate the Service, at your direction, or as required by law. Our service providers include:

• Google Firebase and Google Cloud for authentication, API hosting, infrastructure, and operational logs;
• Neon for managed database hosting;
• OpenAI and Anthropic for AI-generated content;
• PostHog for product analytics and AI-operation tracing;
• RevenueCat, Apple, and Google for purchases, subscriptions, entitlements, and sign-in where selected;
• Expo, Apple Push Notification service, and Firebase Cloud Messaging for app delivery, updates, and notifications;
• Resend for transactional email; and
• Vercel for website hosting.

These providers may process information in countries other than your own. Where required, we rely on recognized transfer mechanisms such as adequacy decisions or contractual safeguards. We require service providers to use personal information only to perform their services for us and to protect it consistently with this policy and applicable law.

We may also disclose information to professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, or complete a merger, financing, acquisition, or sale of assets. If ownership changes, this policy continues to apply unless you are notified otherwise.

6. Social features and information you share

When you use friend or joint-reading features, the people involved can see information necessary for that experience, such as your display name, profile photo, invitation topic, participation, and the resulting shared reading or conversation. A shared invitation link can show a limited preview—including the inviter’s name, profile photo, and topic title—to anyone who has the link.

Profile-photo links use long, unguessable addresses so photos can load in the app, but anyone who obtains such an address may be able to view the photo until you replace or remove it. Content you export or share through your device is handled by the apps and people you choose.

7. Legal bases for processing

If European Economic Area or UK data-protection law applies, we process personal information under the following legal bases:

• Contract: to create your account and provide the Service you request.
• Legitimate interests: to secure, maintain, troubleshoot, understand, and improve the Service, provided those interests are not overridden by your rights.
• Consent: where we ask for it, including device permissions and optional notifications. You can withdraw consent through device settings or by contacting us.
• Legal obligation: to keep required transaction and compliance records and respond to lawful requests.

8. Retention and deletion

We keep account and saved content while your account is active and for as long as needed to provide the Service. You can remove an individual profile photo, journal entry, or eligible reading using available in-app controls. A deleted joint reading may remain available to the other participant; it is hidden from your account and removed entirely when no participant retains it.

To request deletion of your account and associated personal information, email privacy@symbolictarot.app from the address linked to your account. We may ask you to verify ownership. We will delete or de-identify information unless we must retain it for legal, security, fraud-prevention, dispute-resolution, or financial-recordkeeping purposes. Purchase and transaction records may therefore be retained after account deletion. Residual copies may remain temporarily in backups until overwritten.

Expired authentication and invitation credentials stop working at expiration. Operational logs, analytics, delivery records, and provider-held records are retained only for their applicable operational, security, or legal periods and are then deleted or de-identified.

9. Your choices and rights

You can:

• change your display name and profile photo in the app;
• disable notifications in the app or your device settings and revoke photo-library access in device settings;
• remove friends, revoke invitations, or block another user;
• request access, correction, deletion, restriction, objection, or portability where applicable; and
• withdraw consent at any time where processing relies on consent.

Send a request to privacy@symbolictarot.app. You may also complain to the data-protection authority where you live or work. We will not discriminate against you for exercising a privacy right.

10. Security

We use technical and organizational safeguards designed to protect personal information, including encrypted transport, authentication, access controls, secrets management, and rate-limiting. No online service can guarantee absolute security, so please use care when choosing what to enter or share.

11. Children

SYMBOLIC is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and delete it where required.

12. Changes to this policy

We may update this policy as the Service or applicable law changes. We will post the revised policy here and update the date above. If a change materially affects how we use personal information, we will provide additional notice when required.

13. Contact

For questions, requests, or complaints about privacy, contact Marcin Balinski at privacy@symbolictarot.app.