Privacy Policy

1. Information we collect

• Account information. If you create an account, we process your email address, authentication credentials, session information and account identifier. If you choose Google or Apple sign-in, we receive the profile and authentication information those services provide, which may include your name, email address and provider identifier.
• Readings and app content. Tarot results, journal notes, collections, preferences and downloaded content are stored on your device. Signing in can start account synchronization of reading facts, dates, time zones and collection choices. Ordinary synchronization does not upload private journal notes or locally generated rule-based interpretations.
• Optional AI features. Accepting the Terms of Service and this Privacy Policy in the app also permits the AI data sharing described here. When you choose an AI reading or follow-up, we send the question, card and spread information, language and relevant earlier messages in that reading to the AI providers listed below and process the resulting response. When you request personalized meditation, we process your mood, the feelings you submit, practice preferences and any reading you choose to include. Older app versions may also submit journal text as meditation context. Submitted context, generated guidance, audio and practice records may be stored with your account. Choosing a local reading does not send its content to AI providers.
• Purchases. We receive store transaction identifiers, receipts or purchase tokens, product and subscription status, and verification results to provide and restore benefits. Apple or Google processes your payment details; we do not receive your full payment-card information.
• Technical information. Our hosting and service systems process IP addresses, request metadata, device or installation identifiers, app and operating-system versions, language, timestamps, usage limits and error information. These support authentication, reliability, fraud prevention and anonymous usage limits.
• Communications. If you contact us, we process your email address and the information you include so we can respond.

Questions, feelings and notes can contain sensitive personal information. Include only information you want processed for the feature you choose, and avoid sharing another person's private information without permission.

2. Voice and microphone access

Voice input is optional and uses microphone permission to record audio when you start a recording. The audio is sent to our backend and transcription provider to turn it into text. You can review or edit the text before submitting it as a question or note. Voice transcription can send audio even when the resulting text is saved only as a local journal note.

The current immediate-transcription flow does not intentionally save a new recording on our server after processing. Older queued voice requests may retain audio to complete or retry a request; that server copy is deleted after successful processing or when it expires, with a maximum retry-retention period of seven days. Historical recordings may remain on your device until you delete the associated content or clear the relevant local data. Provider retention is governed by the provider's policies.

3. How we use information

We use information to deliver the features you request, manage accounts and synchronization, generate readings and meditation, verify purchases, enforce usage limits, respond to support requests, understand app usage, diagnose failures and protect the service against abuse. Where applicable law requires a legal basis, we rely on providing the requested service, our legitimate interests in operating and securing it, consent where required, and compliance with legal obligations.

4. Service providers and other disclosures

Information is shared with providers as needed for the feature you use:

• Cloudflare hosts the website, API, account databases and private content storage, and delivers verification and password-reset emails through its Workers email binding when email delivery is enabled. Email delivery processes your email address and the message containing your verification code. See Cloudflare's privacy policy.
• OpenRouter and its model providers process AI requests and voice transcription. The current reading route uses OpenAI through OpenRouter; voice transcription uses a Qwen model through OpenRouter. Content and relevant context are sent to the selected provider. See OpenRouter's privacy policy and provider data policies.
• Google Cloud / Gemini processes text used to synthesize meditation narration. Some historical audio routes use Google models through OpenRouter. See Google Cloud's privacy notice.
• Google Firebase, Google Analytics and Google AdMob provide usage analytics, crash diagnostics and advertising in app versions that enable those services. See Firebase's privacy information and Google's privacy policy.
• Apple and Google process store purchases and, when selected, social sign-in under their own policies. See Apple's privacy policy and Google's privacy policy.

AI providers can have different logging, retention and data-use policies. We do not promise that every AI request has zero retention or that every provider excludes all submitted data from training. Please review the linked provider policies before submitting sensitive information.

We may also disclose information when required by law, to protect people's rights or safety, to investigate abuse, or as part of a business transfer subject to applicable privacy obligations.

5. Public reading links

If you choose to share a reading, anyone with the link can view and forward the question, selected cards and first AI response. The sharing page does not include your account profile, private notes, audio or follow-up messages. You can stop sharing in the app; deleting the source reading or account also removes the active link. Copies or screenshots already made by other people remain outside our control.

6. Advertising, analytics and diagnostics

Free app experiences may display AdMob ads. Advertising services may process IP addresses, device information, advertising identifiers where available and permitted, ad interactions and approximate location to deliver, measure and protect ads. We do not send your reading questions, journal notes or AI responses to advertisers for targeting. Where required, Google's consent interface offers advertising choices, and the app provides ad privacy options when available. The current iOS app does not request permission for cross-app tracking.

Accepting the Terms of Service and this Privacy Policy in the app permits Google Firebase Analytics usage collection and Firebase Crashlytics crash reporting, as well as the AI data sharing described above. Rejecting disables all three and leaves local features available. No separate AI or diagnostic confirmation is needed after acceptance. You can review or withdraw this choice in Settings.

After acceptance, app versions with Firebase enabled collect usage events and crash diagnostics, including app activity, device or installation identifiers, app and OS versions, error traces and fixed categories such as screen, theme, reading mode, account status and subscription status. Our custom event and diagnostic fields exclude questions, journal notes, AI response text, email addresses, recordings and account identifiers. Firebase and Google Analytics may collect their own technical identifiers.

Our website, including these policy pages, uses Cloudflare Web Analytics to measure page views and website performance. Its browser beacon collects metrics such as page paths and loading and interaction timings. It does not use cookies or local storage to collect usage metrics. See Cloudflare's information about these metrics.

7. Storage and retention

Local records remain on your device until you delete them or clear local app data. Account content and requested AI results are retained to provide history, synchronization and the service until deleted, subject to necessary operational or legal retention. Generated private meditation audio is stored with the associated content. Authentication and verification records expire or are removed according to their service purpose.

Account deletion removes the account, sessions and associated server content, including active reading shares and private meditation content. We retain minimal deletion receipts, irreversible account-association summaries and transaction-claim records as needed to prevent duplicate purchase claims, protect deletion integrity and meet legal obligations. These retained records do not contain your original reading material, questions or AI responses.

Deleting local data does not delete cloud account data. Deleting an account does not erase separately exported files, other devices' local copies, recipients' copies or records that Apple, Google and other providers retain under their own policies. It also does not cancel a store subscription.

8. Your choices and privacy rights

You can use available offline features without an account, choose whether to request AI or voice features, pause account synchronization, revoke microphone access in device settings, manage available ad privacy options, stop sharing readings, export available app data, clear local data or delete your account through the app's settings. Some choices limit the corresponding online feature.

Depending on your location, you may have rights to access, correct, delete or obtain a copy of your personal information, restrict or object to certain processing, withdraw consent, or complain to your local data-protection authority. Send requests to admin@genowave.com. We may ask for information needed to verify your identity and will handle requests according to applicable law. Withdrawing consent does not affect processing already lawfully completed.

9. Security and international processing

We use safeguards such as HTTPS, authenticated access and account isolation to protect information. No storage or transmission method is completely secure. Genowave and its providers may process information in countries other than where you live, whose privacy laws may differ. Where required, international transfers are subject to applicable legal safeguards.

10. Children

The service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided personal information, contact us so we can investigate and remove it as appropriate. Users must also meet any higher minimum age required in their location.

11. Changes and contact

We may update this policy as the service or legal requirements change. The current policy and its effective date are posted here; we will provide additional notice or seek consent when required.

For privacy questions or requests, contact Genowave at admin@genowave.com.