Privacy Policy

The controller responsible for processing your data is:

Orcana, Volkan Bayrak, Schellingstraße 65, 22089 Hamburg, Germany

Email: kontakt@orcana.app — Phone: +49 151 27111418

Orcana is an entertainment app for coffee-ground, tarot and astrology readings. For the app to work, we process some of your data. This policy tells you in plain words which data that is, why we need it, who else gets to see it and what rights you have.

Two points up front, because they matter most to most people:

We do not use any tracking or advertising analytics. There are no analytics tools, no advertising pixels and no sharing of your data with advertising networks.

We do not store photos of your coffee cup. They are used solely for the reading and discarded afterwards. More on this in section 6.

When you open the app, technically necessary connection data that every browser transmits automatically is processed — in particular your IP address, the time of the request, the page requested, browser type and operating system. This data arises at our hosting provider and is required to deliver the app at all and to protect it against attacks.

The legal basis is our legitimate interest in operating the app securely and reliably (Art. 6(1)(f) GDPR).

Our hosting provider is Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. We have a data processing agreement with Vercel; the transfer to the USA is safeguarded by the European Commission's standard contractual clauses.

Using Orcana requires a user account. You sign in exclusively with your Google account.

In doing so, we receive from Google a unique user ID, your email address and the name stored in your Google profile. We do not receive or store a password. We do not use your profile picture or any other information from your Google profile.

The user ID and the email address are stored in our sign-in service for as long as your account exists. The email address is used to link you to your account and to reach you about important matters. Your name is used as the default for addressing you personally in the app; you can change or delete it in your profile at any time. The user ID is also used to link purchases to your account (see section 8).

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

The sign-in process is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google's privacy notices apply in addition.

So that the readings suit you, you can provide the following information in your profile: name or display name, gender (for addressing you personally), date of birth, time of birth, place of birth and your preferred language.

Date, time and place of birth are needed for the astrological calculations. Without them, an astrology reading is not possible. All information is voluntary — without it, however, you cannot use the corresponding features, or only to a limited extent.

In addition, we store with your account your Premium status, your credit balance and counters showing how many readings you have requested in which period. These counters are needed to calculate the free allowances correctly.

While a reading is being created, we also briefly note that a reading is currently in progress for your account. This prevents several readings from being requested at the same time to get around the allowances. The note is deleted as soon as the reading is complete.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

The texts of the readings are generated by an AI language model. They are not statements by a real fortune teller. The characters shown are fictional figures.

To create a reading, we send our AI provider the information required in each case:

• Coffee-ground reading: the photos you took of your cup — for a video recording, a single frame taken from it instead —, the chosen character, your mood and your language
• Tarot reading: the cards drawn, the chosen character, your mood and your language
• Astrology reading: date, time and place of birth, zodiac sign, element and ascendant, the chosen character, your mood and your language

For all types of reading, we also send your name, your gender and your age so that the reading addresses you personally. We do not send your email address or your user ID.

About the photos: The images of your coffee cup are reduced in size on your device and then sent to the AI provider solely for the purpose of the reading. We do not store them in our database or in any file storage. Once the reading is complete, they are also removed from your browser's temporary storage.

About videos: A video recording of your cup is processed only on your device. Only a single frame from it is sent to the AI provider. The video file itself never leaves your device and is not stored anywhere.

What we store: the generated text of the reading, the type of reading, the chosen character, your mood, the language and the time. For tarot readings, also the cards drawn; for astrology readings, the birth details used and the zodiac signs calculated from them. This is used for your reading history in the app.

Our AI provider is Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. We have a data processing agreement with Anthropic. The transfer to the USA is safeguarded by the European Commission's standard contractual clauses. Under Anthropic's terms, the content transmitted is not used to train AI models.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR), as creating the reading is the service you requested.

Your profile information and the texts of your readings are stored with our database and sign-in provider.

The servers on which this data is kept are located in Ireland, and therefore within the European Union. Your profile information and reading texts do not leave the European legal area.

The provider is Supabase, Inc., 970 Toa Payoh North, #07-04, Singapore 318992. We have a data processing agreement with Supabase.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

In the Android app, you can take out a Premium subscription or buy individual credits. The payment itself is handled by Google Play. We do not receive your payment details such as card number or bank account.

To manage your purchases, we use the service provider RevenueCat. As soon as you are signed in to the Android app, the app connects to RevenueCat using your user ID — even if you do not buy anything. This way, a purchase can be reliably linked to your account, even after you change devices. The data transmitted includes your user ID, technical information about your device and the app (such as device model, operating system and app version, language setting), your IP address and, for a purchase, the purchase data from Google Play (product, price, currency, time, order number, subscription status). We do not send your name, your email address, your profile information or your readings to RevenueCat.

After you sign out, the app continues to run under a randomly generated, anonymous ID until it is next started. This entry is not linked to your account and contains only technical information about the device and the app.

After a purchase, RevenueCat notifies our server so that Premium can be activated or credits added. For this, we store with your account: order number, product, quantity, whether it was a test or a real purchase, an ID of the transaction and the time. Your credit balance and your Premium status are also stored with your account.

The provider is RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA. We have a data processing agreement with RevenueCat; the transfer to the USA is safeguarded by the European Commission's standard contractual clauses.

The payment is handled by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, under its own responsibility. Google Play's terms and privacy notices apply to it.

If you delete your account, we also delete your entry at RevenueCat and the purchase data stored with us. An active subscription does not end automatically as a result — please cancel it in Google Play first.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR).

For the astrology reading, you can enter your place of birth using a search field. As you type, the place name you enter is sent to an external map service, which suggests matching places along with their geographic coordinates. The coordinates are needed to calculate the ascendant.

The request to the map service goes through our own server. The map service only receives the place name you entered and the address of our server, not that of your device. We do not send your name, your email address or your user ID.

The map service is operated by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. The servers are located in the United Kingdom. For the United Kingdom, there is an adequacy decision of the European Commission confirming a level of data protection comparable to the EU.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR), as the location search is a feature you requested.

Orcana stores certain information directly in your browser so that the app works and you do not have to re-enter everything at every step.

Sign-in cookies: These keep you signed in. Without them, you would have to sign in again every time you change pages. They are technically necessary and therefore do not require consent (Section 25(2) no. 2 of the German Telecommunications and Digital Services Data Protection Act, TDDDG).

Your browser's local storage: Here we keep, among other things, your language setting, your profile information, the most recently chosen character, your latest reading texts for faster display, and counter values. This data does not leave your device, except where it is needed — as described above — for a reading or for storage in your profile.

Your browser's session storage: This briefly holds the information of the process currently running, such as the photos taken, until the reading is complete. This data is deleted at the latest when you close the browser tab.

We do not use cookies or similar technologies for analytics, advertising or tracking purposes.

We store your profile information and your email address for as long as your account exists.

Reading texts remain stored in your history; for free accounts, older readings are removed automatically, so that only the three most recent readings of each type are kept.

Technical connection data at the hosting provider is deleted after a short time in accordance with the provider's rules.

If you delete your account, your profile, all stored readings, your purchase data, your entry at RevenueCat and your sign-in account are removed completely. At the same time, the information stored on your device is deleted.

Statutory retention obligations, for example under tax and commercial law, remain unaffected.

You can delete your account yourself at any time: in the app under Profile → Delete. The deletion takes effect immediately and cannot be undone.

If you no longer have access to the app, you can also start the deletion via our public deletion page: orcana.app/konto-loeschen. There you enter the email address of your account. We then send you an email with a confirmation link; your account is deleted only once you open this link. The address entered is not stored permanently for this process.

Alternatively, you can request deletion by email to kontakt@orcana.app.

To send these emails, we use an email delivery service. Your email address and the content of the message are transmitted in the process. Emails are sent via servers in Ireland.

The provider is Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA. We have a data processing agreement with Resend; the transfer to the USA is safeguarded by the European Commission's standard contractual clauses.

The legal basis is the performance of the user agreement (Art. 6(1)(b) GDPR) and our legal obligation to erase data (Art. 17 GDPR).

Under the General Data Protection Regulation, you have the following rights:

• Access to information about which data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability — receiving your data in a common format (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)

To exercise these rights, a simple message to kontakt@orcana.app is enough.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de

You can also contact the supervisory authority where you live.

Although the readings are generated automatically, they serve entertainment purposes only. There is no automated decision-making that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).

We update this privacy policy when the app or the legal situation changes. The version published here applies in each case.