Privacy Policy - Hekate Apps

1. Who We Are and What This Policy Covers

Hekate Apps is the controller of the personal data described in this policy. You can contact us at support@hekateapps.com.

This policy applies to hekateapps.com and the Hekate applications that link to it, including Hekate Tarot, Hekate Lenormand, Hekate Astrology, Hekate Numerology, and Hekate I Ching. Not every feature described below is present in every application.

2. Information We Collect

Depending on how you use Hekate Apps, we collect the following information:

• Account and access data: your email address, language, notification preference, account status, and records needed to issue and verify magic links and maintain a signed-in session. Hekate Tarot and Hekate Lenormand do not use passwords.
• Reading data: the question you ask, selected cards or symbols, spread, language, generated interpretation, and related reading details. Signed-in readings that qualify for private history are stored in encrypted form so you can access them across devices.
• Hekate Memory data: if you enable Memory or include an eligible reading in Memory, we store encrypted summaries, recurring-card information, and other context used to make later readings more personal.
• Purchase and credit data: Stripe customer, Checkout, payment, invoice, refund, dispute, and billing-portal identifiers; purchased product, amount, currency, status, credit grants, reservations, and ledger entries. Hekate Apps does not receive or store your full payment-card number.
• Technical and security data: IP address, user agent, country, API endpoint, response status and timing, an anonymous browser identifier, device or browser digests, session and security events, and rate-limit or fraud-prevention records.
• Usage and service-operation data: app type, reading class, AI provider and model, token usage and estimated cost, and privacy-minimised journey events. Ordinary AI usage records do not contain your question or interpretation.
• Contact data: your name, email address, subject, message, IP address, and reCAPTCHA result when you use the Hekate Apps contact form or contact support.

For abuse prevention, a rejected question may be retained with its validation result and technical information. Accepted anonymous questions are sent for generation but are not added to private reading history unless you sign in and the reading is eligible to be saved.

3. How and Why We Use Information

We use personal data only where we have a lawful reason to do so. The main purposes and legal bases are:

• To provide readings, accounts, private history, Memory, credits, and purchases, and to respond to support requests: performance of our contract with you or steps you ask us to take before entering one.
• To process payments, refunds, disputes, invoices, and accounting records: performance of our contract and compliance with legal obligations.
• To authenticate users, prevent abuse and fraud, enforce limits, investigate errors, secure the service, and maintain reliable operations: our legitimate interests in operating and protecting Hekate Apps and its users.
• To understand service performance and improve Hekate Apps: our legitimate interests, and consent where applicable law requires it for non-essential cookies or similar technologies.
• To send magic links, purchase or account messages, deletion and recovery messages, and other necessary service communications: performance of our contract and security of your account.
• To send the optional weekly free-credit reminder: your notification preference. You can turn this off from your account panel or use the unsubscribe link in the email.

4. AI Processing and Reading Content

Hekate Apps uses OpenAI and Anthropic to generate and structure interpretations. To provide a reading, we may send the provider your question, cards or symbols, spread, language, instructions needed to produce the requested interpretation, and relevant Hekate Memory context when you have enabled that feature.

AI-generated readings are intended for reflection and entertainment. Hekate Apps does not use them to make decisions about you that produce legal or similarly significant effects. We do not use your reading content for third-party advertising.

5. Private History and Hekate Memory

Eligible signed-in Tarot and Lenormand readings can be kept in your private history so they are available on your devices. You can delete an individual reading, clear your history, export available history, or delete your account using the controls provided in the applications.

Memory is an optional personalisation feature. When enabled, it can recognise recurring cards and use summaries of earlier eligible readings as context for future readings. Turning Memory off stops its use for future personalisation; deleting a reading, clearing Memory data, or deleting your account removes the associated active content as described by the relevant control.

6. Cookies, Local Storage, and Similar Technologies

Hekate Apps uses browser storage and cookies for the following purposes:

• Essential functions, including signed-in sessions, security, language and theme choices, and returning safely from magic-link or payment flows.
• A randomly generated browser identifier used across Hekate Tarot and Hekate Lenormand to apply free allowances, protect the service, and measure aggregate API activity. It is stored in local storage and a first-party cookie for up to one year unless you clear it.
• Google Analytics and Google Ads conversion measurement on the Hekate Apps marketing website. Google may set or read cookies and receive device, browser, interaction, and approximate-location information.
• Google reCAPTCHA on the contact form to distinguish genuine submissions from automated abuse.

You can remove or block cookies and local storage through your browser settings, although essential account, allowance, and checkout features may then stop working correctly.

7. Who We Share Information With

We share information only as needed to provide, protect, and operate the services:

• OpenAI and Anthropic process the reading inputs described above to provide AI features.
• Stripe processes payments and billing. Stripe receives payment and transaction information directly; Hekate Apps receives identifiers and transaction status needed to fulfil and support your purchase.
• Postmark, operated by ActiveCampaign, delivers magic links, account-security messages, receipts or purchase messages, and optional weekly reminders.
• Google provides Analytics, Ads conversion measurement, reCAPTCHA, and web fonts used by the marketing website.
• DigitalOcean, Verpex, and related infrastructure suppliers host the API, database, websites, encrypted recovery bundles, and operational services.
• Professional advisers, regulators, law enforcement, courts, or a buyer of the service may receive information where reasonably necessary and permitted or required by law.

We do not sell your personal data, and we do not provide your email address or reading content to third parties for their own direct marketing.

8. Retention

We keep information only for as long as it is needed for the purposes described above. Current operational periods include:

• Private reading history and active Memory content are retained until you delete the relevant content or your account, subject to short backup retention.
• Magic links normally expire after 15 minutes. Pending reading data used during sign-in normally expires after 30 minutes. A short encrypted response replay used for safe retries expires after 8 days.
• Signed-in sessions expire after 30 days of inactivity and have a maximum lifetime of 90 days.
• API request logs are retained for 30 days. Rejected-question abuse records are retained for 90 days. Browser-fingerprint records are retained for 90 days, authentication-request security events for 1 day, and privacy-minimised reveal events for 180 days.
• Weekly reminder delivery records are retained for up to 400 days.
• Encrypted recovery bundles are retained for 35 days.
• Purchase, credit, refund, dispute, audit, and accounting records may be retained for longer where needed to fulfil purchases, resolve disputes, prevent fraud, and meet tax, accounting, or legal obligations.

Account deletion has a 7-day recovery period after confirmation. At final deletion, active account content is deleted or anonymised and purchase records are detached from the account where they must be retained. Residual encrypted copies can remain in recovery bundles until those bundles expire.

9. Security

We use measures designed to protect personal data, including encryption of account email addresses, private reading content, Memory content, and recovery bundles; one-way digests for authentication tokens and selected security identifiers; restricted administrative access; signed Stripe webhooks; rate limiting; and operational monitoring. No internet service is completely secure, so we cannot guarantee absolute security.

10. International Transfers

Some providers named in this policy may process data in the United States or other countries outside the United Kingdom or European Economic Area. Where required, we use providers that offer an applicable adequacy mechanism or contractual safeguards for those transfers. You can contact us for more information about the safeguards relevant to your data.

11. Your Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct inaccurate or incomplete personal data.
• Ask us to delete or restrict the use of personal data.
• Object to processing based on legitimate interests or to direct marketing.
• Receive data you provided in a portable format where the right applies.
• Withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
• Complain to the UK Information Commissioner's Office or your local data-protection authority.

You can exercise in-app controls for history, Memory, reminders, and account deletion, or email support@hekateapps.com. We may need to verify your identity before responding. We normally respond within one month where UK data-protection law applies.

12. Children's Privacy

Hekate Apps is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has provided personal data, contact us so we can investigate and delete it where appropriate.

13. Changes to This Policy

We may update this policy when our services or legal obligations change. We will publish the revised policy here, update the "Last Updated" date, and provide an additional notice when a material change requires it.

14. Contact Us

For privacy questions or to exercise your rights, contact Hekate Apps at:

support@hekateapps.com