Privacy Policy

Aurum Tarot Card Reading

Last updated: August 2, 2026

This privacy policy describes how Aurum Tarot ("the App"), published by Eduard Bruch, handles your data on iOS and Android. In short: there are no user accounts, your readings and journal stay on your device, and the only data that leaves your device is what is needed to generate your AI reading, process purchases, and — on Android, only with your consent — show advertising to free users.

1. Data Controller

Eduard Bruch

Kleinfeld 28c, 21149 Hamburg, Germany

Email: support@eduardbruch.com

2. No Accounts, No Registration

The App has no login and no user accounts. We do not know your email address, phone number, or identity. Where an identifier is technically required (purchases, rate limiting), a randomly generated, pseudonymous ID is used that is not linked to your name or contact details.

3. Data That Stays on Your Device

Your reading history, journal entries, streaks, preferences, and daily cards are stored locally on your device and are never uploaded.

You can erase all locally stored data at any time via Settings → Delete All Data, or by uninstalling the App.

4. AI-Generated Readings

When you request an AI interpretation, the App transmits the drawn cards, the spread type, your question or intention (if you typed one), and — if you provided them during onboarding — your first name and zodiac sign to our server. This data is used solely to generate your reading and the answers to your follow-up questions.

Processing happens on our infrastructure (Cloudflare) and through a large-language-model provider acting as our processor. We do not build profiles from your questions, we do not sell this data, and we do not use it for advertising. Requests are protected by rate limiting keyed to a pseudonymous ID.

Legal basis: performance of contract (Art. 6(1)(b) GDPR) — generating the reading you requested.

5. Purchases & Subscriptions

Payments are processed entirely by Apple (App Store) or Google (Google Play). We never see your payment details. To activate your purchase, our subscription processor RevenueCat receives the store receipt and a pseudonymous app-user ID.

Legal basis: performance of contract (Art. 6(1)(b) GDPR). See RevenueCat's privacy policy.

6. Advertising (Android, Free Version Only)

The iOS version and all premium subscriptions are completely ad-free. Ads are shown only to free users of the Android version.

On Android, free users see ads served by Google AdMob. AdMob may process your advertising ID, IP address (including approximate location derived from it), and ad interaction data. In the European Economic Area and the UK, personalized advertising happens only after you give consent through the consent dialog shown in the App; without consent, ads are limited or non-personalized.

You can change or withdraw your consent at any time in Settings → Advertising Privacy Options, and reset your advertising ID in your device's Google settings.

Legal basis: consent (Art. 6(1)(a) GDPR). See Google's privacy policy and AdMob's partner information.

7. Notifications

Daily card reminders are scheduled locally on your device. No push infrastructure is used and no data leaves your device for this feature. You can disable reminders in Settings or in your system notification settings.

8. International Data Transfers

Some of our processors (Cloudflare, RevenueCat, Google) process data on servers outside the EU/EEA, including in the United States. These transfers are safeguarded by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework certifications of the respective providers.

9. Data Retention

Local data remains on your device until you delete it. AI request content is processed transiently to generate your reading and is not retained by us in an identifiable form; rate-limiting counters expire automatically. Purchase records are kept as long as required for the operation of your subscription and by law.

10. Your Rights (GDPR)

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR), and the right to withdraw any consent at any time with effect for the future. To exercise these rights, contact support@eduardbruch.com. Because the App uses only pseudonymous identifiers, we may ask you for information (e.g. your order number) needed to locate data relating to you.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI).

11. Children

The App is intended for adults (18+) and is not directed at children. We do not knowingly process children's data.

12. Changes to This Policy

We may update this policy when the App or legal requirements change. The current version is always available at this address.