This policy explains what information RandomTarot collects when you use the site, why, how long we keep it, and how you can ask us to delete it. The service is provided for reflection and entertainment only.
Last updated: 12 November 2026.
What we collect
When you draw a free reading, we record:
- The question category you selected (love, career, money, decision, or general).
- The card result: which cards were drawn, their orientation, and the spread used.
- A salted hash of your IP address. We combine your IP with a secret value and run it through a one-way hash. This lets us apply rate limits and detect abuse without storing the IP itself. The hash cannot be reversed to recover your address.
- Basic request metadata such as the time of the reading.
When you purchase a deep report, we additionally record an order token, the amount and currency, the payment status, the email address you provide for delivery and refunds, and the generated report file.
We also use Cloudflare Web Analytics, a privacy-focused analytics service that does not use cookies and does not track you across sites. It gives us aggregate page view and performance data.
We additionally run Minilytics, our own self-hosted analytics service at analytics.yololab.cc. It sets two first-party cookies: ml_vid, a random visitor identifier kept for one year, and ml_sid, a session identifier kept for 30 minutes. They let us count unique visitors, sessions, entry pages and referral sources in aggregate. Minilytics does not use advertising identifiers, does not track you across other websites, and does not receive the text of your tarot question. When you buy a report, we also send Minilytics the order identifier, amount, currency and the same random visitor/session identifiers so the purchase can be attributed to the visit that led to it; we do not send your question, report or payment details.
What we do not collect
- The text of your question, by default. The free reading only needs the category. The words you type are not stored unless you explicitly choose to include them in a paid report.
- Birthdays, photos, contact lists, or other personal details. We do not ask for them.
- Payment card numbers. Payments are processed by Waffo Pancake (Waffo.com Limited, merchant of record). Card details go directly to Waffo and never pass through our servers.
- Advertising identifiers. We do not run third-party advertising or tracking pixels.
How we use the data
To produce your reading and, if purchased, your deep report; to apply rate limits and prevent abuse; to process payments, deliver reports, and handle refunds; to understand which parts of the site are used, in aggregate; and to comply with tax and accounting obligations for paid orders. We do not sell data, and we do not use your readings to build an advertising profile.
Retention
- Free readings: category, card result, and hashed IP are kept for 90 days, then deleted.
- Paid orders: order records are retained for as long as required for tax, accounting, and refund handling, typically several years depending on jurisdiction.
- Report files: kept for 180 days from creation so that you can re-download, then deleted.
- Analytics: Cloudflare Web Analytics retains aggregate data under Cloudflare’s own policies. Minilytics stores aggregate page views and the random
ml_vid/ml_sididentifiers in our own database; the cookies expire after one year and 30 minutes respectively.
Third parties
- Cloudflare hosts the site, runs the card generator on its edge network, stores our data, provides Web Analytics, and powers the optional AI deep reports through Workers AI. Cloudflare processes data on our behalf as our infrastructure provider.
- Waffo Pancake (Waffo.com Limited) processes payments as merchant of record under its own privacy policy.
We do not share data with any other third party except where required by law.
Your rights and deletion requests
You can ask us to delete the data associated with you. Email support@randomtarot.site with your order token (for paid reports) or the approximate time and category of a free reading. Because free readings are not linked to an account or a raw IP, we may not be able to identify a specific free reading, but we will delete whatever we can match. Minimal paid order records may be retained where tax or accounting law requires it.
Depending on where you live, you may also have rights to access, correct, or export your data. Contact the same address.
Cookies and children
The site does not set advertising or cross-site tracking cookies. Minilytics sets the first-party ml_vid and ml_sid cookies described above, used only to measure aggregate usage on this site. A short-lived session value may also be used to deliver a purchased report. The site is intended for adults aged 18 and over, and we do not knowingly collect data from children.
Changes and contact
If this policy changes, we will update the date at the top of this page. Questions: support@randomtarot.site. See also our terms of service and disclaimer.