Skip to content
Mystorae

Legal

Privacy Policy

Version 1.2 · Effective from October 10, 2026

Who is responsible

The controller for the processing described here is:

  • Name: the provider named in our Impressum
  • Address: the address shown on our Impressum page
  • E-mail: the e-mail address shown on our Impressum page

The full provider details are on our Impressum. We have not appointed a data protection officer, because the size and nature of our processing do not require one (Article 37 GDPR).

This policy explains what happens to your personal data when you use Mystorae — the website and, in future, the mobile app. It follows Article 13 of the General Data Protection Regulation (GDPR) and the German Telecommunications-Digital-Services Data Protection Act (TDDDG). It applies to every language version of the site; the legal jurisdiction is Germany.

The short version

  • You can draw a card without an account. We then set one signed cookie so your reading survives a page reload, and nothing else.
  • With an account, we store what you save. Readings are private to you. We never publish them, sell them or use them for advertising.
  • Tarot draws do not ask for a free-text question. Dream exploration and AI conversations let you write your own text, with the choices described below.
  • AI-assisted texts are written by a language model operated by OpenAI. Depending on the feature, it receives the cards, the topic, your Mystorae Love text or the dream and context you explicitly choose to discuss. It never receives a palm photo.
  • Palm analysis runs in your browser. A photo selected on that device stays there. If you choose QR transfer, your phone encrypts the photo before it is relayed to your computer; it is not saved to our database or sent to AI.
  • Initial dream exploration also runs on your device. Dream text is sent only when you choose to save it or consent to discussing it with Astraea.
  • There is no advertising, no advertising tracking and no third-party analytics. Account usage is measured on our own systems. On the Palm page you may also opt in to anonymous aggregate scan measurements without an account.
  • Only strictly necessary cookies are set, so there is no cookie banner. If that ever changes, we will ask first.

What we process, why, and on which legal basis

1. Visiting the site

When you open a page, your browser sends the technical data every website needs to deliver a page: your IP address, the page requested, the time, and information about your browser and device. Our hosting provider processes this to deliver the page and to keep the service secure (Article 6(1)(f) GDPR — our legitimate interest in running a working, secure website). We do not build profiles from it.

To protect the service against abuse, our rate limiting keeps a keyed hash of your IP address or e-mail address for the duration of a short window; the raw value is not stored, and the hash is deleted shortly after the window closes.

2. Reading without an account

Drawing a card does not require an account. To keep your shuffled deck, your chosen topic and your drawn cards for the rest of the visit, we set one cryptographically signed cookie (mystorae_reading) that lives for 24 hours. It contains the shuffle, the spread, the topic category and the cards; it does not contain any text you wrote, because there is nothing to write — Mystorae does not ask for a free-text question. Legal basis: the cookie is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG), and the processing is performance of that service (Article 6(1)(b) GDPR).

If you close the site without saving, the reading is gone when the cookie expires. Guest readings are not stored in our database.

3. Your account

To save readings, talk to the astrologer or use Mystorae Love and Mystorae Palm you need an account. We process:

  • your e-mail address and a password (stored only as a hash by our authentication provider),
  • a username,
  • your date of birth — to confirm that you are at least 18 and, if you use the astrologer, to compute your chart; it is written once and cannot be changed afterwards,
  • your interface language, time zone and plan preference,
  • the readings, notes, conversations and results you choose to keep (sections 4–8).

Legal basis: performance of the contract with you (Article 6(1)(b) GDPR). Confirming your age is also in our legitimate interest in offering the service to adults only (Article 6(1)(f) GDPR). When you register we record that you confirmed your age, and we receive an internal notification with your e-mail address and username so that we can watch for abuse.

Your e-mail address, a password and your date of birth are required to open an account; without them there is no account. Everything else — a note on a reading, birth time and place, a confession, a palm photo — is optional, and the features that need it simply stay unused.

Your session is kept in an authentication cookie set by our authentication provider (name beginning with sb-). It is strictly necessary for staying signed in and lives until you sign out or it expires.

4. Saved readings

A saved reading consists of the spread, the topic category, the cards you drew with their orientation, an optional note you write, and the time. The per-card interpretation comes from our published knowledge records and is not stored separately. If a multi-card synthesis was written by the language model (section 6), we keep that text with the reading so that you can read the same text again.

Legal basis: Article 6(1)(b) GDPR. Retention: until you delete the reading or your account.

5. The astrologer and your birth data

If you use the astrologer, you give us your birth date, birth time (if known) and birth place; we derive coordinates and a time zone and compute your natal chart on our own servers. This is the most identifying record we hold about you. It is stored until you erase it (you can do so from the astrologer page at any time) or delete your account.

Conversations with the astrologer, and the conversations attached to a reading, a palm reading or a Love reading, are stored for a short time only: at most the latest 20 turns of each conversation are kept, every turn is deleted after 10 days, and you can erase a conversation yourself at any moment. The model receives at most those 20 turns.

Legal basis: Article 6(1)(b) GDPR — you ask for the chart and the conversation.

6. AI-assisted texts (OpenAI)

Mystorae labels every AI-assisted text as such. The texts are generated by a language model provided by OpenAI (OpenAI, L.L.C., San Francisco, USA), acting as our processor. What the model receives depends on the feature:

  • Tarot readings: the spread, the position names, the cards drawn with their orientation, the topic category and the published meaning records for those cards. For Mystorae Love, additionally the intent you selected from a fixed list. No free text.
  • Mystorae Love confessions: the text you write, after we automatically remove e-mail addresses, links, phone numbers and social-media handles from it, together with your alias and the cards.
  • The astrologer: your display name, your birth instant and place, the computed chart, the current sky, the topics and cards of your saved readings, your palm observations if you have any, and the recent turns of the conversation.
  • Mystorae Palm: a short structured description of what was measured (bucketed observations such as "long heart line"), never the photo.
  • Dream conversations: the current dream report, optional waking-life context, selected feeling, optional symbolic-perspective choice, the questions and recent replies in this exact dream thread, and curated research summaries. A separate model call checks the proposed reply against this material before it is displayed. Other dreams in your journal are not automatically sent to the model.

We call the API with storage disabled. According to OpenAI's API terms, content sent through the API is not used to train OpenAI's models, and is retained by OpenAI for up to 30 days for abuse monitoring before deletion. OpenAI is located in the United States; see section "Transfers outside the EU".

We cache a generated synthesis for the exact same reading for up to 30 days so that reloading the page does not generate a different text; the cache is keyed by the reading, not by you.

Legal basis: Article 6(1)(b) GDPR. Where a confession you write reveals something about your health, beliefs or sexual life, you decide to include it, and we process it on the basis of your explicit consent given when you submit the confession (Article 9(2)(a) GDPR); you can withdraw that consent at any time for the future by deleting the confession or writing to us.

7. Mystorae Love — publishing your words

If you tick the publication consent when you submit a Love confession, we publish the resulting story on the site under a pseudonym (an alias such as "Mystorae0042"), together with the cards and the AI-written reading. Your name, e-mail address and account are never shown, and the automatic redaction described above runs before anything is published. The raw text you typed is deleted from our database once the story has been processed.

You can ask us to remove a published story at any time by e-mail; we will take it down and it will disappear from search engines as they re-index. Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time without affecting the lawfulness of the publication before the withdrawal.

8. Mystorae Palm

When you choose to sign in from a scan, a validated copy of its measurements is kept in this browser tab's session storage for up to 30 minutes so you can continue after authentication. It contains no photo or filename. Expired data is discarded when the page checks it, and starting another scan clears it. Closing the tab ends this storage. Sharing is initiated by you: the share sheet or clipboard receives the displayed insight and a public guide link; a downloaded card is generated on your device without the photo or palm outline.

The optional “Help improve the scan” control is off by default. Your explicit choice is kept in this tab's session storage across sign-in and removed when you disable it or close the tab. If you enable it, this visit can send fixed scan-step names, coarse time ranges, language and fixed failure categories to our own endpoint. We store only aggregate UTC daily counts, without an account ID, visitor identifier, photograph, line measurements or reading text. These reports are separate from account analytics. You can stop further reports by turning the control off; already anonymous counts cannot be linked back to a person. The request still uses the ordinary hosting and short-window abuse protection described in section 1.

The palm reading runs in your browser. The photo you take or choose is analysed on your device by a machine-learning model that we ship with the page; the photo is not saved to our database or sent to AI. What is stored, if you keep the reading, is a small structured description of the lines (their relative length, depth and shape as coarse categories, and a simplified outline), together with the written reading. We do not use this to identify you, and it cannot be used to reconstruct the photo.

Optional phone-to-computer transfer uses a temporary QR link. The phone applies image orientation, removes EXIF metadata and resizes the photo before encrypting it in the browser with AES-GCM. Supabase Realtime relays encrypted messages between the open pages; we do not write these messages to a database or photo bucket. The randomly generated encryption key stays in the QR URL fragment and browser memory, never in a server request, account record or analytics event. The link expires after 10 minutes, and the pages disconnect when the transfer completes, is cancelled or is closed. Anyone you give the complete QR or link can participate in that transfer, so keep it private. The encrypted relay uses ordinary connection data as described in section 1. Selecting a photo directly does not use this relay.

Legal basis: Article 6(1)(b) GDPR. Retention: until you delete the palm reading or your account.

8a. Dream exploration and your private dream journal

You can explore a dream without an account. The initial word-mention detection happens in your browser; we do not automatically submit or save the report, and we do not keep it in local or session storage. Leaving or reloading the page clears this unsaved input.

If you sign in and separately choose to save a dream, we store the original report, optional personal context and date, selected feeling, symbolic-perspective choice, detected mention tags, source identifiers and analysis version. Only your account can read or delete its entries. They remain until you delete them or your account; the journal is separate from the temporary conversation history. This is descriptive exploration, not a diagnosis or a scientifically validated interpretation of hidden meaning.

Before a dream conversation begins, you must explicitly allow the current report and optional context to be sent to Astraea AI. Each dream has its own private thread, with at most the latest 20 turns and a 10-day age limit. Alongside an assistant reply we store the configured model identifier, prompt and research-summary versions, selected and cited source identifiers, mention tags and reply language so that its grounding can be audited. This metadata is private to your account and is deleted with the associated message.

You can erase a dream conversation separately. Deleting a saved dream also erases its matching conversation; an already-running generation cannot restore it. A reset marker contains only your account identifier, the dream fingerprint and the reset time, without another copy of the dream or conversation. Account deletion removes these markers too. Dream text is not published, used for advertising or added to a shared dream corpus.

9. E-mails

  • Account e-mails (confirmation, password reset, a single welcome message) are sent because you asked for the account (Article 6(1)(b) GDPR).
  • The morning letter is a daily e-mail you can switch on in your account. We send it only with your consent (Article 6(1)(a) GDPR), and every letter contains a one-click link to stop it; you can also switch it off in your account. We record when you switched it on and off.

E-mails are delivered by our e-mail providers listed below.

10. Usage measurement

We want to know whether the product is used, not who you are. Account usage is measured only for signed-in accounts (the separate optional anonymous Palm counters are described in section 8): when a session starts, how long it was active, which kind of device (phone, tablet, desktop) and which language, and a fixed list of product events (for example "reading saved"). No event can carry a question, a note or any text you wrote — a technical guard rejects it. We do not set an analytics cookie; for the duration of a browser tab, a short-lived session identifier is kept in your browser's session storage and discarded when the tab closes. There is no third-party analytics service.

Legal basis: our legitimate interest in understanding and improving the service (Article 6(1)(f) GDPR). You may object at any time (see "Your rights").

11. Error monitoring

When something breaks, a technical error report is sent to Sentry (Functional Software, Inc., San Francisco, USA). We have switched off the collection of personal information and session recordings; before an event leaves our servers, request data, user data and breadcrumbs are removed, so a report contains the error, the page and technical context, not what you wrote. Legal basis: Article 6(1)(f) GDPR — keeping the service working.

12. Payments

No payments are taken at present. When purchases open, they will be handled by a payment service provider; we will never see or store your card number, and this policy will be updated first. Order records, consent records and the audit trail of a purchase are retained for the periods required by German commercial and tax law (§ 257 HGB, § 147 AO).

Cookies and browser storage

Only strictly necessary cookies are set, which is why there is no consent banner (§ 25(2) no. 2 TDDDG):

  • sb-… — your sign-in session, set by our authentication provider; until you sign out or it expires.
  • mystorae_reading — your current reading, signed, 24 hours.
  • mystorae.reply-language (local storage) — the reply language you chose for the astrologer; until you clear it.
  • mystorae.analytics.session (session storage, signed-in accounts only) — the identifier described in section 10; until the tab closes.

Fonts are bundled with the site, so no request goes to a font provider. The palm-reading model is delivered from our own site, and the telemetry calls that the underlying library would make are blocked.

Recipients and processors

We use the following processors under Article 28 GDPR contracts. They act on our instructions only.

  • Vercel Inc. (San Francisco, USA) — hosting and content delivery; our serverless functions run in Frankfurt.
  • Supabase Pte. Ltd (Singapore) with Supabase, Inc. (USA) — database and authentication; our project and all stored data are located in Frankfurt (EU).
  • OpenAI, L.L.C. (San Francisco, USA) — AI text generation, section 6.
  • Plus Five Five, Inc., trading as Resend (San Francisco, USA) — transactional e-mail and the morning letter.
  • Functional Software, Inc., trading as Sentry (San Francisco, USA) — error monitoring, section 11.

We do not sell personal data and we do not share it with advertisers. We disclose data to authorities only where the law obliges us to.

Transfers outside the EU

Our database and authentication data stay in Frankfurt. What leaves the EU is what the respective section above describes, and it goes only to the processors listed. For those established outside the EU we rely on:

  • the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795, Article 45 GDPR) for providers certified under it — Vercel, Sentry and Resend are listed as active participants;
  • the European Commission's standard contractual clauses (Article 46(2)(c) GDPR), incorporated in the provider's data processing agreement, for OpenAI and Supabase, which are not certified under the Framework.

You can obtain a copy of the clauses we rely on by writing to the e-mail address shown on our Impressum page.

How long we keep data

  • Account data: until you delete your account.
  • Saved readings, notes, palm readings, birth data: until you delete them or your account.
  • Conversations: at most 20 turns, each deleted after 10 days, or earlier by you. Dream reply audit metadata expires or is erased with its message.
  • Saved dream journal entries: until you delete them or your account. Conversation reset markers: until account deletion; they contain no report or message text.
  • Cached AI syntheses: up to 30 days.
  • Guest reading cookie: 24 hours.
  • Rate-limiting hashes: about one hour after the window ends.
  • Consent records, orders, audit trail: for the statutory retention periods (up to ten years for accounting records), even after account deletion, with the account reference detached.

Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you (Article 15),
  • rectification (Article 16) and erasure (Article 17),
  • restriction of processing (Article 18),
  • data portability (Article 20),
  • object to processing based on our legitimate interests, including the usage measurement in section 10 (Article 21),
  • withdraw consent at any time, with effect for the future (Article 7(3)),
  • lodge a complaint with a supervisory authority (Article 77). In Germany you may contact the data protection authority of the federal state in which we are established; the Federal Commissioner for Data Protection and Freedom of Information publishes the list at bfdi.bund.de. You may also complain to the authority of the EU country where you live.

You can delete dream journal entries, conversations, birth data, palm readings, saved readings and confessions yourself from the respective pages. To delete your whole account, to receive a copy of your data, or to exercise any other right, write to the e-mail address shown on our Impressum page. We answer within one month.

No automated decisions

Mystorae makes no decision about you with legal or similarly significant effect (Article 22 GDPR). Readings, charts and AI-assisted texts are reflections offered to you; they decide nothing.

Children

Mystorae is for adults. You must be at least 18 years old to create an account. We do not knowingly process data of anyone younger; if you believe a minor has registered, tell us and we will delete the account.

Changes to this policy

We publish every change as a new, dated version on this page. The version number and effective date are shown at the top. If a change affects how we use data you have already given us, we will tell you in your account or by e-mail before it takes effect.

Legal references

  • Regulation (EU) 2016/679 (GDPR) — EUR-Lex
  • Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz (TDDDG), § 25 — gesetze-im-internet.de
  • Judgment of the Court of Justice in Case C-298/07 (means of rapid contact) — EUR-Lex
  • Commission Implementing Decision (EU) 2023/1795 on the EU–US Data Privacy Framework — EUR-Lex
  • Handelsgesetzbuch § 257 and Abgabenordnung § 147 (retention of commercial and tax records) — gesetze-im-internet.de, gesetze-im-internet.de