Privacy Policy

1. Who We Are

Unveyled is offered by Sphereness, a sole proprietorship registered in the Netherlands (Chamber of Commerce number 17215839), Hermenstraat 12, 5712 CV Someren, the Netherlands. Sphereness is the controller of your personal data under the General Data Protection Regulation (GDPR), wherever you live.

For anything about your privacy, email privacy@unveyled.com.

2. Information We Collect

• Account: your email address and the name you give us. If you sign in with Apple or Google, we receive an account identifier from them and, if you allow it, your name and email address. Apple may give us a private relay address instead of your own.
• Preferences: your answers during onboarding (such as your experience with tarot, what you hope for, your zodiac sign and how you feel) and your app settings, such as language.
• Your content: the questions you ask, your readings and their interpretations, your journal notes, your chat messages and any report you send us about a reading.
• Activity: your streak, achievements and the cards you have discovered.
• Subscription: which subscription you have, its status and its dates. Payment is handled entirely by Apple or Google; we never see your payment details.
• Technical data: when you sign in, we store your IP address and a short description of your device and app version with your login session. If you allow notifications, we store a push token and your device name.
• Crash and error reports: when the app or our server runs into an error, a report is sent with technical details such as device model, operating system, app version and what went wrong. These reports do not contain your name or email address.

Your content may say something about your feelings, relationships or health. We use it only to give you your readings and for nothing else.

3. How We Use Your Information

• To provide the app: create your account, sign you in, create and store your readings, journal and chats, and check your subscription. Legal basis: performance of our contract with you.
• AI interpretations: sending the data described at the top of this policy to OpenAI. Legal basis: your consent.
• Safety: the text you type is checked automatically, by keyword and by OpenAI's moderation service, so that we can show crisis support information instead of a reading when someone may be in danger. Legal basis: legitimate interest (protecting your wellbeing).
• Security and reliability: preventing abuse, limiting repeated sign-in attempts and fixing errors. Legal basis: legitimate interest.
• Email: we only send you sign-in and verification codes. We do not send marketing email.
• Notifications: reminders, only if you turn them on. Legal basis: consent, which you can withdraw in the app or in your phone's settings.

We do not show ads, we do not use analytics or tracking tools, we do not build profiles for advertising, and we never sell your data.

4. Where Your Data Is Stored

Your data is stored in one region, chosen when you create your account based on your country:

• North, Central and South America: OVHcloud servers in the United States (Virginia).
• Everywhere else: OVHcloud servers in the European Union (France).

Backups are kept with Cloudflare in the same region. When you travel, your data stays in your home region.

5. Service Providers

We use the following providers to run Unveyled. They process your data only on our instructions and only for the purpose listed.

• OVHcloud (France, United States): hosting of our servers and databases.
• Cloudflare (global network): secure connections to our servers, delivery of card images, backups and our website.
• OpenAI (United States): AI interpretations and safety checks.
• Sentry (Germany): crash and error reports.
• RevenueCat (United States): subscription status. It receives only your user ID, not your name or email address.
• Resend (United States): sending sign-in code emails.
• Expo (United States): registering your device for notifications.
• Apple and Google: sign-in with Apple or Google, app distribution, payments and notification delivery. Their own privacy policies apply to your Apple or Google account and store purchases.

6. International Transfers

Some of these providers are based in the United States. When personal data from the European Economic Area goes to them, the transfer is protected by the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses.

OpenAI does not use data sent through its API to train its models, and keeps it for at most 30 days to detect abuse.

7. How Long We Keep Your Data

• Your account and content: until you delete your account. A reading you delete is hidden straight away and erased for good when you delete your account.
• AI request logs (the text sent to OpenAI and its answer): at most 90 days, to investigate problems and complaints.
• Login sessions, including your IP address: until you sign out or delete your account.
• Server logs, which can contain your email address and IP address: at most 30 days.
• Crash and error reports: at most 90 days.
• Backups: at most 30 days. After you delete your account, your data disappears from the backups within that time.

You can delete your account at any time in Settings. We then erase your data, end all your sessions and, if you used Sign in with Apple, revoke our access with Apple.

8. Your Rights

Under the GDPR you have the right to:

• access your data and receive a copy
• have incorrect data corrected
• have your data deleted (you can do this yourself in Settings)
• receive your data in a machine-readable format
• object to processing based on legitimate interest, or have processing restricted
• withdraw your consent at any time, without affecting processing that happened before

Email privacy@unveyled.com to use any of these rights. We answer within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in your own country.

9. Security

All connections to our servers are encrypted. Your sign-in token is kept in your phone's secure storage (iOS Keychain or Android Keystore). Access to our servers and databases is limited to the people who need it to run the service.

10. Age Requirement

Unveyled is for adults. You must be 18 or older to use the app. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy. The date at the top shows when it last changed. If a change affects how we use your data, we will tell you in the app before it takes effect.

12. Contact Us

Questions about this Privacy Policy or your data? Email privacy@unveyled.com, or write to Sphereness, Hermenstraat 12, 5712 CV Someren, the Netherlands.