Skip to content
ORAETAROT
中Log in

Privacy Policy

Effective date: 2026-11-07

ORAE 塔羅 ("we", "us") operates ORAE Tarot at https://orae.tw (the "Site"). We take your privacy seriously. This Privacy Policy explains what personal data we collect when you use the Site, why we collect it, how we use and protect it, and the rights you have. Our separate Personal Data Collection Notice provides the specific notice required by Article 8 of Taiwan's Personal Data Protection Act.

1. Scope

This policy applies to every service offered on the Site, including online readings, Tarot Academy, fortunes, accounts, the journal and sharing features. If the Site links to another website, that website's privacy practices are not covered by this policy; please read its own privacy policy.

2. Data we collect

Our principle is simple: we only collect what we need to run the service.

Information you provide

  • Account details: your email address, display name and password. Passwords are stored only as a salted hash using the scrypt algorithm, so we never know your actual password.
  • Google sign-in data (if you choose to use it): the account identifier, email address and name that Google provides. We never receive your Google password.
  • Reading content: the questions you enter, the spreads and topics you choose, the cards drawn and the reading depth.
  • Personal records: journal entries, notes, and the cards and articles you save as favorites.
  • Preferences: interface language, whether upright-only mode is on, and similar settings.
  • Messages to us: whatever you include when you contact us.

Information generated when you use the Site

  • Guest identifier: if you are not signed in, a randomly generated cookie identifies your browser so that we can keep your guest readings.
  • Sign-in session: used to keep you signed in.
  • Technical and connection logs: IP address, browser and operating system type, access times, requested pages and error logs.
  • Security logs: sign-in attempts, password resets, email verification and changes to account settings.
  • Usage statistics: first-party event counts (for example, page views or completed readings), stored in our own database.

What we do not collect

The Site has no paid features, so we never collect credit card or other payment details. We do not use third-party advertising trackers and we do not build cross-site behavioral profiles. We do not ask for health records, religious beliefs or other sensitive categories of data. Please keep in mind, though, that anything you type into a question or journal entry may itself be sensitive, so only write what you are comfortable keeping.

3. How we use your data

We use your data to:

  1. Provide, maintain and improve readings, learning, fortunes and personal records.
  2. Create and manage your account, including email verification, password resets and sign-in.
  3. Store your readings, journal and notes and show them to you, and, when you create a share link, show the content you chose to share to people who have that link.
  4. Keep the Site secure and detect and prevent fraud, abuse, bots and unauthorized access.
  5. Produce aggregated, de-identified statistics about which features are useful and which need work.
  6. Answer your questions and provide support.
  7. Comply with legal obligations and lawful requests from authorities.

We do not use your readings, questions or journal for advertising, and we never sell or rent them to anyone. Our readings are not generated by AI, and your content is not used to train AI models.

4. Legal basis

We process personal data in accordance with Taiwan's Personal Data Protection Act and other applicable laws. Our main grounds are: our service agreement with you (to deliver what you ask for), your consent (for example, when you create a share link), our legitimate interests in keeping the service secure and improving it, and compliance with legal obligations. If the EU General Data Protection Regulation (GDPR) or a similar law applies to you, these correspond to performance of a contract, consent, legitimate interests and legal obligation.

5. How long we keep data

  • Account and personal records: kept for as long as your account exists. When you delete your account, your readings, journal, favorites and notes are deleted with it.
  • Guest records: linked to a random guest identifier. They are attached to your account if you sign up, and may be cleared periodically if left unused for a long time.
  • Security and audit logs: kept for a limited period as necessary for security and legal compliance, then deleted or de-identified.
  • Backups: the database is backed up in encrypted form on a fixed rotation. Deleted data disappears from backups as they rotate out.
  • Statistics: kept only in aggregated form that does not identify individuals.

6. Sharing and disclosure

We do not sell your personal data. Data is only provided to, or visible to, others in the following cases:

  • Service providers that help us run the Site, such as our cloud hosting provider (Linode / Akamai) and the email service that delivers verification and notification emails. They may process data only on our instructions and only to provide the service.
  • Google: if you choose Google sign-in, the sign-in process is handled by Google. The Site may also load fonts from Google Fonts; when it does, your browser connects to Google's servers, and Google may receive technical information such as your IP address.
  • Share links you create: only after you deliberately create a share link can people with that link see the shared content. You decide whether your question is included, and you can revoke the link at any time.
  • Legal requirements: when required by law, or when courts, prosecutors or other competent authorities make a request through due legal process.
  • Business transfers: if the Site is merged, acquired or otherwise transferred, we will require the successor to keep honoring this policy and will notify you in advance.

7. Cookies and similar technologies

The Site uses essential cookies only:

  • A sign-in session cookie (set as HttpOnly and Secure)
  • A guest identifier cookie
  • A language preference cookie
  • Security cookies, such as those that protect against cross-site request forgery (CSRF)

We do not use third-party advertising cookies or cross-site tracking cookies. Site statistics are first-party event counts stored in our own database. You can block cookies in your browser settings, but signing in and saving readings may then stop working properly.

8. Security

We use reasonable technical and organizational measures to protect your data, including:

  • HTTPS encryption across the entire Site
  • Passwords stored as salted scrypt hashes
  • Session cookies set as HttpOnly and Secure
  • Mandatory two-factor authentication (TOTP) for every administrator account
  • Administrators cannot freely browse your private readings; if access is genuinely needed for support or a security investigation, the administrator must state a reason, and every access is recorded in an audit log
  • Rate limiting and anti-abuse measures
  • Data stored in a PostgreSQL database with regular encrypted backups
  • Private reading pages marked noindex so that search engines do not index them

No system can be guaranteed to be 100% secure. If a personal data breach occurs, we will notify you as required by law and take the necessary steps to contain it. Please keep your password safe and do not share your account with anyone.

9. Your rights

Under Article 3 of Taiwan's Personal Data Protection Act and other applicable laws, you have the right to:

  • Access and review your data: sign in to see it on the Site.
  • Get a copy: export your data as JSON or PDF at any time, free of charge, from Settings.
  • Correct or supplement your data: edit your display name, email and preferences in Settings, or ask us for help.
  • Ask us to stop collecting, processing or using your data: contact us, or delete the relevant records yourself.
  • Delete your data: delete your account in Settings (password confirmation required). This removes your readings, journal, favorites and notes. Minimal records we must keep by law, such as security and audit logs kept for a limited period, are an exception.

If the GDPR or a similar law applies to you, you also have the right to data portability, to restrict processing, to object to processing and to lodge a complaint with a data protection authority. For help, email server@orae.tw. To protect your account, we may need to verify your identity first, and we will respond within the period required by law. Exercising these rights is always free.

10. Children

The Site is only for users aged 13 or older, or the minimum age required in your country if that is higher. Minors should use the Site with the knowledge and consent of a parent or legal guardian. If we learn that we have collected a child's personal data without these conditions being met, we will delete it promptly. Parents and guardians with concerns are welcome to contact us.

11. International transfers

The Site's servers are provided by a cloud hosting provider (Linode / Akamai), so your data may be stored or processed outside your country or region. Providers such as Google may also process data in various locations around the world. We choose providers with appropriate security measures and apply the safeguards required by applicable law.

12. Changes to this policy

We may update this policy because of changes in the law, in our services or in technology. The updated version will be posted on this page with a new effective date. For significant changes, we will notify you on the Site or by email before they take effect.

13. Contact us

If you have any questions about this policy or your personal data, please contact us:

Google Analytics

We use Google Analytics 4 (provided by Google LLC) to understand how visitors use the site, such as which pages are viewed, the approximate region, device type and how visitors arrived. IP addresses are anonymised. Your questions, readings, notes and journal entries are never sent to Google.

You can block analytics cookies in your browser settings. Google's own policy: https://policies.google.com/privacy