Privacy
Last updated
This policy covers novatarotbaby.com ("the site", "Nova Tarot Baby", "we", "us"). It says what we collect, why, who else handles it, how we protect it, how long we keep it and how you can see, download, correct or delete it. It is written from what the site's code actually does, and it is meant to meet California law (the California Consumer Privacy Act as amended by the CPRA, the California Online Privacy Protection Act and California's "Shine the Light" law) and the comparable privacy laws of other US states.
The short version: we collect only what we need to give you readings and run your account, and limited, aggregate analytics to improve the site. We do not sell your personal information, we do not share it for advertising, and we do not use your information to build advertising profiles.
What we keep, and why
Your account
Signing in is run by Clerk. Clerk holds your email address and how you sign in. If you choose to sign in with Facebook, Facebook shares your name, email address and profile picture with Clerk, and nothing else (no friends, posts or other Facebook data); we never receive or ask for your Facebook password; the site receives an account id from Clerk and uses it to keep your data separate from everyone else's.
Your birth details and chart
When you save your profile we keep your full name, birth date, birth time (if you give it), birth place with its coordinates and time zone, the time zone you live in. From these the site works out your chart (the positions of the Sun, Moon and planets, and your Rising sign and houses when the time is known) and keeps it, so readings don't recompute it. Your time zone decides when your day, and your daily allowance, starts.
People you save (Inner Circle)
If you add partners, family or friends we keep what you enter for them (how they relate to you, an optional nickname, their full name and birth details) and their chart. They are visible only on your account. Only add details for people who are okay with it.
Your readings
Each saved reading keeps what you asked (including the answers you typed and, for a dream reading, your description of the dream), the cards drawn, the chart facts it was written from, Nova's text, the date, and a copy of the birth details it was written from so it still makes sense if you change your profile later.
Request records
While a reading is being written we keep its cards and your answers so that "Try again" uses the same ones; the answers are cleared once the reading is saved. For the daily issue we keep the day's three cards.
Usage counts
For each day we count how many readings, letters to Nova and AI calls you used (each search of Nova's reference library counts as one), and keep a site-wide count of AI calls. These counts hold no content.
Place searches
When you search for a birth place, the text you type is matched against a list of cities and towns built into this site. It is not sent to any other service.
Letters to Nova
Your letters in the chat are sent to the AI to write Nova's reply and are not saved by the site. The conversation is kept in your browser tab until you press Start over, close the tab or sign out. On our side only the usage counts change.
Messages to support
When you use the contact form on the support page, we receive your name, the email address you give, the topics you tick and your message, as an email to our support inbox. The site itself does not store the message. We keep the email in our support inbox for as long as it takes to help you and for a reasonable time afterwards, and you can ask us to delete it. To stop one person sending the form over and over, the site counts messages per day against a one-way hash of the sender's network address; the count holds no readable address and is removed the next day. Please don't put passwords or card numbers in a message.
Payments
Inner Circle is sold through Clerk Billing, which handles payment with its payment processor. We never see or store your card details; the site only learns whether your account has an active Inner Circle plan.
The site's code does not write your answers, letters, birth details or reference searches to its logs; its error logs say what went wrong (for example "AI call failed" or "search failed").
What the AI is given
Readings and Nova's replies are written by an AI model run by Cloudflare Workers AI; the chat can also use Cloudflare AI Search, which looks up Nova's own reference material. The model is given:
- positions from your chart (signs and degrees; houses only with a birth time) and, where a reading uses it, today's sky;
- the cards drawn, and what you typed into the reading's form;
- for numerology, only the numbers worked out from your name and birth date, never the name or date;
- for a relationship reading, both charts' positions and the name you chose for the other person (their nickname, or how they relate to you), never their full name or birth details;
- in the chat: your letter, the earlier letters and replies in that conversation, the signs of your Sun, Moon and Rising, the headline and cards of today's issue, and, if you opened the chat from a reading, that reading's title, headline and cards.
It is never given your name, birth date, birth time, birth place or coordinates. Chart positions come from your birth details but are not the details themselves. What you type into a form or a letter is sent as you typed it, so leave out anything you don't want sent.
Nova's reference library
Before a reading or today's issue is written, the site searches Nova's reference library, a collection of passages from books on astrology, tarot, numerology and dreams, through Cloudflare AI Search, and gives the passages it finds to the model as background reading. The search is sent only terms the site works out: the names of the cards drawn and whether they are reversed, zodiac signs (no degrees), the names of aspects between planets, for a relationship reading the elements and modalities of the two charts, for numerology the names and values of the core numbers (not the Birthday number or this year's, month's and day's cycles), and for a dream at most one symbol and one feeling, and only when each is a word from the site's fixed lists. It is never sent your name, birth date, birth time, birth place or coordinates, a saved person's name, nickname or details, what you typed into a form, or what your dream was about. The model isn't told which books the passages come from. If the search fails, the reading is written without it.
Who else handles your data
- Clerk: sign-in (including sign-in with Facebook, if you choose it), your account and sessions, and Clerk Billing for the Inner Circle subscription (with its payment processor).
- Cloudflare: the site runs on Cloudflare Workers, and Cloudflare Web Analytics counts page views (see Analytics). Your profile, people, readings and counts are stored in Cloudflare D1 (a database); Cloudflare KV holds only records from the site's earlier version, which deleting your account also removes; readings and replies are written by Cloudflare Workers AI, and Cloudflare AI Search finds the reference passages they draw on and helps answer letters; place-search answers are cached on Cloudflare's network; and Cloudflare Email Service delivers messages sent from the support form to our inbox.
These services process data for us to run the site. Clerk and Cloudflare operate worldwide, so your data may be processed outside the country you live in, including in the United States.
We don't sell your personal information and we don't share it for cross-context behavioral advertising (what California calls "sharing"). The site's code includes no advertising trackers, and these services act as our service providers or processors: they may use your data only to run the service for us.
We may also disclose information when the law requires it (for example a valid court order). We review every request from a public authority to check it is lawful, challenge those that are not, disclose only the minimum a valid request requires, and keep a record of each one. We may also disclose it to protect the safety, rights or property of our readers or the site, or to a successor if the site is sold or merged, in which case this policy will keep applying to your data until you are told of a change.
Cookies and browser storage
- Clerk's cookies keep you signed in (for example
__sessionand__client_uat). They are needed for your account to work. - Local storage keeps a random id for this browser and whether today's home-page card and your daily cards have been turned, so they stay turned when you come back. It holds nothing about who you are.
- Session storage keeps what you typed into a reading's form until the reading is saved, and your conversation with Nova until you start over, close the tab or sign out.
None of these are used for advertising or to follow you to other sites.
How long we keep it
- Your profile, chart, saved people and readings: until you delete them, or your account.
- A reading's request record: removed two days after it was made, at your next reading request (its answers are cleared as soon as the reading is saved).
- The daily issue's cards: until you delete your data or your account.
- Usage counts: kept when you use Delete my data (they hold no personal details, and deleting them would reset the day's allowance); deleted with your account.
- Place-search answers: an hour in Cloudflare's cache.
- Letters to Nova: not kept by the site at all.
Your choices and rights
- See and download everything. "Export my data" on your profile downloads all we store for your account as one file.
- Correct it. Edit your birth details and saved people on your profile at any time.
- Delete parts of it. Delete a single reading or a saved person from your profile. Deleting a person also removes their details from the readings about them.
- Delete all of it. "Delete my data" on your profile deletes your profile, chart, people, readings and request records at once. Only the usage counts stay.
- Delete your account. Your sign-in account is held by Clerk. Delete it from "Manage or delete your account" on your profile, which opens your Clerk account settings. When it is deleted, Clerk tells the site and the site deletes everything it holds for that account, usage counts included. To be certain your data is gone at once, use Delete my data first.
Depending on where you live, data protection law may give you further rights, such as objecting to how your data is used or complaining to your local data protection authority. Sections below describe the rights of California residents and residents of other US states, and how to use them.
Children
The site is not for anyone under 16. Please don't create an account if you are younger.
Analytics
We want to know whether the site works and which parts are useful, so we can make the experience better. That is the only reason we use analytics. The site uses Cloudflare Web Analytics, a privacy-focused tool from Cloudflare, which our host already runs. It:
- counts page views and how fast pages load, with the page address, the website you came from, your browser and device type and your approximate country, in aggregate across all visitors;
- does not use cookies or local storage, and does not follow you across websites or build a profile of you;
- is never sent your name, birth details, answers, letters, readings or email address, and never sees what you type.
We use these totals only to improve the site. They are never used for advertising and never sold. Your browser or a content blocker can block the analytics script, and the site works the same without it.
Do Not Track and Global Privacy Control. Because we do not track you across websites, the site responds the same way whether or not your browser sends a Do Not Track signal. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, though we do neither.
Security
We collect your information to run the site, and we protect it with these measures:
- Encryption at rest, twice. Before it is written to our database, the personal information you give us is encrypted by the site itself with AES-256-GCM: your name, birth date, time, place and coordinates, the same details for people you save, your chart, your saved readings and the answers you typed. The key is held as a separate secret, not in the database, so a copy of the database alone cannot be read. The database, Cloudflare D1, also encrypts everything stored in it at rest. Sign-in details, including your email and any password, are held by Clerk, not in our database, and Clerk encrypts them too.
- What is not encrypted. The few things needed to run the site are not: your account id, the time zones, when a reading was made and which kind, and the daily usage counts. They hold no names, birth details or reading text.
- Encryption in transit. Connections to the site, and between the site and the services above, use HTTPS.
- Access control. Every request that reads or changes your data checks your Clerk sign-in, and every query is limited to your own account. Requests from other websites are refused. Account-deletion messages from Clerk are verified with a signature before anything is deleted.
- No card data. Payments are handled by Clerk Billing and its payment processor. Card details never reach our servers.
- No content in logs. The site's code does not write your answers, letters, birth details or reference searches to its logs.
- Minimizing what exists. We don't ask for your phone number, street address, government ID or precise location, and we do not keep your letters to Nova.
No system is perfectly secure, and we cannot guarantee absolute security. If a breach of your personal information occurs, we will notify you and the authorities as the law requires, in the most expedient time possible.
Your California privacy rights
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you the rights below. This section also serves as our notice at collection.
What we collected in the past 12 months
- Identifiers: account id, email address (held by Clerk), full name, a random id for your browser. Purpose: your account, your readings, keeping your data separate from other people's.
- Personal information in customer records: the birth date, birth time and birth place you give for yourself and for people you save. Purpose: working out charts and readings.
- Commercial information: whether your account has an Inner Circle plan (card details stay with Clerk's payment processor). Purpose: giving you what your plan includes.
- Contact information and messages: name, email address and what you write in the support form. Purpose: answering you.
- Internet or other electronic activity: daily usage counts, errors, and aggregate page-view and performance counts from Cloudflare Web Analytics. Purpose: daily limits, fair use, keeping the site working, improving the experience.
- Inferences: your chart and the readings written for you. Purpose: providing the service you asked for.
- Content you type: answers in reading forms, dream descriptions, letters to Nova. Purpose: writing your reading or reply. Letters are not kept. You may type sensitive things there, such as health or relationship details; we use them only to write what you asked for, and not to infer anything else about you.
We get this information from you, from Clerk (your account id and plan) and from the site itself when you use it. We keep each category for the periods in "How long we keep it" above.
Sold or shared? In the past 12 months we have not sold personal information or shared it for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16. We do not use or disclose sensitive personal information for any purpose that would give you a right to limit it. We disclosed the categories above to our service providers, Clerk and Cloudflare, for the business purposes described in this policy.
Your rights
- Know and access: the categories and specific pieces of personal information we hold about you. "Export my data" on your profile gives you the specific pieces at once.
- Delete: "Delete my data" and account deletion on your profile.
- Correct: edit your details on your profile, or ask us.
- Opt out of sale and sharing: we do neither, so there is nothing to opt out of.
- Limit use of sensitive personal information: we use it only to provide the service.
- Non-discrimination: we will not deny you service, charge you a different price or give you a different quality of service for using these rights.
To use a right the profile page doesn't cover, email support@novatarotbaby.com from the address on your account. We confirm your identity by matching it to your account (we may ask you to sign in), and we respond within 45 days, which we may extend once by another 45 days if we tell you why. An authorized agent may make a request for you with your written permission; we may ask you to confirm it with us directly. If we decline a request we will tell you why.
California "Shine the Light". We do not disclose personal information to third parties for their own direct marketing. Minors. The site is not for anyone under 16.
Residents of other US states
Privacy laws in Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware and several other states give residents rights to confirm and access their data, correct it, delete it, receive a portable copy, and opt out of targeted advertising, the sale of personal data and profiling that produces legal or similarly significant effects. We honor these rights for every reader whatever state they live in, in the same way as above: Export my data, Delete my data and editing on your profile, or an email to support@novatarotbaby.com. We do not sell personal data, do not use it for targeted advertising and do not profile you in a way that has legal or similarly significant effects. Nevada residents may also email us to opt out of any future sale of covered information.
If we decline your request you may appeal by replying to our answer with the word "Appeal" and any reasons. We answer appeals within 45 days (60 in some states). If your appeal is denied, you may contact your state attorney general.
Contact us about privacy
Questions, requests or complaints about this policy: support@novatarotbaby.com. For technical problems, tech@novatarotbaby.com. We usually reply within 24 hours. See also our support page. You may also contact the California Privacy Protection Agency or your state attorney general.
Changes to this policy
When this policy changes, the date at the top changes with it. If a change affects what we collect or who receives it, including adding or changing an analytics tool, the page will say what changed before the change takes effect, and we will tell signed-in readers where the law requires it.