Arkanika Privacy Policy

Effective date: 5 August 2026

This Privacy Policy explains how we handle personal information in Arkanika, a dark-mystical, AI-powered tarot app for iOS and Android. It applies to the Arkanika mobile app and any companion web pages we operate (including our web deletion page at arkanika.net/delete-account), everywhere the app is available.

Arkanika is strictly for adults aged 18 and over. It is not directed to children, and we do not knowingly collect data from anyone under 18.

We may update this policy from time to time (see "Changes to this policy" below).

---

The short version (what you most need to know)

• Your readings are written by AI. When you create a reading or chat with your mage, the details you enter — plus your display name and a short summary of your journey in the app (your streak, and the themes and cards of your recent readings) — are sent to our AI partner Anthropic to write your reading. Anthropic works only on our behalf under contract, never uses your data to train its AI, and automatically deletes it within 30 days (kept only for safety monitoring).
• We never sell or share your reading or chat content, and we never use your readings or chats for advertising.
• We do not sell your reading data. If you see ads (you have neither Premium nor the Remove Ads purchase), your advertising identifier may be "sold"/"shared" for personalized ads under California law — you can opt out at any time, and personalized ads in the EEA/UK happen only with your consent.
• You're in control. You can withdraw your AI permission, and export or permanently delete everything, from Settings in the app (or delete via arkanika.net/delete-account without opening the app).

This summary is only a guide. The full policy below controls.

---

1. Who we are

Yurii Onyshko, an individual entrepreneur (фізична особа-підприємець, "ФОП") registered under the laws of Ukraine, with registered address 14A M. Khvylovoho St., Lviv, 79000, Ukraine, is the data controller (under the EU/UK GDPR) and the business (under the California CCPA/CPRA) responsible for the personal information described in this policy.

• Privacy questions and requests: [email protected]
• General support: [email protected]

Data Protection Officer: We have not appointed a Data Protection Officer because we are not required to. You can reach our privacy team using the contact details above.

2. Contact for EEA and UK users

For individuals in the European Economic Area and the United Kingdom, the direct contact for all data-protection questions and requests is [email protected]. We respond to all data-protection matters through that address, wherever you are.

3. Age: Arkanika is for adults 18+

Arkanika is strictly for adults 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. When you start using the app, you self-attest that you are at least 18, and we record that attestation. Our store age ratings reflect an adults-only (18+) filing.

If we learn that someone under 18 has used the app or provided us data, we will delete that account and its data. Because the app is for adults only, a parent or guardian cannot consent to a minor's use on their behalf. If you believe a minor has provided us information, contact us at [email protected].

4. Data we collect, why, and our legal basis

We collect only what we need to run Arkanika. The table below lists every category of data, why we use it, and — for EEA/UK users — our legal basis under Article 6 of the GDPR. Retention is summarized in section 8.

Legal-basis key: Contract = necessary to provide the service you asked for · Consent = your freely-given, withdrawable consent · Legitimate interests = our legitimate business interests, balanced against your rights · Legal obligation = required by law.

Identity & account

Reading content — sensitive, written by you

Why this is sensitive: what you type is free text and can reveal things like your health, relationships, beliefs or finances — even another person's information. We never ask for this, but it can appear. See section 5.

Chat with your mage — sensitive

Progression & game economy

We do not share your economy state (your balances) with third parties for its own sake — it lives in our database. One narrow exception: your current streak is included in the personalization details sent to our AI partner when writing a reading or chat reply (see section 6).

Purchases & subscriptions

Content you report to us (safety)

Note: Readings and mage replies are AI-generated or drawn from content prepared in advance, and are not individually reviewed by a person before you see them. The exception is content you choose to report — a person on our team may then review the referenced content. See section 17 of this policy and Section 12 of our Terms of Use.

Support & suggestions

Launch waitlist (website)

The waitlist lives outside your app account: it is never linked to your readings, chat, or game data, and deleting one never touches the other. Waitlist emails are used only for the two emails above — never marketing beyond them, never shared.

Device & technical

Where we rely on legitimate interests, we have weighed our interest (for example, keeping the service secure and improving it) against your rights and freedoms, and we use the data in ways you would reasonably expect. You can object — see section 10.

5. Sensitive information

The question you type, who a reading is for, the theme, and your chat messages are free text. They can reveal sensitive things about you — health, sex life, relationships, religious or philosophical beliefs, finances — or information about other people, even though we never ask for it.

Please don't enter anything you wouldn't want processed, and avoid entering other people's personal or sensitive details.

• How we generate your reading (GDPR): The transfer of your reading and chat inputs to our AI partner is necessary to provide the reading or chat you requested, so our lawful basis for that transfer is contract (Art. 6(1)(b)). Separately, because your free text may reveal special-category data (Art. 9), we ask for your explicit consent under Art. 9(2)(a) as the condition for processing any such data, and — to meet Apple's App Store requirements — we also ask for your explicit in-app permission before any reading is generated. Our server will not generate a reading without that in-app permission on file. You can withdraw it at any time (see section 13); if you do, we can no longer generate readings or chat, because that processing is essential to those features.
• California (CPRA): this content may be "sensitive personal information." We use it only to provide the reading and chat you asked for — never to infer characteristics about you and never for advertising. Because we already limit our use to what's necessary to deliver the service, there is nothing further to limit, but you can still withdraw your AI permission and delete this content at any time.

We never use your reading or chat content for advertising, and we never sell or share it.

6. Who we share data with (at a glance)

We share personal information only with the service providers and partners below. Most act as our processors/service providers — they act only on our instructions under a data protection agreement (DPA). A few are independent controllers for a specific relationship (payments, or ad personalization).

Our processors are bound by DPAs and may act only on our instructions. We keep our list of sub-processors current and can provide details on request at [email protected].

We never share your reading or chat content for advertising, and we never sell it.

More on the AI (Anthropic)

To write your reading and generate mage replies, we send Anthropic the details you provide — your question, who the reading is for, the theme, and the cards drawn — together with personalization details we already hold: your chosen display name, your current streak, and a short summary of your recent readings (their themes, and cards that have recurred), so the writing can feel personally yours. During a chat, we also re-send your chat messages, the earlier turns in that conversation, and the related reading content (the question/theme/cards and the reading text) so the multi-turn conversation stays coherent. We do not send Anthropic your account identity beyond the request itself, your email, the name your sign-in provider shares, payment data, advertising ID, or your game-economy balances beyond the streak just described.

• Legal basis: the transfer is necessary to deliver the reading or chat you requested (contract), and your explicit consent covers any special-category data in your free text. We also require your explicit in-app permission (recorded with a timestamp) before making any AI call; without it, our server returns an error and makes no AI call. You can withdraw that permission in Settings.
• Safeguards: a data processing agreement with Anthropic (incorporated into its commercial terms). Anthropic does not use your inputs or outputs to train its models and automatically deletes them within 30 days (kept only for safety monitoring). The lasting copy of your reading lives in our database and is erased when you delete your account.

This matches what the in-app consent screen tells you, word for word:

"Your spread readings and mage chats are written for you by an AI oracle. When you ask for a reading — and when you chat with your mage — what you share (your chosen theme, who it's for, your messages) is sent to our AI partner (Anthropic) to write the reply, together with your display name and a glimpse of your journey (your streak, and the cards and themes of recent readings) so it feels truly yours. What you write is up to you — it may reveal tender things (your health, your beliefs, your heart); by agreeing you explicitly consent to us handling whatever you choose to share, solely to create your readings and chat. The daily card is served from writings prepared in advance — nothing personal is sent for it. We never sell your readings or chats. You can withdraw consent, and delete everything, anytime in Settings."

7. International data transfers

We and some of our providers process data outside your country, including in the United States and in the European Union — Amsterdam, the Netherlands (where our database is hosted). US-based recipients include Anthropic (our AI partner), RevenueCat, Sentry (a US company; our crash data is stored in its EU region), Resend (a US company; EU sending region), Expo (app updates and push delivery), GitHub (backup storage), Cloudflare (website hosting and email routing), and Google (AdMob, sign-in, and our support mailbox).

Because we are based in Ukraine, we also access and administer data from Ukraine when operating the service. For that access we remain directly bound by the GDPR (Article 3(2)) and apply the safeguards described in section 9; the European Commission is preparing standard contractual clauses for controllers outside the EEA that are directly subject to the GDPR in this way, and we will adopt them for this scenario when they are finalised.

Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures. For recipients that act as independent controllers (for example, Google AdMob for ad personalization), the recipient's own transfer mechanism applies to the data it controls. You can request a copy of the safeguards we use by emailing [email protected].

8. How long we keep data

Where no fixed period applies, we set retention based on why we need the data, legal requirements, and the risk involved.

9. How we protect your data

We use technical and organizational measures appropriate to the risk, including: encryption in transit; server-authoritative access controls with per-user authorization checks on every request (each account can only reach its own rows); keeping the AI key server-side only (never on your device); least-privilege access; scrubbing personal data from diagnostics; and a breach-response process. No method of transmission or storage is ever 100% secure, but we work to protect your information and to keep improving our safeguards.

10. Your choices & rights

You have rights over your personal information. To exercise any of them, use the in-app Settings (which offer permission controls, data export, and Delete Account & Data) or email [email protected]. Because most accounts are anonymous, we may verify a request by reference to your account/device or sign-in; we may ask for limited information to confirm you are the account holder. We will not discriminate or retaliate against you for exercising your rights.

If you're in the EEA or UK (GDPR)

You have the right to: - Access the personal data we hold about you; - Rectify inaccurate or incomplete data; - Erase your data ("right to be forgotten"); - Restrict processing in certain cases; - Portability / export — receive your data in a portable format; - Object to processing based on our legitimate interests; - Withdraw consent at any time (as easily as you gave it) — in particular for your AI permission, push notifications, and personalized ads; withdrawal doesn't affect processing that already happened; - Complain to a supervisory authority — your local data protection authority (or the UK ICO).

We do not use your data for solely-automated decisions that produce legal or similarly significant effects. Readings are AI-generated entertainment, not profiling that affects your legal rights.

We aim to respond within the timeframes the law requires (generally one month under the GDPR).

If you're in California (CCPA/CPRA)

You have the right to: - Know / access the personal information we've collected and how we use and disclose it; - Delete your personal information; - Correct inaccurate personal information; - Opt out of "sale"/"sharing" of personal information; - Limit the use of sensitive personal information (we already limit it to providing the service); - Non-discrimination for exercising your rights.

We do not sell your reading or chat data, and we never share it for advertising. As explained in section 11, showing personalized ads to free users via AdMob involves disclosing your advertising identifier and related signals and may be both a "sale" and a "share" under the CPRA, so we provide an opt-out. You may submit requests via [email protected] or in-app Settings, and you may use an authorized agent. We generally respond within 45 days and may verify your request.

California data categories (CPRA disclosure)

The following table maps the statutory categories of personal information to what we do. "Sold/Shared" refers to CPRA's broad definitions, which can include disclosing an advertising identifier for cross-context behavioral advertising.

11. Advertising, tracking & your "Do Not Sell or Share" choice

Arkanika is free to use with ads; you can remove ads with a Premium subscription or the one-time Remove Ads purchase.

• Users with neither Premium nor the Remove Ads purchase see ads served by Google AdMob, which uses your device advertising identifier (Apple IDFA on iOS / Google Advertising ID on Android) along with your IP address and ad-request signals.
• Personalized ads involve cross-context behavioral advertising. Under California's CPRA, disclosing your advertising identifier and related signals to AdMob for this purpose may be treated as both a "sale" and a "share." You can opt out of it at any time: use the Ad privacy options control in the app (Account settings — it opens Google's ad-privacy form where it is available for your region), decline or change App Tracking Transparency for Arkanika in your iOS settings, reset or limit your advertising identifier at the OS level, or email [email protected] and we will complete the opt-out with you (we will confirm your ATT and ad-privacy settings with you and treat your request as a standing opt-out). This opt-out covers both "sale" and "share."
• In the EEA/UK, personalized ads and any tracking happen only with your consent, collected through Google's consent prompt (UMP) and, on iOS, Apple's App Tracking Transparency (ATT) prompt.
• Premium and the one-time Remove Ads purchase both remove ads.
• We never use your reading or chat content for ads, and we never sell or share it.

12. Identifiers & on-device storage

Arkanika is an app rather than a website, but it uses SDK identifiers and on-device storage similar to cookies: - Device advertising identifier (Apple IDFA on iOS / Google Advertising ID on Android; AdMob) — for ads to users who see ads; consent-gated for personalization; - Device identifiers — compatibility, support, security; - Push notification token (only if you turn notifications on) — delivering the reminders you asked for; - Secure on-device storage for your guest/session token.

In the EEA/UK, we treat non-essential SDK identifiers/local storage as consent-based, and only strictly-necessary storage (such as your guest/session token) operates without consent. You can reset your advertising identifier at the OS level, change tracking choices via ATT/UMP, and manage ad privacy in the app via Account → Ad privacy options.

Our website (arkanika.net) stores only your theme choice in your browser and sets no tracking cookies. Our web pages do not currently read browser opt-out signals such as Global Privacy Control — the website neither sells nor shares personal information, so there is nothing there for such a signal to switch off; the in-app and OS-level controls above are the effective ad-privacy controls. If that ever changes, we will honour GPC on the pages it applies to.

13. Consent & how to withdraw it

We rely on your permission/consent for: the AI processing of your reading and chat inputs (your in-app AI permission, plus explicit consent for any special-category data), push notifications, and personalized ads/tracking.

• We collect your AI permission during onboarding as a separate, affirmative step and record it with a timestamp; we show ATT/UMP prompts for tracking/ads.
• Push notifications are off by default. They start only after you say yes twice — once on an in-app explanation screen, and once on the operating system's own permission prompt. Turn them off any time in the app (Settings → Moon whispers) or in your device's notification settings; either stops them.
• Your permissions are granular and can be withdrawn at any time in Settings, without affecting processing that already lawfully took place.
• If you withdraw your AI permission, we can no longer generate readings or mage chat for you, because sending your inputs to our AI partner is essential to those features.

This matches the in-app consent screen: your reading and chat inputs are sent to our AI partner Anthropic to write the reply; we never sell your readings or chats; and you can withdraw consent and delete everything in Settings.

14. Children

To reiterate section 3: Arkanika is for adults 18+. It is not directed to children, we do not knowingly collect data from anyone under 18, and we will delete any account we learn belongs to a minor. Because the app is adults-only, California's under-16 opt-in rules for sale/sharing do not apply to our intended users.

15. Deleting your account & data (in-app and web)

You can delete everything at any time: - In-app: Settings → Account → "Delete Account & Data" (two taps) → we soft-delete immediately, then permanently purge your data within 30 days. - On the web: you can request deletion at arkanika.net/delete-account without opening the app (for accounts linked to Apple or Google sign-in — an anonymous guest account has no email we could match to it, so it can only be deleted from inside the app). - Export: you can export your data from Settings before deleting.

When you delete: your readings, chat, display name, economy and account data are purged; if you linked Apple sign-in, we call Apple's token-revocation; any copy held by our AI partner auto-deletes within 30 days (and is never used for training). We may retain de-identified purchase/financial records where the law requires (tax/audit), unlinked from your identity.

When you request deletion through the web page, we keep a minimal record of the request — the email address you enter, any optional note you add, and the request's status — for 180 days, as an audit trail that your request was honoured and to prevent abuse of the form; this record survives the account purge. Deleted account data may also persist in our routine database backups for up to 30 further days before those backups automatically expire; backups are stored privately, encrypted at rest, and are not used to restore deleted accounts.

16. Consistency with our store privacy labels

The disclosures here are designed to match the Google Play Data safety form and the Apple App Privacy ("nutrition") label — the data types we collect, how we use and share them, our security practices, and deletion. If we change what we collect or which third parties we use, we update this policy, the Play Data safety form, and the Apple label together.

17. About the AI, and AI safety

Spread readings, deep readings and mage chat are AI-generated; daily-card readings and standard card meanings are pre-generated in advance (some with the help of our AI partner) and served identically to all users — no personal data is used or sent to the AI for them (see Section 5 of our Terms of Use). All reading content may be inaccurate, inconsistent, or unexpected, and are provided for reflection and entertainment only. They are not professional medical, legal, financial, or psychological advice, and you should not rely on them for important decisions.

• Every reading and mage message includes an in-app Report control so you can flag offensive or harmful content. When you report content, it is sent to us and a person on our team may review it (see section 4, "Content you report to us").
• If you are in crisis: If you are thinking about harming yourself or are worried about your safety or someone else's, please contact your local emergency services or a crisis/suicide-prevention helpline right away. You can find helplines for many countries at findahelpline.com. Arkanika is an entertainment app, not a crisis service, and its AI mage cannot keep you safe — a person can.
• There is no solely-automated decision that produces legal or similarly significant effects about you.

The full AI disclaimer and the same crisis resource also appear in our Terms of Use.

18. Changes to this policy

We may update this policy as the app and the law evolve. We'll revise the effective date above and, for material changes, give notice through the app, a "What's New" note, or email where we have it. Where a change affects processing that relies on your consent, we'll ask for your consent again. Continued use after the effective date means you accept the updated policy, to the extent permitted by law.

19. Contact us & how to complain

• Privacy requests & questions: [email protected]
• General support: [email protected]
• Postal: Yurii Onyshko, 14A M. Khvylovoho St., Lviv, 79000, Ukraine
• California requests: [email protected] or in-app Settings

If you're in the EEA or UK, you also have the right to complain to your local supervisory authority (or the UK ICO). We'd appreciate the chance to address your concern first.

This policy is interpreted under the laws of Ukraine, without limiting any mandatory rights you have under your local law.