Privacy policy
Written to be read rather than survived. If any of it stops being true, this page changes before the app does.
Last updated 3 October 2026
Your journal and saved readings are stored on your phone, without a TareOh sign-in. TareOh does not keep a server copy of your journal. AI requests and posts you choose to share are separate, as explained below. Save a copy to Files is on by default: it keeps a copy in your own iCloud Drive when available, otherwise on your phone. You can turn it off in Settings. TareOh does not receive that backup.
AI readings use Claude by Anthropic. The app asks permission before sending writing for AI processing. You can decline or withdraw that permission in Settings → Privacy and data; local journal and library features still work. This permission does not control separate actions you choose, such as posting, reporting or taking back a Candlelight post, or deleting local data. Withdrawal does not recall data already sent.
The AI features below send their inputs through TareOh's Cloudflare Worker to Anthropic. The Worker does not save private AI request text as journal records or use it for training. Provider processing and retention follow the provider's terms: anthropic.com/legal/privacy. A supported API key of your own sends the request to that key's provider instead. Service records and deliberately shared posts are described separately below.
| When | What is sent | Where it goes |
|---|---|---|
| You request a reading | The question you typed, the cards drawn, which deck they came from, anything you wrote under “what you noticed,” and the language the app is set to. If you have entered a preferred name or pronouns, those go too, so the reading is written to you correctly. If you come back to a reading to add new information or answer its follow-up questions, what you add and the earlier interpretation go with it. If you have turned on History in readings, a small, related slice of your themes may go too: their names, the insight written for each and the cards that recur in them, and at the fuller setting up to three related past questions. That setting is off by default. With TareOh Plus, a reading also sends any of your own readers’ takes on the cards you drew. That is each reader’s name as you wrote it and the take itself, at most three per card, and only the takes you have left switched on. |
Cloudflare Worker → Anthropic API. Not stored by TareOh. |
| Patterns in older builds (deferred in the current build) | When the tab opens and your entries have changed since the last check (not on every visit), up to 60 of your recent entries, so it can suggest themes: journal note titles with their full text, plus your saved readings' questions and anything you wrote under “what you noticed,” together with the names of the themes you already have and the questions filed under each. When you open a theme whose insight is not yet written or is out of date, that theme's name, up to 40 of the questions filed under it, and the cards that recurred across them, with how often each appeared. | Cloudflare Worker → Anthropic API. Not stored by TareOh. |
| You use Ask your archive (TareOh Plus) | What you ask and the conversation so far, plus up to 200 of your most recent saved readings: for each, its date, question and cards, the theme it is filed under, and anything you wrote under “what you noticed.” A reading you add by hand goes the same way. | Cloudflare Worker → Anthropic API. Not stored by TareOh. |
| You push back, preview a custom panel, or request supporting quotes | Push-back sends your objection, the selected panel's previous text and the reading context. A custom-panel preview sends its name and instructions with the selected reading's question and cards. “Pull the lines that say this” makes another Ask request, resending the conversation and the archive index described above. Custom-panel instructions also accompany readings that use them. Patterns and its reading-history context are disabled in the current build. | Cloudflare Worker → AI provider. Private request text is not saved as journal records. |
Support notes. A Support note sends a random submission ID, which form sent it (phone or website), the category you choose, and the note you write. From the phone it also sends the app version and platform. A reading report adds only the reading ID and reader version, plus an optional prompt revision; Push Back also adds the selected panel's stable ID. It does not send your question, cards, panel text, full reading, Journal, Ask Austin conversation, clipboard, photos, email address or phone number. Website Support sends no reading reference or app information. Support notes are one-way and kept for up to 90 days. For website abuse prevention, the service briefly processes the network address and stores only a keyed, one-way rate-limit value.
Security records. App Attest key identifiers, public keys and replay counters currently have no automatic expiry. They contain no journal text. Local deletion does not erase these records.
Blocking in Candlelight. Posts are pseudonymous, not untraceable. Moderation uses hashed installation identifiers; newer posts also carry an opaque author-block identifier. Blocking can cover later posts from the same installation, but may not survive reinstallations or apply on another device. Older posts may support only candle-level blocking. Typed or pasted text is not verified as human-authored.
Request limits use installation identifiers and IP addresses. Daily counters expire after two days, monthly counters after about forty days. Installation-derived identifiers are also used for security and moderation; they are not advertising identifiers.
A candle's token and deck are normally kept for seven days. With approval-first moderation enabled, a shared reading waits privately for up to fourteen days and is visible for seven days after approval. Posts include the cards, reading text and any question you choose to share. Taking back or reporting a post removes or hides it at the service; cached views may take time to update. Others' saved copies remain. The retired shelf accepts no new posts; existing items expire after seven days, or thirty days from the last keep.
Approval and report notices can send post content to the moderation mailbox through ZeptoMail. The app does not automatically delete those emails when a post expires, is removed or its report is resolved. Mailbox retention, provider records and purchase records are separate from local deletion; their complete erasure is not implemented by the current app.
Research measurement (off unless you turn it on). This sends numeric measures of question wording, reading settings and response structure, with fixed categories such as language and deck. It does not send your written text. Extra research counts require a second switch and add categories for reading topics, timing, panel choices, push-back, re-asking and refusals. Both use a separate random research identifier: these records are pseudonymous, not fully anonymous. Turning research off deletes that identifier locally; turning it on again creates a new one. This does not erase earlier events. Daily research counters expire after three days. The summary endpoints show groups of at least three contributors.
Cloudflare documents a three-month retention period for Analytics Engine events. App Attest records and moderation emails do not share that expiry. See Cloudflare's retention documentation.
Subscriptions. Apple handles payment. RevenueCat checks subscription status and stores purchase information with an app-user identifier, including for an installation without a TareOh sign-in. These are separate service records, not journal entries. Local deletion does not cancel a subscription or erase Apple or RevenueCat records.
Your own API key. A key you add is stored on the device and sent with AI requests. It is excluded from app exports and the Files copy, but may be included in device backups. The Worker uses it for the request without saving a copy. Remove key or the current Manage local data flow removes it locally; older builds may require Remove key separately.
Nothing else. Apart from research measurement, which you have to turn on, neither the app nor this website has an analytics product, and both carry their own fonts rather than fetching them from Google Fonts.
Talk to Austin is a separate, optional private chat. It sends only the text you write in that chat—not your Ask AI conversation, saved readings or Journal—to TareOh's Cloudflare Worker. The conversation text is stored in separate Ask-chat tables in Cloudflare D1 and is visible to Austin through the owner-only Studio queue. It is not a public Candlelight post and is not sent to an AI provider. The phone keeps a random access token; the chat database stores a SHA-256 digest rather than that token. Austin's chat view does not show your name or email.
Austin checks between 11am and midnight Central Time. A note sent outside that window waits until his next check. This is not live or emergency support, and a reply is not guaranteed. Waiting conversations are kept for up to 14 days. Connected conversations are kept until 30 days without a message; closed conversations are kept for up to 30 days after closure. After message text is scrubbed, limited thread metadata may remain for up to 30 additional days before deletion. You can withdraw and delete a conversation from the phone; withdrawal removes its content from live D1 and leaves only a text-free marker containing a random conversation ID and deletion time in separate R2 storage. The marker is retained for at least 35 days and removed by scheduled cleanup; if cleanup is delayed, it may remain longer.
The marker lets the service hide and scrub a withdrawn conversation if the chat database is restored within its recovery window. This safeguard depends on using Cloudflare D1's production storage subsystem, whose Time Travel restore window is 30 days, and on completing the documented restore reconciliation before reopening reads. Any separate backup that can be restored after the marker expires needs its own deletion replay or a longer marker-retention period. Cloudflare also processes requests in transit as TareOh's infrastructure provider.
Settings → Manage local data first retracts this phone's known posts and candles. If a request fails, local data and deletion credentials remain for retry; some posts may already be removed. On success it clears local writing, profile, API key and restore-undo data, withdraws AI permission, stops automatic Files saving and restarts. Files-copy deletion needs separate confirmation. Exported files, device backups and others' saved copies remain. Older builds may only clear local writing. This is not comprehensive server or account erasure: security, research, mailbox, purchase and provider records are not erased by this flow.
Decline AI processing or withdraw permission in Settings → Privacy and data. Research measurement and its extra counts have separate switches. Sharing and taking back posts are separate actions. Save a copy to Files can also be turned off.
TareOh is not directed at children and is not meant for anyone under 13. We don't knowingly collect information from children.
If what the app sends ever changes, this page changes first, with the date above updated. No silent expansions.
Write to support@tareoh.com.