Privacy Policy

Last updated: 19 October 2026

This Privacy Policy explains what personal data Unveyled collects, why we need it, where it is stored and what your rights are.

Sharing with AI (OpenAI)

To create your readings and answer your follow-up questions, we send OpenAI the cards you drew, your question, your reading preferences (such as tone, experience level, topic, feeling and zodiac sign) and, in a follow-up chat, the conversation so far. We do not add your name, email address or other account details to AI requests. Personal information you include in a question or chat message is sent along with it. Creating your readings is the service you get from us. Because what you write can be sensitive, we also ask for your explicit consent when you create your account. The app does not work without it. You withdraw it by deleting your account.

Do not include medical information, information about your sex life, sexual orientation or religious beliefs, or sensitive personal information about others in your questions, notes or chats.

1. Who We Are

Unveyled is offered by Sphereness, a sole proprietorship registered in the Netherlands (Chamber of Commerce number 17215839), Hermenstraat 12, 5712 CV Someren, the Netherlands. Sphereness is the controller of your personal data under the General Data Protection Regulation (GDPR), wherever you live.

For anything about your privacy, email privacy@unveyled.com.

2. Information We Collect

Account: your email address and the name you give us. If you sign in with Apple or Google, we receive an account identifier from them and, if you allow it, your name and email address. Apple may give us a private relay address instead of your own.
Preferences: your answers during onboarding (such as your experience with tarot, what you hope for, your zodiac sign and how you feel) and your app settings, such as language.
Your content: the questions you ask, your readings and their interpretations, your journal notes, your chat messages and any report you send us about AI-generated content.
Activity: your streak, achievements and the cards you have discovered.
Subscription: which subscription you have, its status and its dates. Payment is handled entirely by Apple or Google; we do not receive your card or bank account details.
Technical data: when you sign in, we store your IP address and a short description of your device and app version with your login session. If you allow notifications, we store a push token and your device name.
Crash and error reports: when the app or our server runs into an error, a report is sent with technical details such as device model, operating system, app version and what went wrong. Technical monitoring also measures app performance and session stability.

Do not include medical information, information about your sex life, sexual orientation or religious beliefs, or sensitive personal information about others in your questions, notes or chats. If you include this information anyway, it may be stored with your content and sent to OpenAI when you request a reading or use chat.

3. How We Use Your Information

To provide the app: create your account, sign you in, create and store your readings, AI interpretations, journal and chats (for which we send the data described at the top of this policy to OpenAI), and check your subscription. Legal basis: performance of our contract with you.
Sensitive information in what you write, such as about your health, sex life, sexual orientation or religion: we only process it with your explicit consent (Article 9(2)(a) GDPR), and only for the purposes in this list. You give that consent when you create your account and withdraw it by deleting your account.
Safety: the text you type is checked automatically, by keyword and by OpenAI's moderation service, so that we can show crisis support information instead of a reading when someone may be in danger. We do not store the result with your account. Legal basis: legitimate interest (protecting your wellbeing) and, because this may involve health information, your explicit consent.
Security and reliability: preventing abuse, limiting repeated sign-in attempts, measuring technical performance, fixing errors and investigating complaints. Legal basis: legitimate interest and, for sensitive content in AI request logs and reports, your explicit consent.
Email: sign-in and verification codes and replies to your requests. We do not send marketing email.
Notifications: reminders, only if you turn them on. Legal basis: consent, which you can withdraw in the app or in your phone's settings.

We do not show ads, we do not use advertising tracking, we do not build profiles for advertising, and we never sell your data.

4. Where Your Data Is Stored

Our primary database stores your account and content in one region, chosen when you create your account based on your country:

North, Central and South America: OVHcloud servers in the United States (Oregon).
Everywhere else: OVHcloud servers in the European Union (France).

Backups are kept with Cloudflare in the same region. When you travel, your data stays in your home region.

This describes our own database storage. The providers below also process data in other locations.

5. Service Providers

We use the following providers to run Unveyled. Providers acting as our processors process data on our instructions. Some providers, including Apple and Google for their accounts and purchases, also act as independent controllers.

OVHcloud (France, United States): hosting of our servers and databases.
Cloudflare (global network): secure connections to our servers, delivery of card images, backups and our website.
OpenAI (United States): AI interpretations and safety checks.
Sentry (Germany): crash and error reports and technical performance monitoring.
RevenueCat (United States): subscription management. It processes your user ID, purchase and subscription information and technical device data. We do not supply your name or email address.
Resend (United States): sending sign-in code emails.
Expo (United States): registering your device for notifications.
Apple and Google: sign-in with Apple or Google, app distribution, payments and notification delivery. Their own privacy policies apply to your Apple or Google account and store purchases.

6. International Transfers

Some of these providers are based in the United States. When personal data from the European Economic Area goes to them, the transfer is protected by the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise by the European Commission's Standard Contractual Clauses.

OpenAI does not use data sent through its API to train its models by default. Abuse-monitoring logs are normally kept for up to 30 days, with exceptions where longer retention is legally required or reasonably necessary to protect its services or others from harm.

Contact privacy@unveyled.com for information about the applicable transfer safeguards and how to obtain a copy.

7. How Long We Keep Your Data

Your account and content: until you delete your account. A reading you delete is hidden straight away and erased for good after 30 days.
AI request logs (the text sent to OpenAI and its answer): at most 30 days, to investigate problems and complaints.
Login sessions, including your IP address: until you sign out or the session expires, and never longer than your account exists.
Reports you send us about AI-generated content: at most 12 months, and erased sooner when your account is erased or, for a report about a reading, when that reading is erased.
Server logs, which can contain your email address and IP address: at most 30 days.
Crash and error reports: at most 90 days.
Backups: at most 30 days. After you delete your account, your data disappears from the backups within that time.

You can delete your account at any time in Settings. We then erase your data, including at our subscription service RevenueCat, end all your sessions and, if you used Sign in with Apple, revoke our access with Apple.

8. Your Rights

Under the GDPR you have the right to:

access your data and receive a copy (you can also download a copy yourself on the Delete account screen)
have incorrect data corrected
have your data deleted (you can do this yourself in Settings)
receive your data in a machine-readable format
object to processing based on legitimate interest, or have processing restricted
withdraw your consent at any time by deleting your account, without affecting processing that happened before

Email privacy@unveyled.com to use any of these rights. We answer within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the data protection authority in your own country.

9. Security

All connections to our servers are encrypted. Your sign-in token is kept in your phone's secure storage (iOS Keychain or Android Keystore). Access to our servers and databases is limited to the people who need it to run the service.

10. Age Requirement

Unveyled is for adults. You must be 18 or older to use the app. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy. The date at the top shows when it last changed. If a change affects how we use your data, we will tell you in the app before it takes effect and publish the updated policy on our website. If a new use of your data requires consent, we ask for it before that processing starts.

12. Contact Us

Questions about this Privacy Policy or your data? Email privacy@unveyled.com, or write to Sphereness, Hermenstraat 12, 5712 CV Someren, the Netherlands.