1. Data we collect
On-device data (localStorage): reading history, story drafts, onboarding state, PWA preferences, visit counts, and cookie-consent choices — stored in your browser unless you sign in or use account-backed features.
Account (optional): if you register, we store email, display name, username, and a hashed password in Supabase/PostgreSQL. Journal entries may be encrypted before storage.
Community content: Q&A posts, reader reviews, and portfolio items you submit under each feature’s visibility rules.
Technical data: Vercel Analytics records anonymous visits (pages, device, country) for site operations — not for personalized advertising.
2. Cookies and similar technologies
Essential cookies: NextAuth session cookies when you log in — required to keep your session; they cannot be turned off if you use an account.
Analytics (optional): when Google Analytics (GA4) is configured, the script loads only after you accept analytics cookies on our consent banner. GA4 may record pages viewed, content language, and technical data (IP anonymization when configured).
Personalized advertising (optional): when Google AdSense is enabled, we and Google may use cookies or identifiers to serve and measure ads (including interest-based ads). The AdSense script loads only after you accept advertising cookies on our consent banner.
Your consent choice is stored on your device (localStorage). Clear site data in your browser to reset the choice and see the banner again.
3. How we use data
Provide and improve tarot draws, the card library, numerology, and educational content.
Maintain accounts, journals, and reader features when you choose to use them.
Analyze site performance (anonymously or with consent) to fix bugs and improve UX.
Show ads (when AdSense is enabled and you consent) to support free content.
Comply with law and respond to lawful requests when required.
4. Third parties
We do not sell personal data. Processors may include Vercel (hosting / Analytics), Supabase (database), and — when you consent and the service is configured — Google Analytics / Google AdSense under Google’s terms and privacy policy.
With AdSense, Google may receive page-view and ad-cookie information under Google’s policies. See: https://policies.google.com/technologies/ads
Content you publish publicly (e.g. Q&A, reader profiles) may be indexed by search engines.
5. Storage and security
Passwords are hashed; we do not store plain-text passwords.
The site uses HTTPS. Production database access is restricted.
localStorage data lives on your device — clearing site data in the browser removes it, including cookie preferences.
6. Your rights
Delete local data via browser site-data settings or in-app history controls.
Registered users may request access, correction, or deletion by email below.
You may refuse analytics and advertising cookies on our consent banner (essential cookies only). You may also use browser settings or Google’s ad settings (e.g. https://adssettings.google.com) to limit personalized ads.
7. Children
The service is intended for users aged 16+. We do not knowingly collect children’s data. Parents who believe we have should contact us for removal.
8. Changes and contact
We may update this policy; the date at the top reflects the latest version. Continued use after updates means acceptance.
Contact: melaap.app@gmail.com. System notifications (comments, reports) are sent to melaap.app@gmail.com. Contact page: /contact.