Privacy Policy for Taranaut
Version 1. Effective from 30 October 2026.
The short version
- Your readings are stored in your browser, not with us, unless you choose to save them to your profile.
- Your question is sent to the AI so that the reading can be written. Your name and email are never sent with it.
- We use no advertising cookies, no trackers and no analytics that recognise you.
- We never sell your data and never use it to train any AI model.
- You can delete everything with the Delete my profile button.
The rest of this page explains the details, as the law requires (Article 13 of the General Data Protection Regulation, GDPR).
1. Who is responsible for your data
The controller is [Firmanamn], a Swedish sole trader (enskild firma), company registration number [Organisationsnummer], [Adress].
Questions about your data: hej@taranaut.com. We have no data protection officer because we are not required to have one. The owner of the business answers personally.
2. What we process, why, and on what legal basis
2.1 When you visit the site
The site runs on Vercel. Like every web server, Vercel receives your IP address and information about your browser in order to send you the page and protect the service against attacks. Technical logs are kept for at most [X] days.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in running a secure website.
2.2 The free-reading cookie (tn_q)
We set a single cookie, tn_q. It contains only today's date and how many free readings you have had today, for example 20261201:1. It contains nothing that identifies you and expires after 24 hours. It exists so that the free reading works, one per day.
The cookie is strictly necessary for the service you asked for, so under chapter 9, section 28 of the Swedish Electronic Communications Act (lagen (2022:482) om elektronisk kommunikation) no consent is required. That is why there is no cookie banner.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in offering one free reading per day.
2.3 Visitor statistics (Plausible)
We use Plausible Analytics to see how many people visit the site and which pages they read. Plausible sets no cookies and stores nothing in your browser. Visits are counted using a code built from the IP address and browser together with a random value that is replaced and deleted every 24 hours. The IP address is never stored. We only see totals, never individuals. Plausible is an Estonian company and the data does not leave the EU.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in understanding how the site is used. You can object, see section 6.
2.4 Your question and your reading
When you ask for a reading, your question, the cards you drew, the language and the chosen tone are sent from your browser via our server to the AI service (see section 3). The reading is sent back to you. We do not store your question or the reading on our server. Your name, email and account ID are never sent to the AI service.
The only thing we keep about the reading is an anonymous line: what kind of question it was (for example "relationship" or "work"), how long the question was, and which tone the reading used. That line is not linked to you, your account or your IP address.
Questions about love, relationships, health or grief can reveal sensitive information, for example about your health or sex life. That is why we ask for your explicit consent before your first reading. Tara may also switch to a gentler mode and show support lines if a question is about, for example, self-harm or grief. That assessment happens only while the reading is being written and is not stored.
If you are not logged in, the reading is stored only in your browser (localStorage). It stays there until you clear site data in your browser. We cannot see it.
Legal basis: contract (GDPR Article 6(1)(b)), because we need to process the question to give you the reading you asked for. For sensitive data: your explicit consent (GDPR Article 9(2)(a)), which you give before your first reading.
2.5 Your account (Google login)
You only need to log in if you want to buy or save readings. We use Google login. Google then gives us your Google ID, email address and name. We use them to know which purchases and readings are yours and to send receipts.
Legal basis: contract (GDPR Article 6(1)(b)).
How long: until you delete your profile. If you have not logged in for 24 months, we delete the profile after emailing you 30 days in advance.
2.6 Saved readings (only if you choose)
If you are logged in, you can save your readings to your profile so you can read them again on another device. You do this by ticking a separate box yourself:
I consent to Taranaut saving my questions and readings to my profile. I understand that they may contain sensitive information, for example about health, relationships or sex life. I can delete them at any time.
The box is not pre-ticked, and you can buy and use Taranaut without ticking it. Saved readings are stored with Neon in Stockholm (AWS eu-north-1) in the EU. They are used for nothing except showing them to you.
Legal basis: your explicit consent (GDPR Articles 9(2)(a) and 6(1)(a)).
How long: until you delete the reading, withdraw consent or delete your profile. Withdrawing is as easy as consenting: untick the box or delete the readings. The saved readings are then deleted immediately.
2.7 Purchases
When you buy, payment is handled by Stripe. We keep a record of the purchase: your account ID, email, what you bought, amount, VAT, date, Stripe's payment reference and when you gave consent to immediate delivery. We never receive your card number. The record never contains your question.
Legal basis: contract (GDPR Article 6(1)(b)) and legal obligation (GDPR Article 6(1)(c)), because the Swedish Bookkeeping Act requires us to keep the records.
How long: seven years after the end of the calendar year in which the financial year ended (Swedish Bookkeeping Act, chapter 7, section 2). This applies even if you delete your profile.
2.8 Confirmation email and receipt
After a purchase we send an email with a receipt, VAT breakdown and the terms. The law requires it (Swedish Distance Contracts Act, chapter 2, section 4).
Legal basis: contract and legal obligation (GDPR Article 6(1)(b) and (c)).
2.9 The seven-day email
Seven days after a purchase we send a single short email asking how the reading felt. It contains no offers and not your question. You can stop it with the link in the email, or by emailing us. If you reply, we keep your reply for at most 12 months.
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in following up on a purchase and improving the readings.
2.10 When you email us
If you email us, we keep the email while the matter is open and for at most 12 months after it is closed, unless we have to keep it longer for bookkeeping (for example after a refund).
Legal basis: legitimate interest (GDPR Article 6(1)(f)) in being able to reply to you.
3. Who receives the data
We never sell your data and never share it with advertisers. We use the following providers. Most are processors, which means they may only process the data on our behalf and under a contract with us.
| Recipient | What they do | What data | Where |
|---|---|---|---|
| Anthropic PBC | The AI service (Claude) that writes the reading | Question, cards, language, tone. Never name or email. | USA |
| Vercel Inc. | Runs the site and server | IP address, browser information, all traffic passes through | USA and EU |
| Stripe Payments Europe Ltd. | Takes the card payment | Card details, amount, email | Ireland (and USA) |
| Google Ireland Ltd. | Login | That you log in with us | Ireland (and USA) |
| Plausible Insights OÜ | Cookieless visitor statistics | Page views, counted anonymously | EU |
| Resend Inc. | Sends receipts and the seven-day email | Email, receipt details | EU (Ireland), company in the USA |
| Neon Inc. | Stores accounts, purchases and saved readings | Account details, purchases, saved readings | Sweden (Stockholm) |
For some purposes, such as fraud prevention and anti-money-laundering rules, Stripe is an independent controller. Stripe's own privacy policy then applies. The same goes for Google regarding your Google account.
We disclose data to authorities only when the law requires it.
4. Transfers to the USA
Anthropic: The AI service currently runs in the USA. The transfer is protected by the European Commission's standard contractual clauses, which are part of our data processing agreement with Anthropic. We send only what the reading needs: the question, the cards, the language and the tone. Your name, email and account ID are never sent. Anthropic does not use the data to train its models. Anthropic may keep the question and answer for up to 30 days to detect misuse, and then deletes them. We are looking into moving the AI service to servers in the EU.
Vercel, Stripe and Google may also transfer data to the USA. This is protected by the EU–US Data Privacy Framework or standard contractual clauses in each provider's terms.
5. How long we keep data
| Data | How long |
|---|---|
The tn_q cookie | 24 hours |
| Readings in your browser | Until you clear site data |
| Statistics in Plausible | Totals only; the daily value is deleted after 24 hours |
| Anonymous log line about the reading | Not personal data; kept to improve readings |
| Technical server logs | At most [X] days |
| Question and answer at Anthropic | Up to 30 days |
| Account | Until you delete your profile, or 24 months without login |
| Saved readings | Until you delete them or withdraw consent |
| Purchase records | Seven years after the end of the calendar year in which the financial year ended |
| Replies to the seven-day email | At most 12 months |
| Emails to us | At most 12 months after the matter is closed |
6. Your rights
You have the right to:
- access the data we hold about you and get a copy,
- rectify data that is wrong,
- erase your data. The Delete my profile button deletes your account and all saved readings immediately. We keep the purchase records the Bookkeeping Act requires, but they never contain your questions,
- restrict processing while we look into an objection or an error,
- data portability. We send your saved readings and account details as a machine-readable file (JSON),
- object to processing based on legitimate interest, for example the statistics or the seven-day email,
- withdraw your consent at any time. This does not affect what we did before.
Email hej@taranaut.com from the email address you log in with. We reply within one month.
You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se, or to the data protection authority where you live. Feel free to contact us first and we will try to sort it out.
7. No automated decisions
An AI writes the reading, but it makes no decisions about you that have legal effects or similarly significant effects on you (GDPR Article 22). It does not decide what you can buy, what you pay or whether you may use the service.
8. Children
Taranaut is not intended for children under 13, and we do not knowingly collect data about them. You must be 18 to buy. If you believe a child under 13 has given us data, email us and we will delete it.
9. Do you have to give us data?
The free reading requires no data about you apart from your question. To buy, we need your email through Google login and a payment through Stripe, otherwise we cannot enter into the contract. Saving readings is optional.
10. Security
All traffic is encrypted (HTTPS). We keep as little as possible. Only the owner of the business has access to account and purchase data, and access is protected with two-factor authentication.
11. Changes
If we change this policy we publish the new version here with a new date. We email everyone with a profile about significant changes before they take effect. If a change requires new consent, we will ask for it.
Last updated: 30 October 2026.