Legal

Privacy Policy

Effective August 8, 2026

1. Data controller

The controller of personal data for users of Draw the Card is the private individual operating the Service (the "Operator"), based in Poland.
For any matter concerning personal data, contact: postaw.karty@gmail.com

Your email address and an optional display name – provided voluntarily when you create an account.
The text of the question you ask, the cards drawn and the interpretation produced. These are saved for every reading, including one drawn without signing in – a reading drawn without an account is not linked to any user, but its content is still stored.
Anonymous page-visit counts – with no way of identifying an individual person.
We collect no payment data at all. The Service is free and accepts no payments, so no records of transactions, amounts or cards exist on our side.
Please do not put anything identifying into a question – names, addresses, phone numbers or details of your health. None of it is needed to draw a reading.

Account data is processed to run your account and give you the features that depend on being signed in, including your reading history.
Questions and readings are processed in order to produce and display the interpretation, and afterwards to improve the Service and protect it from abuse.
We do not process data for marketing purposes and we do not profile users for our own ends. Advertising in the Service is served by third parties, who act as separate controllers – see section 7.

Account data – your consent under Article 6(1)(a) GDPR, given by voluntarily creating an account. You may withdraw that consent at any time by requesting deletion of your account and data.
Questions and readings drawn without an account – the legitimate interests of the Operator under Article 6(1)(f) GDPR, namely providing and improving the Service and protecting it from abuse.
Where processing rests on legitimate interests you have the right to object – see section 8.

Data is stored on secured servers located within the European Union. If you use the Service from outside the EU, your data is transferred to and stored in the EU.
Passwords are stored in hashed form only – the Operator cannot read them.
Account data is retained until you delete your account, or until you request deletion at postaw.karty@gmail.com.
Readings drawn without an account are kept in a form not linked to any user. If you want a particular one removed, write to postaw.karty@gmail.com – finding it needs the approximate date and the wording of the question.

Personal data is never sold or shared with third parties for marketing purposes.
The text of your question is sent to an external provider of the AI model for the sole purpose of writing the interpretation. That provider processes it on our instructions and does not use it for its own purposes.
Account data is held in a database inside the European Union. Requests and the writing of interpretations may be handled on servers outside the European Economic Area, including in the United States, under the transfer terms agreed with those providers.
The Service uses no payment provider, because it accepts no payments. Should that change, this policy will be updated beforehand to name the provider and set out what is shared with it.
Data may be disclosed only at the request of competent public authorities, where required by law.

The Service uses cookies to function correctly (for example, to keep you signed in).
The Service uses Google Analytics, which uses cookies to collect anonymized traffic data (such as visit counts and referral sources). This data is not used to identify individuals.
The Service may display third-party advertising, including Google AdSense. Advertisers may set their own cookies under their own privacy policies and act towards you as separate data controllers.
You can turn off personalized advertising from Google, on every site that uses it, at myadcenter.google.com. Doing so does not remove ads from this Service – it makes them less relevant to you.
On your first visit a banner informs you about the use of cookies – continued use of the Service constitutes acceptance.
You can block cookies in your browser settings, though this may affect how some features of the Service work.

The right to access your personal data.
The right to rectification of inaccurate data.
The right to erasure (the "right to be forgotten").
The right to restrict processing.
The right to data portability.
The right to object to processing based on legitimate interests – this covers readings stored without an account (section 4).
The right to lodge a complaint with the data protection supervisory authority in your country of residence if you believe your data is being processed unlawfully. A list of EU authorities is published by the European Data Protection Board; the Operator is established in Poland, where the authority is the President of the Personal Data Protection Office (UODO).
To exercise any of these rights, contact: postaw.karty@gmail.com

The Operator is established in Poland and applies the standard set out above – the GDPR – to every user, wherever they are. In practice that is a higher standard than most United States state privacy laws require, and the rights listed in section 8 are available to you regardless of the state you live in.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are used in California law. We have never done so, including in the twelve months before this policy took effect. Because there is no sale and no sharing, there is nothing to opt out of.
We never ask for sensitive personal information as defined by California law, and we do not use what you write to profile you or to make automated decisions about you. If you choose to put sensitive details into a question, they are stored along with the reading – which is why we ask you not to.
Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may request access to their personal information, a copy of it, correction of it, or its deletion, and may appeal a refusal. Write to postaw.karty@gmail.com – requests are handled the same way for everyone and you will never be treated differently for making one.
The Operator will not discriminate against you in any way for exercising a privacy right.

The Service is intended for adults aged 18 and over and is not directed to children.
The Operator does not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe a child has provided personal information here, write to postaw.karty@gmail.com and the account and its data will be deleted.

✦