Privacy Policy for Vesikaa

Effective Date: July 22, 2026

Last Updated: August 24, 2026

1. Overview and Contact

Vesikaa is operated by Vesikaa LLC, a California limited liability company ("Vesikaa," "we," "our," or "us"). Vesikaa is a tarot reading, journaling, and small-group reflection application. Vesikaa is local-first: your readings, journals, and preferences live primarily on your device. Vesikaa requires a signed-in account, and cloud services support sign-in, security, and backup and sync of your account data. Other cloud processing depends on your choices and device permissions, such as purchases, push notifications, optional analytics, encrypted journal backup, and Soul House sharing.

This Privacy Policy explains what we collect, how we use it, who we share it with, and the choices you have. Acknowledging this Privacy Policy is not blanket consent. Optional product analytics, marketing push, and any processing that requires consumer-health-data consent use a separate, purpose-specific choice.

You can reach us at:

• Privacy questions: privacy@vesikaa.com
• General support: support@vesikaa.com
• In app: Settings > Help & Support > Send Feedback

If you do not agree with this Privacy Policy, please do not use Vesikaa.

2. Scope

This Privacy Policy applies to the Vesikaa mobile app, Vesikaa websites and legal pages, account-deletion and support workflows, and related cloud services we operate.

This policy does not cover the independent privacy practices of Apple, Google, RevenueCat, PostHog, Sentry, Cloudflare, Firebase/Google Cloud, or other services that process data under their own privacy policies when you use their platforms.

3. Information We Collect

We collect information needed to provide the app, keep it reliable, deliver the features you use, and meet legal and platform obligations.

3.1 Account and Identity Data

Vesikaa requires an account for release builds. You can sign in with Sign in with Apple, Google Sign-In, or email and password. We collect:

• Firebase user ID, which is a stable account identifier we use to associate your readings, journals, purchases, entitlements, diagnostics, and support requests with you
• Email address, or Apple's private relay address if you choose that option
• Display name and public handle, if you set them
• Authentication provider metadata needed to keep you signed in and secure

3.2 Reading, Reflection, and Progress Data

When you use Vesikaa, we store app data locally and, for signed-in users, may back up compact records to owner-only cloud storage:

• Daily draws, yearly draws, and spread readings, including card identifiers, deck identifiers, positions, reversal state, timestamps, reveal state, and provenance needed to restore the same reading
• Daily and spread personal reflections and yearly intentions, when backed up, encrypted before upload
• Journal entries, when journal backup is enabled, encrypted before upload
• Card mastery, soul-points, streaks, progression snapshots, and similar product state
• Optional birthday or yearly-cycle anchor used to compute your yearly draw cycle
• Soul House sign and personalization seed metadata used to keep personalized draws deterministic across your devices

3.3 Preferences and Settings

We store preferences such as active deck, deck mode, animation settings, notification settings, privacy choices, onboarding state, gyroscope setting, local reminder times, and cloud-backup state.

3.4 Device, Install, and Diagnostic Data

For app stability and support, we may collect:

• Device model, operating system, app version, build number, platform, locale, timezone, and SDK install identifiers
• Crash logs, stack traces, performance traces, app lifecycle breadcrumbs, and feature breadcrumbs
• Firebase Crashlytics and Sentry events associated with your stable Firebase user ID when you are signed in
• Error metadata needed to debug sync, backup, purchase, push, and Soul House issues

Diagnostics should not include journal body text, private reflection text, or private questions. If you send feedback, the message you write is included in the support event.

3.5 Optional Usage Analytics

If you choose to share optional usage analytics, we use PostHog to understand broad product activity such as app sessions, pages visited, daily draws and reveals, journaling, spreads, Soul Sphere participation, Store interest, purchase outcomes, reminders, feedback opportunities, bounded survey choices or ratings, and deck-feedback ratings and selected topics. We use a pseudonymous identifier derived from your account ID. Relevant events may include the local calendar date when an event occurred (without your timezone), broad performance and retry ranges, bounded subscription-status observations, a code-assigned product-test variation after it is shown, and a first known campaign/source/channel from an approved Vesikaa link. This first-touch information is stored in bounded fields and never includes the full link, query string, search term, raw referrer, invite code, or sender identity. To understand which published decks are discovered, delivered, activated, used again, and rated, relevant events may also include a trusted public catalog deck ID and version. We do not send your account ID, email, name, exact card identity, user-authored deck labels, house or invite identifiers, purchase receipts or transaction identifiers, prices, private questions, journal text, reflection text, feedback notes, social-message content, exact performance durations, or exception messages to product analytics.

PostHog automatic screen capture, session replay, surveys, and automatic lifecycle tracking are disabled. Product events are sent only after you opt in. You can change your choice at any time under Settings > Privacy & personalization > Share usage feedback. Turning it off stops future product events and resets the analytics identity on that device.

3.6 Purchase and Entitlement Data

If you view offerings, buy a deck, start or manage a subscription, restore purchases, or receive an entitlement, we process purchase-related data through Apple, Google Play, RevenueCat, Firebase, and our entitlement mirror. This can include Firebase UID/app user ID, offerings and packages shown, product IDs, entitlement IDs, purchase and restore events, store transaction IDs and original transaction IDs, subscription expiry, cancellation, billing issue, refund, transfer, and renewal status. We do not receive your full payment card number.

3.7 Notification and Push Messaging Data

If you allow notifications or use features that need push routing, Vesikaa may store Firebase Cloud Messaging/APNs tokens and token-refresh metadata, permission status, device platform, locale language, timezone, and install diagnostics. We may also record delivery receipts, display receipts, open receipts, message IDs, campaign or broadcast IDs, quiet-hours skips, frequency-cap ledger entries, and related counters.

3.8 Soul House and Shared Content

Soul House and shared readings are optional social features. If you create, join, or use them, we process members-only social content such as:

• House membership, invite-code metadata, host/admin state, display names, public handles, Soul House sign, snooze/resting state, and reveal schedule
• Shared daily cards, shared spreads, communal reading state, shared intentions, notes you choose to share, comments, chat messages, replies, reactions, mentions, and timestamps
• GIF attachment metadata, such as provider IDs, URLs, dimensions, and preview metadata, when GIFs are enabled
• Reports, report reasons, moderation snapshots, message or comment snapshots, and redacted or anonymized records needed for safety, abuse prevention, audit, and group integrity
• Community-policy acceptance metadata, including policy version, the applicable minimum-age threshold, age-assurance method, and acceptance time. Apple or Google Play provides an age range and applicable guardian or communication status rather than a birthday. Vesikaa also reads your current App Store or Play Store country long enough to select the regional Soul Spheres age threshold, then discards the country; it is not saved in your community acceptance. Vesikaa stores only the derived threshold/tier and method used. On unsupported operating systems, you may confirm the applicable 13+ or 16+ threshold without providing a birthday.
• Owner-private block and mute controls, plus an owner-readable safety status that says whether community participation is active, restricted, suspended, or banned. Moderation evidence is not exposed through that status.

Soul House content is not encrypted like private journal backups. It is stored as members-only plaintext social content so the people in the house can see it. Vesikaa may suspend community sharing through a server-authoritative control for safety, security, legal, or operational reasons; access, deletion, safety, and moderation obligations continue to apply to existing community data while sharing is suspended.

3.9 Feedback and Support Data

If you send feedback or report an issue, we collect the message you write, optional name and email for follow-up, app version, build number, device details, and a shortened account identifier used for support correlation. Feedback is sent to Sentry when enabled for the build.

4. Optional Permissions and Local-Only Processing

Some features ask for optional device permissions:

• Motion sensors: If you enable motion-based reveal gestures, Vesikaa reads accelerometer/gyroscope signals live to detect the gesture. Motion readings are processed on device and are not stored or sent to our servers.
• Microphone: Rituals such as the Yearly Vibe candle can optionally use the microphone as a live signal — for example, to estimate blow strength when you blow out the candle. Audio is used only as a live signal for the interaction. Vesikaa does not record, save, transcribe, or share microphone audio for these features.
• Bluetooth: In-person shared readings can use Bluetooth to discover nearby Vesikaa sessions and exchange local session metadata. On Android, Bluetooth scan permission is requested with a no-location-use posture (neverForLocation). We do not use Bluetooth to infer, store, or sell your location.
• Photo library (save only): If you choose Save Image while sharing a card, Vesikaa asks for permission to add that image to your photo library. This permission is add-only: Vesikaa saves the image you chose and cannot browse or read your existing photos.
• Face ID / biometric unlock: If you enable Journal Lock, Vesikaa uses your device's Face ID, Touch ID, or equivalent biometric or passcode check to unlock your private journal and to confirm sensitive journal-backup actions. The check runs on your device through the operating system; Vesikaa receives only the success or failure result and never receives or stores your biometric data.

Vesikaa does not use your camera, contacts, or precise location, does not read your existing photos, and does not use the Advertising Identifier (IDFA) or cross-app tracking identifiers for the release behavior described here. Vesikaa may copy invite codes or share links to your clipboard when you tap a copy action, but it does not read clipboard contents.

5. Journal Encryption and Cloud Backup Modes

Journals are local-first. They live on your device unless you enable encrypted cloud backup. Journal cloud backup is a paid/private-backup feature, may not be available in every build or region while rollout completes, and journal plaintext must be encrypted on your device before any backup write.

For cloud-backed journals, daily/spread private reflections, and yearly intentions:

• The readable text is encrypted before upload.
• Cloud documents store encrypted payloads and limited metadata needed for sync, restore, conflict handling, and deletion.
• Already-backed-up encrypted data may remain in cloud storage until you delete it, request deletion, or delete your account.

Vesikaa supports two journal backup modes:

• Account-recoverable mode. This mode is designed to help you restore journals after signing in on a new device. A journal key is protected through server-managed metadata and Google Cloud KMS wrapping. Recovery requires your authenticated account and security checks, but because our infrastructure can help recover the key for your account, this mode is not zero-knowledge.
• Advanced recovery-key-only mode. This mode is designed for users who want zero-knowledge recovery. You keep the recovery key. Vesikaa does not keep an account-recoverable copy of the journal key for this mode, so we cannot recover readable journal text if you lose both your device and recovery key.

Turning backup off stops new journal backup activity but does not automatically delete encrypted documents that were already backed up. You can request deletion or delete your account to remove cloud-backed data, subject to limited retention described below.

6. Soul House and Shared Content

Soul House is a members-only social space. Content you share there is meant for other members of that house. This includes shared draws, shared spreads, communal reading material, intentions, comments, chat messages, reactions, GIF metadata, reports, and report snapshots.

We use server-side rules and Cloud Functions to limit access to current members and authorized workflows. However, shared social content is not private journal content and is not zero-knowledge encrypted. Other members may see it while they have access, and they may remember, copy, or screenshot it.

When a message, comment, member, or account is deleted, Vesikaa may remove the visible content, replace author details with a deleted-account marker, keep redacted/anonymized counters, or retain limited group-integrity records so conversations, reports, safety actions, and house history do not break for remaining members.

A global block is private to the person who creates it. It hides the blocked member's community content and reply previews for that person, prevents new direct interactions in either direction, and suppresses direct social notifications. Reports are not visible to house members. Reports include the selected reason, optional details, a limited content snapshot, target and reporter account identifiers, policy version, status, and a review target so authorized moderators can investigate and enforce the Community Guidelines.

7. Notifications and Push Messaging

Vesikaa supports local notifications and server-sent push notifications. Push notifications may include:

• Daily draw, journal, reflection, or reveal reminders you choose
• Soul House and shared-reading notifications, such as mentions, shared draws, chat activity, selection openings, and communal reveals
• Campaign or admin-authored notifications, such as deck launches, product updates, or account-relevant messages, when notifications are enabled for your device and the message is enabled for your account

To deliver and govern push notifications, we process FCM/APNs tokens, install and token diagnostics, platform, locale, timezone, permission status, delivery receipts, display/open receipts, campaign/broadcast IDs, message IDs, quiet-hours policy results, and frequency-cap ledger entries. Timezone, locale, and platform are used for local-time delivery, audience matching, quiet hours, and frequency caps.

Account-level notification controls separately govern social push, promotional push, and promotional in-app presentation. Promotional push defaults off, promotional in-app defaults on, and social push defaults on when a preference record is absent. Malformed preferences and unknown categories fail closed. Essential service messages, such as security or account-operation messages, are not governed by the promotional toggle. Your device settings can disable delivery of every remote notification, including essential service messages. We do not put journal body text, private reflection text, or private questions in push payloads.

8. Purchases and Subscriptions

Purchases and subscriptions are processed by Apple App Store, Google Play, and RevenueCat. Those providers process payment and store-account data under their own policies. Vesikaa receives purchase status and entitlement information needed to unlock content and restore access.

RevenueCat and Vesikaa may process Firebase UID/app user ID, offerings, packages, purchases, restores, product IDs, entitlement IDs, store transaction IDs, original transaction IDs, subscription expiry, cancellation, billing issue, refund, renewal, and transfer events. Vesikaa stores a server-owned entitlement mirror in Firebase so the app can unlock decks, subscriptions, private backup access, and other paid features across devices.

We do not receive your full payment card number. Refunds, billing disputes, and subscription cancellation are handled through the relevant app store unless the app directs you otherwise.

9. Analytics, Diagnostics, and Feedback

We use analytics and diagnostics to understand whether Vesikaa works, find bugs, prevent abuse, and improve core flows. Optional product analytics uses PostHog as described above. Operational diagnostics use Firebase Crashlytics, Sentry, and limited internal logs and are handled separately from optional product analytics.

When you are signed in, Crashlytics and Sentry may receive your stable Firebase user ID so we can connect crashes and support events to the right account. Sentry breadcrumbs and contexts may include app screens, feature states, device/app details, notification state, sync state, and non-sensitive identifiers. Feedback reports may include the message you write, optional contact name and email, device details, app version/build, tags, and a shortened account identifier.

We do not intentionally include journal body text, private reflection text, private questions, card identity, user-authored deck labels, purchase identifiers, feedback notes, or social message bodies in product analytics events. Trusted public catalog deck IDs and versions may be included as described above. Support feedback and issue reports include whatever you choose to type into the feedback form and are handled through the support/diagnostics channel, not PostHog product analytics.

10. AI and Personalization

Vesikaa includes personalization and on-device AI-style features. Depending on what you enable, on-device processing may use card history, deck choices, birthday/yearly-cycle data, personalization seed material, journal excerpts, local embeddings, retrieved passages, or prompt text to generate reflections, detect themes, or compose readings.

Mobile journal personalization is designed to run on device or through local app logic, and private journal text is not sent to third-party model providers for training. Shared-reading AI artifacts, when used, are generated on device and may save the generated reading text plus model and prompt-version metadata to the shared session so participants can view it.

Vesikaa may also offer optional AI features that run on servers rather than on your device — for example, richer interpretations or AI conversations. If you use such a feature, the text and context you provide for it (such as your question, the relevant reading, and the conversation itself) is sent to our servers and may be processed by a contracted AI model provider acting as our service provider. We limit any such provider to processing your content to provide the feature, and we do not allow your content to be used to train third-party models. Private journal text and other content we treat as consumer health data is not included in a server-side AI feature unless you give the separate, purpose-specific consent described in this policy. Any cloud AI provider we use will be identified in the service-provider table in this policy when the feature is available.

If you choose Report generated content, Vesikaa sends the displayed generated output, the reason you select, optional details you type, and limited context or model metadata to Firebase for authorized safety review. The report does not automatically include your journal text, private question, prompt, retrieved passage, or other source input. These reports are never visible to other users.

Vesikaa websites or admin tools may include separate generation APIs for deck or image-production workflows. If those tools are deployed publicly and you submit a prompt there, the prompt may be sent to the configured generation provider for that tool. Do not submit private journal text to web/admin generation tools unless that surface explicitly says it is intended for that use.

11. How We Use Information

We use the information described above to:

• Provide tarot readings, journals, reflections, personalization, and progression features
• Keep your data local-first while supporting backup, restore, and cross-device continuity
• Operate Soul House, shared readings, comments, chat, reports, and safety workflows
• Deliver local notifications and push notifications you allow or opt into
• Process purchases, subscriptions, restores, entitlements, and deck delivery
• Diagnose crashes, reliability issues, purchase issues, backup issues, and abuse
• Respond to support and privacy requests
• Maintain security, prevent fraud, enforce limits, and comply with legal obligations

We do not use your personal information for third-party advertising, cross-context behavioral advertising, or automated decisions that produce legal or similarly significant effects.

12. How We Share Information

We share information only as needed to provide Vesikaa, operate chosen features, comply with law, and protect users. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising or targeted advertising.

Key service providers include:

Soul House members receive the shared content you choose to post or generate in that house when community features are enabled. We may disclose information if required by law, to protect rights and safety, or in connection with a business transfer, subject to appropriate safeguards.

Where a service provider processes personal information on our behalf, we use the provider's applicable service terms and, where required, a data-processing agreement that limits processing to documented purposes and requires appropriate confidentiality and security. A provider may also process information as an independent business under its own terms for app-store, sign-in, payment, or platform functions you request.

Provider privacy policies:

• Google / Firebase: https://policies.google.com/privacy
• Tenor: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/
• Google Play: https://policies.google.com/privacy
• RevenueCat: https://www.revenuecat.com/privacy/
• PostHog: https://posthog.com/privacy
• Sentry: https://sentry.io/privacy/
• Cloudflare: https://www.cloudflare.com/privacypolicy/

13. Retention and Deletion

• Local data: Readings, journals, preferences, and local personalization data remain on your device until you delete them, clear local data, uninstall the app, or use an app flow that removes them.
• Cloud-backed personal history and settings: Retained until you delete the record, complete verified account deletion, or complete an approved privacy deletion request, except for a documented legal hold or a record that law requires us to preserve.
• Encrypted journal backups and encrypted private reflections/intentions: Retained until you delete them, request deletion, or delete your account. Turning backup off stops new backup activity but does not automatically remove prior encrypted backups.
• Account-recoverable journal-key metadata: Retained while account-recoverable backup is enabled or needed for recovery, and removed when you switch to recovery-key-only mode where the product flow deletes it, or when your account is deleted.
• Soul House social content: Retained until the author deletes it, its Sphere is deleted, or account erasure redacts it. Limited tombstones or safety evidence may remain only under the approved group-integrity, investigation, or legal-hold rule.
• Generated-content safety reports: Current reports remain in the server-only review queue until operator disposition under the approved retention rule. Account deletion anonymizes the reporter and removes the generated-output snapshot and optional details unless an active investigation, court order, or documented legal hold requires preservation.
• Push tokens and notification metadata: Tokens are updated, rotated, or removed after invalid-token responses, permission or account changes, account deletion, or an approved privacy request. Receipts, weekly ledgers, and rollups remain under their current server lifecycle until the release retention schedule's objective expiry or purge is approved and verified; we do not claim an unverified fixed period.
• Purchase records: Store and RevenueCat records are retained according to Apple, Google, RevenueCat, tax, accounting, fraud-prevention, and entitlement-restoration requirements.
• Analytics and diagnostics: PostHog product events currently do not have automatic event-retention enforcement, even though the project contains a 12-month configuration value. We therefore do not represent that events are automatically deleted after 12 months. PostHog deletion tools and verified privacy requests remain available. Crashlytics and Sentry records follow their verified vendor controls and approved deletion process; no shorter fixed period is promised until those settings are approved and evidenced.

Account deletion is available in the app where supported and at https://vesikaa.com/account-deletion.

14. Your Privacy Choices and Rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to certain processing of your personal information, and to withdraw consent where processing is based on consent.

Your choices include:

• Use device settings to allow or block notifications, microphone, Bluetooth, motion, photo-library, and biometric permissions.
• Use separate in-app controls for social push, promotional push, and promotional in-app messages. Promotional push requires an explicit opt-in and defaults off. Use device settings to stop all push delivery.
• Grant or withdraw optional product analytics under Settings > Privacy & personalization. Withdrawing stops future capture and resets the analytics identity on that device.
• Give or withdraw any separate consumer-health-data authorization presented for an optional cloud or personalization purpose. Privacy Policy acknowledgment does not grant that authorization.
• Use in-app export tools for supported local and backup data.
• Use in-app account deletion or https://vesikaa.com/account-deletion to request account deletion.
• Contact privacy@vesikaa.com for a complete access, export, correction, deletion, or objection request.

The in-app export is a product export for supported Vesikaa data. It may not include every vendor log, diagnostic event, purchase processor record, moderation snapshot, or internal security record that could be relevant to a formal privacy access request. Email privacy@vesikaa.com for a complete request.

California residents: we do not "sell" personal information or "share" personal information for cross-context behavioral advertising as those terms are used in the CCPA/CPRA.

Browser Do Not Track and Opt-Out Signals

Vesikaa does not use third-party advertising, cross-context behavioral advertising, or cross-site tracking. Because there is no such tracking to disable, browser Do Not Track signals do not change app or website behavior. Where a legally recognized browser opt-out signal applies to a sale or sharing of personal information, our no-sale/no-share posture already supplies the requested result.

Consumer Health Data

For release controls, we conservatively treat journal entries, private reflections, intentions, and inferences drawn from them as consumer health data where applicable law may classify them that way. We use this data only for the feature and purpose you request, do not sell it, and do not use it for advertising. A Privacy Policy acknowledgment is not consent to collect or share consumer health data. Before enabling an optional regulated cloud or personalization use, Vesikaa must present a separate, purpose-specific choice and the applicable consumer-health notice and rights. If that control is not available, the regulated optional use remains disabled.

15. Children and Age Restrictions

Vesikaa is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to Vesikaa, contact privacy@vesikaa.com so we can review and delete it where appropriate.

Community features, including Soul House and shared social features, require users to be at least 13 by default, at least 16 for the Australian storefront, and to satisfy any higher regional or guardian-consent requirement surfaced by Apple or Google Play. Before the first community post or interaction under a policy version, the app requests a privacy-preserving age range from the platform. It stores only the versioned acceptance, minimum-age threshold, age-assurance method, and acceptance time, not the returned range or a birthday. On an older device where the platform API is unsupported, you may confirm the applicable 13+ default or 16+ Australian threshold without providing a birthday.

16. International Transfers

This public release is offered in the United States. Vesikaa is operated from the United States, and our service providers may process information in the United States and other countries. These countries may have data-protection laws different from those where you live.

Distribution in the European Union and United Kingdom is deferred for this submission. We will not represent that an EU/UK transfer, representative, legal-basis, or child-design posture is complete until those regions pass a separate privacy and product review.

17. Security

We use technical and organizational measures designed to protect Vesikaa data, including HTTPS/TLS in transit, Firebase security rules, owner-only data paths, App Check and authentication checks where applicable, limited admin access, client-side encryption for private backup payloads, and KMS wrapping for account-recoverable journal-key workflows.

No system is perfectly secure. If we discover a security incident involving personal information, we will evaluate notification obligations under applicable law.

18. Changes

We may update this Privacy Policy as Vesikaa changes or as legal, platform, or vendor requirements change. When we make material changes, we will update the "Last Updated" date and provide additional notice where required or appropriate.

Feature names, menu paths, and screen locations described in this policy may change as the app evolves; where a named control has moved or been renamed, the equivalent current control applies. The data practices described here govern regardless of what a feature or setting is called.

19. Contact

For privacy questions, requests, or complaints:

• Email: privacy@vesikaa.com
• General support: support@vesikaa.com
• Account deletion: https://vesikaa.com/account-deletion

If you are in a region with a data protection authority and believe we have not addressed your concern, you may have the right to contact your local authority.