Your readings stay private by design.
Requests use HTTPS/TLS in transit. Sensitive questions and AI answers are protected with application-level AES-256-GCM encryption at rest and are not used for model training.
Reading data and deletion
Only the current question, selected cards, reading mode, and spread are sent to the AI processor. The commercial API is not used for model training and may retain API inputs/outputs for up to 30 days under its service terms. Pressing and holding a message removes it only from this device; Delete Personal Data removes private server content earlier. Minimum payment, subscription/access, fraud-prevention, and legally required transaction records may be retained separately.
Encryption boundary
This is not end-to-end encryption: the service must briefly process readable question text in memory to generate a response. Encryption keys are kept separately from database content.
Payments
Payment details are handled by the checkout provider. Dorothy only receives purchase status, plan type, and transaction metadata needed for access control.
User control
You may export or delete saved reading history at any time, subject to separate legal, fraud-prevention, and billing retention requirements for transaction records.
Optional analytics
If you allow analytics, basic usage and attribution events use a one-way hashed visitor identifier and expire after 90 days. Broad relationship themes are classified on this device with a fixed taxonomy; only product, topic, and intent counters are uploaded, without message text, free-text summaries, account identifiers, or session identifiers. The server stores these theme signals only as daily aggregates.