Privacy Policy
Last updated: 18 October 2026
Cardiki is a place to reflect, and some of what you write here is personal. This policy explains what we collect, why, who helps us process it, how long we keep it and the choices you have. The short version: we collect what we need to run the app, your journal is encrypted, and we never sell your data. Two things are up to you and are off until you turn them on: using what you do in Cardiki to personalise your recommendations, and using it to improve Cardiki's own AI. You can turn either off at any time.
1. Who we are
[to be confirmed by counsel], of [to be confirmed by counsel] ("Cardiki", "we", "us"), provides the Cardiki apps and cardiki.com and is the controller (in India, the data fiduciary) of the personal data described here. You can reach us about privacy at privacy@cardiki.com, and about anything else at support@cardiki.com.
- Our representative in the European Union [to be confirmed by counsel]: [to be confirmed by counsel]
- Our representative in the United Kingdom [to be confirmed by counsel]: [to be confirmed by counsel]
- Our grievance officer for India [to be confirmed by counsel]: write to privacy@cardiki.com with "Grievance" in the subject.
2. What we collect
| Data | Why we use it | Legal basis (EU and UK) | How long we keep it |
|---|---|---|---|
| Email address, password hash, or Apple or Google sign-in ID | Your account and its security | Contract | Until your account is deleted, plus 30 days |
| Age range (and birth year, for accounts that gave a date of birth before October 2026) | Checking you are old enough to use Cardiki | Legal obligation | Life of the account |
| Country and language, your device's time zone, and the region your device language named when you signed up (such as India, the UK or the US) | Showing the app in your language and the right crisis lines for your region; checking the minimum age, which is 18 in India (section 12) | Contract; legal obligation for the age check | Life of the account |
| The language you use Cardiki in (English, Hindi or Bengali) | Writing your readings, notifications and recaps in that language | Contract | Life of the account |
| Whether your browser sent a Global Privacy Control signal | Honouring it as an opt-out of sale and sharing (section 10) | Legal obligation | Life of the account |
| Readings: spread, cards drawn and your question | Giving you readings and your reading history; with your choice, recommendations and improving our models (section 4) | Contract; explicit consent for each choice in section 4 | Until you delete them |
| Journal entries and mood tags | Your journal, and personalised readings and insights; with your choice, recommendations and improving our models (section 4) | Explicit consent | Until you delete them |
| What we send to the AI and what it writes back | Writing your interpretation | Contract; explicit consent when journal context is included | Kept by us only as part of your reading; for our AI providers, see section 6 |
| In-app activity: which cards, spreads, moments and screens you open, and when | Running features such as your streak and history; with your choice, recommendations and improving our models (section 4) | Contract; explicit consent for each choice in section 4 | Life of the account; activity events 13 months, then kept only as totals; copies in a training set as below |
| Your choices in section 4, with the date, the policy version and where you made them | Proving what you agreed to and when | Legal obligation | 3 years after the choice changes or your account is deleted |
| Recommendation profile: themes and preferences we work out from your activity | Personalising your recommendations, only if you turn that on | Explicit consent | Deleted when you turn personalisation off or delete your account |
| Training sets: copies of questions, readings, journal entries, mood tags and activity, with your account details removed | Improving and training Cardiki's own models, only if you turn that on | Explicit consent | At most 3 years [to be confirmed by counsel], and removed sooner when you turn it off (section 8) |
| Safety event codes (a category and a response type, never your text) | Checking our safety protocol is working | Legitimate interest | 13 months |
| Push notification token and reminder preferences | Sending the daily reminder you chose | Consent | Until you turn reminders off |
| Stripe customer ID, App Store and Google Play receipts, records of what you agreed to at checkout | Billing, tax, and proving you agreed to a subscription | Contract; legal obligation | 7 years in the US, 6 years in the UK; checkout consent records at least 3 years |
| Device type, app version and crash diagnostics | Keeping the app reliable | Legitimate interest | 90 days |
| Pseudonymous product analytics | Understanding which features help people | Consent, everywhere: off until you turn on "Share usage statistics" | 13 months, then kept only as totals |
| Support conversations | Answering your questions | Contract | 24 months |
| Marketing email consent | Newsletters, if you ask for them | Consent | Until you withdraw it; we keep a suppression list so we never email you again |
We do not collect your precise location, contacts, photos or advertising identifiers, and we do not use geofencing.
Questions and journal entries can reveal things about your health (including pregnancy), your sex life or sexuality, your relationships or your religious or spiritual beliefs. The law treats these as special-category, sensitive or consumer health data, and so do we: we use them beyond running Cardiki for you only with your explicit consent.
3. How we use your data
We use your data to run Cardiki: drawing cards, writing interpretations, keeping your journal and history, sending the reminders you chose, processing payments, keeping the service secure, answering support requests, and improving the app using pseudonymous analytics. With your choice, we also use it for the two purposes in section 4.
AI processing. To write an interpretation we send our AI provider the cards you drew, the spread, your question and your stated focus. If you have turned on "Personalise with my journal", we also send recent mood tags and short excerpts of your journal. We never send your name (including the name you choose to show in the app), email address or account identifiers. We use third-party AI model providers to generate readings and to check questions for safety. Depending on the provider and its terms, a provider may keep data for a period and may use it to improve its own services. Section 6 explains when that can happen: only for people who have turned on "Help improve Cardiki's AI".
What readings are. Readings are for entertainment only. They are not predictions and not advice of any kind. Sections 2 and 10 of our Terms of Service explain this and the limits of our liability.
No sale, no ads. We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use advertising pixels. If you turn on "Help improve Cardiki's AI", AI model providers may use what we send them to improve their own services (section 4); where the law treats that as a sale or sharing, it happens only at your direction through that switch [to be confirmed by counsel].
Safety. Before a question reaches the AI, automated checks look for signs that someone may be in crisis, so we can show support resources instead of a reading. We log only a category code and a response code, never the text. Our safety protocol explains this in full.
4. Your two choices
Cardiki offers two separate switches. Both are off until you turn them on. You can find them after you pick your focus when you first open Cardiki (you can skip that step), and at any time in You, then Privacy, on the web, Android and iOS. Turning one on does not turn on the other, and nothing in Cardiki, including the price of Plus, depends on either.
Personalise my recommendations. If you turn this on, we use your questions, readings, journal entries, mood tags and in-app activity to work out what is likely to be useful to you, and suggest spreads, cards, questions and moments to match. This is profiling, and it may use sensitive information about you. Recommendations change only what Cardiki suggests. They never decide your price, your access to any feature, or anything with a legal or similarly significant effect on you, and they are never used for advertising.
Help improve Cardiki's AI. If you turn this on, we use your questions, readings (including what the AI wrote), journal entries, mood tags and in-app activity to evaluate, improve and train Cardiki's own AI and machine-learning models, for example so that readings are clearer and safety checks are more accurate. Where practicable, before your data enters a training set we remove your name, email address and account identifiers, replace your account with a code that is kept apart from the training data, and remove names, email addresses, phone numbers and addresses from the text. Data that can be linked back to you this way is still personal data, and your rights in section 10 still apply. The models belong to Cardiki. Training happens on our own systems or with service providers working for us.
The same switch also lets us send your requests (your question, the cards, and, if you use journal personalisation, mood tags and journal excerpts, never your name, email or account identifiers) to AI model providers whose terms let them keep data and use it to improve their own services and models. Those providers then decide how to use it under their own terms and privacy policies, so for that use they are separate controllers, not working only for us. With the switch off, we use a provider only on terms under which it processes your requests for us, apart from keeping them for a period for safety and abuse monitoring [to be confirmed by counsel].
What each choice covers. Each choice covers what you have already saved in Cardiki and what you add while it is on. Before 18 October 2026 this policy said that nothing you wrote would be used to train AI. We do not use anything collected before that date for either purpose unless you turn the switch on.
Turning a choice off. Turning a switch off withdraws your consent. It takes effect straight away: we stop using your data for that purpose from then on. For personalisation, we delete your recommendation profile. For improving our AI, we remove your data from training sets within 30 days [to be confirmed by counsel], we do not use it in any training run after you turn the switch off, and from then on we send your requests only to providers that process them for us. A provider that already received data under the switch holds it under its own terms; where the law requires, we pass your deletion or withdrawal on to it. A model that has already been trained is not retrained to remove what it learned, because training cannot reliably be undone one person at a time [to be confirmed by counsel], but we take steps so that our models do not repeat what people wrote. Withdrawing does not affect use before you withdrew.
When we change these purposes. If we change what a choice allows in a way that matters, we ask you again, and we treat the switch as off until you answer.
5. Legal bases
European Union and United Kingdom. We rely on: contract, to provide the service you signed up for; explicit consent (Articles 6(1)(a) and 9(2)(a) of the GDPR and UK GDPR), for journal entries and mood tags, for each of the two choices in section 4 (including, under "Help improve Cardiki's AI", disclosure to AI model providers for their own use), and for analytics and push notifications; legal obligation, for age checks, tax, billing records and records of consent; and legitimate interests, for security, diagnostics and safety metrics, where we have balanced our interests against yours. We do not rely on legitimate interests to personalise recommendations or to train models, because your questions may contain special-category data.
United States. Under the California Consumer Privacy Act as amended by the CPRA, the categories of personal information we collect and our purposes are those in sections 2 to 4. We use sensitive personal information for the two choices in section 4, and disclose it to AI model providers for their own use, only if you opt in, and we treat any state law that requires consent to process sensitive data, such as those of Colorado, Connecticut, Virginia and Texas, in the same way [to be confirmed by counsel]. Consumer health data under Washington's My Health My Data Act and Nevada's equivalent law is covered by our Consumer Health Data Privacy Policy: we collect and use it beyond running Cardiki for you only with your consent, which is separate from acceptance of these terms, and we share it with AI model providers for their own use only with your separate consent through "Help improve Cardiki's AI".
India. Under the Digital Personal Data Protection Act, 2023, we process your personal data on the basis of your consent, which you give when you create an account and use Cardiki and, separately, for each of the two choices in section 4. Each consent covers only the purposes described for it. This policy is the notice for that consent, and you can ask us for it in English or in any language listed in the Eighth Schedule to the Constitution [to be confirmed by counsel]. Where the Act allows a legitimate use without consent, such as complying with a law or responding to a medical emergency, we may rely on it.
Journal consent. The first time you save a reflection we show an unticked box, "Personalise with my journal". Ticking it lets us store mood tags, use your journal in readings and build pattern insights. It is separate from the two choices in section 4. You can withdraw consent in Settings at any time. Processing stops immediately, and we offer to delete insights derived from your journal.
6. Who processes data for us
We share personal data only with service providers that process it on our instructions under a data processing agreement:
- third-party AI model providers, to generate readings and check questions for safety. Depending on the provider and its terms, a provider may keep data for a period and may use it to improve its own services. A provider that uses data for its own purposes receives your requests only if you have turned on "Help improve Cardiki's AI" (section 4); otherwise it acts as our processor or service provider [to be confirmed by counsel];
- service providers that help us store, evaluate and train Cardiki's own models, only for people who have turned on "Help improve Cardiki's AI", and only with account details removed where practicable;
- our cloud hosting and database provider;
- Stripe, Apple and Google, for payments and sign-in;
- Apple Push Notification service and Firebase Cloud Messaging, for reminders;
- our transactional email provider, for sign-in links and receipts;
- our analytics, error monitoring and support desk providers;
- our content delivery network.
We may also disclose data where the law requires it, to protect someone's safety in an emergency, or as part of a merger or acquisition, in which case this policy will continue to apply to your data.
7. International transfers
Your data may be processed in countries other than the one where you live, including countries whose data protection laws differ from yours [to be confirmed by counsel]. When we transfer personal data out of the EU or UK, we rely on an adequacy decision (such as the EU-US Data Privacy Framework, where the recipient is certified) or on the European Commission's Standard Contractual Clauses and the UK addendum, with additional safeguards where needed [to be confirmed by counsel]. Under section 16 of India's Digital Personal Data Protection Act, we do not transfer personal data from India to any country the Government of India has restricted by notification [to be confirmed by counsel].
8. How long we keep it
Retention periods for each kind of data are in the table in section 2. In addition: when you delete your account we lock it straight away and erase it within 30 days, and backups containing it are purged within 90 days. When you delete your account, or turn off "Help improve Cardiki's AI", we remove your data from training sets within 30 days [to be confirmed by counsel]. If an account is inactive for 24 months, we delete it after sending two warnings to the email on file. We may keep data that has been aggregated or de-identified so that it can no longer reasonably be linked to you; we keep it in that form, do not try to re-identify it, and require anyone who receives it to do the same.
9. Security
All traffic uses TLS 1.2 or later. Your journal entries and questions are encrypted in our application with a key unique to your account, which is itself protected by a master key held in a key management service. They are decrypted only for the moment needed to show them to you, write a reading or, if you have chosen it, prepare them for the purposes in section 4. Training sets are kept apart from accounts, and access to them is limited to staff who need it. Journal text never appears in push notifications, analytics or crash reports. Access to production systems is limited to staff who need it.
If a breach affects your personal data, we notify the relevant supervisory authority (in India, the Data Protection Board) where required, within 72 hours where that deadline applies, and tell you without undue delay.
10. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you, and a summary of how we process it and who we have shared it with;
- export it in a portable format (Settings, then Export, gives you JSON and Markdown);
- delete it (Settings, then Delete account, or on the web), including from training sets;
- correct, complete or update inaccurate data;
- withdraw consent at any time, as easily as you gave it, without affecting processing that happened before. For the two choices in section 4, turn the switch off in You, then Privacy;
- object to processing based on legitimate interests, and to profiling;
- limit the use of sensitive personal information (section 11);
- opt out of the sale or sharing of personal data. We do not sell or share it except at your direction through "Help improve Cardiki's AI", which you can turn off at any time. We honour Global Privacy Control: once your browser sends the signal with a request from your account, we never again send your requests to an AI model provider for its own use, even if "Help improve Cardiki's AI" is on. The signal does not turn that switch off or change how we use your data to improve Cardiki's own models, which stays your choice in You, then Privacy [to be confirmed by counsel];
- in India, have your grievance addressed by our grievance officer (section 1) and nominate another person to exercise your rights if you die or become unable to;
- appeal if we decline a request, by replying to our decision.
To make a request, use the in-app tools or email privacy@cardiki.com. We may need to confirm it is you. We respond within 30 days in the EU and UK, within 45 days in the US, and to grievances in India within 90 days [to be confirmed by counsel], and we aim to complete exports within 72 hours. We will not treat you differently for exercising your rights.
11. Sensitive personal information (California)
We collect sensitive personal information: your account sign-in details, and information about your health, sex life or sexual orientation, or religious or philosophical beliefs that your questions, journal entries or mood tags may reveal. Without your opt-in we use it only to provide the service you asked for, keep it secure, prevent fraud and misuse, and for the other purposes California law permits. We use it to personalise recommendations or improve our models only if you turn on the matching switch in section 4. Leaving both switches off, or turning them off, limits our use of your sensitive personal information; you can also email privacy@cardiki.com with "Limit" in the subject, and we will turn both off for you.
12. Children
Cardiki is for people aged 16 and over, and 18 and over in India, where the Digital Personal Data Protection Act treats everyone under 18 as a child. We ask your age range before the first reading and keep only that range (and the birth year, for accounts that gave a date of birth before October 2026). If you are under 16, or under 18 in India, we do not create an account and keep nothing you chose. To decide whether you are in India we use only what your device already tells us: its region, time zone and language settings, and we treat you as being in India if any of them points there [to be confirmed by counsel]. If we learn that someone under 13 has used Cardiki, we suspend the account and delete it within 72 hours. For users aged 16 and 17 we apply high-privacy defaults: quiet hours are on, there is no behavioural advertising, we avoid features designed to lengthen sessions, and the two choices in section 4 are not offered, so they stay off [to be confirmed by counsel].
13. Cookies and similar technologies
The website uses a small number of strictly necessary cookies and local storage entries to keep you signed in and remember settings such as your theme and the website's language. With your consent, we also use first-party analytics. In the EU and UK we ask before setting any analytics cookies, and "Reject all" is as easy as "Accept all". In the US we honour Global Privacy Control. You can change your choice at any time from the cookie settings link. We use no advertising cookies or third-party tracking pixels.
14. Consumer health data
Mood tags, journal text and questions can count as consumer health data under laws such as Washington's My Health My Data Act and Nevada's equivalent law. Our Consumer Health Data Privacy Policy explains how we collect, use and share it, and the rights you have.
15. Changes to this policy
We will post any changes here and update the date at the top. If a change is material, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it. A change to what either choice in section 4 allows always needs your consent again.
16. Complaints
If you are unhappy with how we handle your data, please contact privacy@cardiki.com first. You also have the right to complain to a supervisory authority: in the EU, the data protection authority in the country where you live or work; in the UK, the Information Commissioner's Office (ico.org.uk); in California, the California Privacy Protection Agency (cppa.ca.gov); in India, the Data Protection Board of India, once you have used our grievance process.