Divinica

Legal

Privacy Policy

Last updated: May 24, 2026

This Privacy Policy explains how Artur Nikolaienko, an Empresário em Nome Individual (Portuguese sole proprietor) based in Portugal (“Divinica”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data when you use the Divinica iOS mobile application (bundle identifier app.divinica.mobile), our website, and related services (together, the “Service”).

For purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Brazilian Lei Geral de Proteção de Dados (LGPD), Divinica is the controller of personal data processed through the Service, except where this Policy states otherwise.

1. Who We Are and How to Reach Us

You can write to us at support@divinica.app about anything in this Policy, including to exercise the rights described in Section 11.

2. Scope

This Policy applies to personal data we process about Users of the Service. It does not cover:

The Service is available globally in multiple languages and is hosted in the United States. If you access the Service from outside the United States, your personal data will be transferred to the United States. See Section 8 on international transfers.

3. Age Restriction

You must be at least 16 years old to create an account or use the Service. We do not knowingly collect personal data from anyone under 16. If we learn that we have collected personal data from a person under 16, we will delete it as soon as reasonably practicable. If you believe a child under 16 has provided us with personal data, please write to support@divinica.app and we will investigate.

4. Categories of Personal Data We Collect

We collect the following categories of personal data. Required fields are marked.

4.1 Account data (collected directly from you)

Field Required? Source Notes
Email address Yes You, or Apple/Google sign-in Used to identify your account and contact you about the Service.
Password (hashed) If you choose email signup You Stored as a bcrypt hash. We never see, store, or transmit your plain-text password.
Display name No You Optional; shown back to you in the app.
Sign-in provider identifier If you use Sign in with Apple or Google Apple / Google A stable opaque identifier issued by Apple or Google. Apple may use a private relay email; Google provides your email (and optionally name) only with your consent.
Authentication provider Yes Derived Tells us how you sign in (email, Apple, or Google).

4.2 Profile and preferences

We store the preferences you set in the app — your preferred reading tone, default theme, the intention or purpose you choose, and your interface language — together with technical request metadata such as your Accept-Language header. These are used only to personalize and deliver the Service for you. All are optional except language, which is needed to render the app.

4.3 Subscription data

We store your subscription state and an identifier provided by RevenueCat that links to your Apple subscription so we know which features to unlock for you. Apple is the merchant of record for all purchases — we do not receive your payment-card details.

4.4 Authentication tokens

4.5 Reading content

For each reading you perform, we store the question text you typed (see Section 4.7), the reading inputs (such as the card drawn, the chosen theme, and the moon phase at the time), the AI-generated interpretation text, and a timestamp — all linked to your account.

4.6 Technical and operational data

4.7 Sensitive / special-category data — important warning

The questions you submit are free text. Many tarot questions naturally touch on personal topics — relationships, mental health, sexuality, religion, finances, work, family. Some of this content may qualify as a “special category” of personal data under GDPR Article 9 (e.g., health, religious beliefs, data concerning sex life or sexual orientation), as “sensitive personal information” under the California CPRA, or as “sensitive personal data” under LGPD Art. 5(II).

Please do not include information you do not wish to share. In particular, please do not include full names of other people, contact details, government IDs, financial-account numbers, or medical records.

If you nonetheless choose to enter sensitive content, our lawful basis for processing it is your explicit consent (GDPR Art. 9(2)(a); LGPD Art. 11(I)), given by your act of submitting the question to the Service after this warning. You can withdraw that consent at any time by deleting the reading from your history or by deleting your account; withdrawal does not affect processing already carried out. Note that the question text is transmitted to Anthropic so that the language model can generate your reading (see Section 7.3).

5. Sources of Personal Data

We collect personal data from:

  1. You directly — when you register, set preferences, type a question, or contact support.
  2. Apple and Google — when you choose Sign in with Apple or Sign in with Google. These providers send us the identity token and the opaque user identifier described in Section 4.1.
  3. RevenueCat and Apple — for subscription events (tier, renewals, cancellations).
  4. Derived from your use — your reading history, your preferences, and standard request metadata.

6. Why We Process Your Data, and Our Lawful Basis

For Users in the EU, UK, EEA, and any other jurisdiction with a GDPR-style framework (including Brazil under LGPD and Ukraine under the Law on Personal Data Protection), the lawful bases are as follows.

Purpose Lawful basis (GDPR / UK GDPR) Lawful basis (LGPD)
Creating and operating your account; authenticating you Performance of a contract (Art. 6(1)(b)) Execução de contrato (Art. 7(V))
Generating tarot readings from your questions (the core service) Performance of a contract (Art. 6(1)(b)) Execução de contrato (Art. 7(V))
Processing sensitive content you voluntarily include in a question Explicit consent (Art. 9(2)(a)) — see Section 4.7 Consentimento específico (Art. 11(I))
Storing your reading history Performance of a contract (Art. 6(1)(b)) Execução de contrato (Art. 7(V))
Managing your subscription and billing reconciliation Performance of a contract (Art. 6(1)(b)); legal obligation for tax/accounting (Art. 6(1)(c)) Execução de contrato + cumprimento de obrigação legal
Security, fraud prevention, abuse detection, rate limiting Legitimate interests (Art. 6(1)(f)) — to keep the Service secure and available Legítimo interesse (Art. 7(IX))
Responding to support requests Performance of a contract; legitimate interests Execução de contrato / legítimo interesse
Improving the Service (debugging, error analysis, performance tuning) Legitimate interests (Art. 6(1)(f)) Legítimo interesse (Art. 7(IX))
Complying with legal, tax, regulatory, or law-enforcement obligations Legal obligation (Art. 6(1)(c)) Cumprimento de obrigação legal (Art. 7(II))

We do not profile you for advertising. We do not make automated decisions that produce legal or similarly significant effects about you (the AI-generated reading text is not such a decision — it is informational content you read).

7. Who We Share Your Data With

We share personal data only with the service providers we need to operate the Service. None of them sell your data, and we have written agreements (data processing addenda or equivalent) where applicable.

We do not sell or “share” your personal information in the sense those terms are used in the California CPRA. We do not disclose your personal data to advertising networks. We do not use cross-context behavioral advertising.

7.1 Apple Inc. — Sign in with Apple, App Store, StoreKit

7.2 Google LLC — Sign in with Google

7.3 Anthropic, PBC — Claude language model

7.4 RevenueCat, Inc. — subscription state management

7.5 Fly.io (Hydroku, Inc.) — application hosting and managed Postgres

7.6 Other recipients

We may disclose personal data:

7.7 Sub-processors

The providers above may use their own sub-processors (for example, cloud-infrastructure providers, CDN providers, email-delivery services). We rely on each provider’s published sub-processor list. We may add, replace, or remove processors and sub-processors over time. Material changes will be reflected in updates to this Policy.

8. International Transfers

Because our backend and several of our processors are in the United States, personal data of Users located in the EU, UK, EEA, Switzerland, Brazil, Ukraine, or elsewhere outside the United States is transferred to and processed in the United States.

The United States has not received a general adequacy decision from the European Commission. To safeguard these transfers we rely on:

You can request a copy of the relevant SCCs / addenda from support@divinica.app (we may redact commercially sensitive terms).

9. Retention

We keep personal data only for as long as we need it for the purposes described in Section 6.

Data Retention
Account data (email, display name, provider IDs, preferences) Kept for the life of your account.
Reading content (question, card, interpretation, moon phase, timestamp) Kept for the life of your account. Some readings may only be visible to you in the app while your subscription tier permits; all readings remain stored on our servers until the account is deleted.
Subscription state (tier, RevenueCat customer ID) Kept for the life of your account; certain billing-related records may be retained longer for tax and accounting purposes (typically up to 7 years) where required by law.
Refresh tokens Until you log out of that device session or your account is deleted.
Server logs Typically 30 to 90 days, then deleted or aggregated.
Backups Database backups may persist for up to 90 days after deletion, after which they are overwritten on rotation.

Account deletion. You can delete your account from inside the app with one action. Our backend handler immediately hard-deletes your user row, which CASCADE-deletes all your readings, preferences, and active refresh tokens. The deletion is immediate at the database level; residual copies in encrypted backups expire on the schedule above. We will complete any required propagation within 30 days at the outside — well within GDPR’s one-month requirement.

10. Security

We use reasonable technical and organizational measures to protect personal data, including:

No service is perfectly secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by GDPR Art. 33 and will notify affected Users without undue delay where Art. 34 (or equivalent) requires.

11. Your Rights

11.1 If you are in the EU, EEA, or UK (GDPR / UK GDPR)

You have the right to:

Our lead supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD) at www.cnpd.pt. A directory of EU/EEA supervisory authorities is available at edpb.europa.eu. The UK authority is the Information Commissioner’s Office (ICO) at ico.org.uk.

11.2 If you are in California (CCPA / CPRA)

You have the right to:

We do not knowingly sell or share the personal information of consumers under 16.

11.3 If you are in Brazil (LGPD)

You have the right to:

11.4 If you are in Ukraine

You have the rights provided under the Law of Ukraine “On Personal Data Protection,” including the right to know about processing of your data, to access it, to require its correction or destruction, and to lodge complaints with the Ukrainian Parliament Commissioner for Human Rights.

11.5 Exercising your rights

Write to support@divinica.app. To protect your account, we will verify your identity (typically by confirming control of the account email). We will respond:

There is no fee for reasonable requests. We may charge a reasonable fee or refuse to act on manifestly unfounded or excessive requests.

You can also exercise some rights directly in the app:

To cancel a paid subscription, use Settings → [your name] → Subscriptions on your iOS device. Subscription cancellation is handled entirely by Apple; we cannot cancel for you and cannot issue refunds directly (refund requests go through Apple at support.apple.com/HT204084).

12. Cookies, Tracking Technologies, and Identifiers

The Divinica iOS app does not use:

The app stores a refresh token in iOS Keychain to keep you signed in. That is the only persistent identifier used by the app.

If we add an analytics tool (for example, PostHog) in the future, we will update this Policy, surface a clear in-app notice, and where required obtain consent before collection begins.

13. Apple App Store “Privacy Nutrition Labels”

The disclosures in our App Store “App Privacy” labels are consistent with this Policy. If you spot a discrepancy, please tell us at support@divinica.app.

14. Changes to This Policy

We may update this Policy. The “Last updated” date at the top reflects the most recent version. For material changes, we will give you notice via in-app message, email, or both before the change takes effect, and where required we will obtain your consent.

A history of previous versions can be requested from support@divinica.app.

15. Complaints

If you have a concern about how we handle your personal data, please contact us first at support@divinica.app so we can try to resolve it. You also have the right to lodge a complaint with the data-protection authority in your country (in Portugal, the CNPD — see Section 11.1).

16. Contact

For all matters — including privacy questions, data-subject requests, and general support — please write to support@divinica.app.

If you need our current postal correspondence address (for example, to send a formal data-protection notice), please email us and we will provide it.

Operator: Artur Nikolaienko, Empresário em Nome Individual, Portugal. Brazilian Encarregado (LGPD Art. 41): the same.