Mystic Profile

Mystic Profile privacy

Privacy Policy

This policy explains what information Mystic Profile processes, why it is needed, and the choices available to you.

Effective September 20, 2026

1. Scope and operator

WHITE LIFE LLC, a Delaware limited liability company, operates Mystic Profile and is responsible for the practices described in this policy. The policy applies to mysticprofile.com and Mystic Profile mobile applications that link to it.

It does not govern a third party’s own website, payment page, app store, sign-in service, or privacy practices.

2. Information we process

Information you provide

  • Reading profile and inputs: first name or nickname, gender selection, birth date, optional concern, selected focus, chosen cards, and the generated reading. You can leave the concern blank.
  • Account information: email address, sign-in provider identifier, and a name or profile field when Google or Apple supplies it.
  • Support communications: messages, screenshots, and details you choose to send when requesting help.
  • Optional Elias AI chat: messages and replies, conversation titles, server-created summaries, interface language, and the saved context you choose to use. Signed-in conversations are stored privately in your account so you can return to them. Elias is a fictional AI guide, not a human support agent or licensed counselor. Please avoid sensitive personal information.

Purchase and entitlement information

We process transaction identifiers, payment status, purchase date, amount, currency, entitlement status, and limited fraud-prevention information. Stripe, Apple, or Google processes payment credentials. We do not receive your full payment-card number or card security code.

Technical information

We and our service providers may process IP address, browser or device type, operating system, request time, security signals, error logs, authentication state, cookie or local-storage identifiers, and general interactions needed to deliver, secure, troubleshoot, and measure the service.

If you tap the optional voice-input control, your browser or operating system may use its speech-recognition service. Mystic Profile receives the resulting text for your question; voice input does not start until you tap and you can always type instead.

3. How we use information

We process information to:

  • create and display the requested reading;
  • answer the questions you choose to send to Elias AI;
  • authenticate an account and synchronize saved readings;
  • confirm a purchase, grant access, restore access, and prevent fraud;
  • send a transactional copy of a purchased reading to the account email when the post-purchase flow requests or discloses that delivery;
  • when daily saved-reading email is available and you separately enable it, send the existing three cards, focus category, original reading date, and full interpretation from the saved reading you choose to your verified account email;
  • provide support, respond to privacy requests, and communicate important service or account information;
  • protect users and the service, enforce our terms, and investigate abuse;
  • measure general advertising events only when adult age confirmation, your advertising consent, and current privacy choices permit it, with Global Privacy Control taking priority; and
  • comply with legal, tax, accounting, dispute, and regulatory obligations.

We do not use tarot questions, birth dates, chosen cards, or reading content to personalize third-party ads.

4. Service providers and disclosures

We disclose information only as reasonably needed for the purposes described above, including to:

  • Supabase for authentication, database, and account data services;
  • Cloudflare for hosting, content delivery, security, network operations, and optional Workers AI processing of Elias messages and permitted reading personalization when selected by our server configuration;
  • OpenAI for API processing of optional Elias messages, limited server-owned conversation context, and saved personalization context when selected by our server configuration;
  • Stripe for website payment processing, fraud controls, refunds, and disputes;
  • Resend for transactional reading and account email, and separately opted-in daily saved-reading email when available;
  • Google and Apple for sign-in, app distribution, and in-app purchases where applicable;
  • Meta for advertising measurement only when the entry consent, age confirmation, and current privacy choice allow its technology to load; and
  • professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate fraud, or complete a corporate transaction subject to appropriate protections.

When Resend delivers a reading email, the email address and content needed for that message are processed for delivery. These providers may process information under their own terms and privacy notices.

Daily saved-reading email is optional and is not enabled by buying a Day Pass or requesting a browser reminder. It revisits one existing saved three-card reading; it does not draw new cards for you. Anyone with access to your email may read its private interpretation. You can stop the daily channel through its signed unsubscribe link or account preference when available without stopping required receipts. We retain the preference, time zone, consent version, and limited delivery records to honor this choice, prevent duplicate sends, and handle delivery failures. Delivery jobs do not contain the reading text.

5. Meta advertising measurement

Meta Pixel and Conversions API measurement require your advertising consent and adult age confirmation. They stay off when you opt out or your browser sends Global Privacy Control. If active, we may send general events such as page view, content view, checkout start, and a verified purchase, with a random event identifier, value, currency, Meta browser or click identifiers (_fbp and _fbc) when present, IP address, and browser user-agent. These technical signals help Meta match and deduplicate the same permitted event. Buying access does not require advertising consent.

We do not send Meta your concern, chat messages, gender, birth date, chosen cards, reading text, reading identifier, full name, email address, or payment-card details. We do not enable advertising measurement for a browser presenting a recognized Global Privacy Control signal.

Server-side match signals are captured only for a consented checkout. Mystic Profile removes them after the Meta purchase event is sent or skipped and retains them temporarily only while a failed delivery remains eligible for retry.

We do not sell personal information for money. Some US privacy laws may define optional cross-context advertising measurement as “sharing,” “targeted advertising,” or a similar regulated activity. You can opt out through US State Privacy Choices.

6. Cookies and local storage

Essential cookies and device storage keep reading progress, sign-in, payment verification, privacy choices, Cloudflare security, and operational logging working. Meta advertising measurement follows the disclosed entry agreement, age confirmation, saved opt-out, and Global Privacy Control state. See the Cookie Notice for details and controls.

7. Retention

We retain account and saved-reading information while the account is active or as needed to provide the service. We delete or de-identify it when it is no longer reasonably needed, subject to backup cycles and records retained for fraud prevention, security, accounting, tax, payment disputes, enforcement, or legal obligations.

Signed-in Elias conversations, messages, and summaries remain in your private account until you delete the conversation, clear all Elias history, or delete the account. Refreshing or signing out does not delete them. According to our server configuration, the server sends only recent messages and a limited server-owned summary to Cloudflare Workers AI or the OpenAI API, plus saved personalization context when you choose to use it. Chat and concern text is not written to application logs or advertising events. Separate request counters enforce usage limits without storing conversation text.

Before sign-in, your name, gender, birth date, and concern stay in active page memory rather than browser storage or analytics. After sign-in, gender and concern are saved for future personalization only if you agree to the explained purpose. Your existing account birth date remains the source of truth. You can delete a saved concern or all personalization memory from Profile. Deletion removes the selected records from active service and AI context immediately; protected backups may retain residual copies until their normal retention cycle ends.

A local coordination record expires after 24 hours and contains only a random browser-session identifier, schema and timing fields, and a saved-state flag. Before checkout, unfinished reading inputs stay in active page memory and are lost on reload. When you start Stripe checkout, we keep a random recovery token in a short-lived HttpOnly cookie and retain its corresponding locked, non-text reading state on the server for up to two hours so the Stripe return and sign-in can finish. The recovery cookie is not available to page JavaScript and does not contain your name, birth date, question, selected cards, or interpretation text. Local storage and tab-scoped session storage also do not retain your name, birth date or month-day key, question, selected cards, private-runtime access token, story draft, or interpretation text. Any obsolete tab-scoped reading copy is removed when session state is saved or loaded. Separate payment and email-delivery records may retain opaque reading and request identifiers so a completed purchase or delivery can be reconciled. Saved readings attached to an account are separate and remain subject to the account-retention rules above. Transaction and entitlement records may be retained after account deletion when reasonably necessary for the listed purposes. Other local information may remain on a device until browser or app storage is cleared. Retention periods can vary by record type and legal obligation.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information. No internet service or storage method is completely secure, so we cannot guarantee absolute security. Use a sign-in account you control and do not send passwords, one-time codes, or full payment credentials to support.

9. Your choices and rights

You can avoid saving a reading, reject optional measurement, sign out, clear local browser data, request support, or delete the account. Depending on where you live and whether a law applies, you may also have rights to access, correct, delete, or obtain a portable copy of information, or to opt out of certain advertising uses or profiling.

See US State Privacy Choices for request instructions, GPC information, authorized-agent requests, and appeals. See Account Deletion for the direct deletion path. We may verify a request to protect you and the account.

10. Adults only

Mystic Profile is intended only for people age 18 and older. We do not knowingly offer the service to children or minors. If we learn that an underage person submitted personal information, we will take appropriate steps to delete it. Contact us if you believe this occurred.

11. International use

WHITE LIFE LLC is a United States company. If you use Mystic Profile from another country, information may be processed in the United States and other places where our providers operate, subject to applicable safeguards and law.

12. Changes and contact

We may update this policy when the service, providers, or law changes. We will post the new effective date and provide additional notice when required.

For privacy questions or requests, contact WHITE LIFE LLC at [email protected].