Privacy Policy

1. Operator and privacy contact

Taroter Inc., Edmonton, Alberta, Canada operates Taroter and is responsible for the personal information it handles. Send privacy questions, access, correction, deletion or portability requests to support@taroter.app, with “Privacy request” in the subject. This policy describes the website, the Taroter apps for Android and iOS, and related services; it is not a request for blanket consent to every use of information.

Alberta’s Personal Information Protection Act and, where applicable, Canada’s federal PIPEDA govern our handling of information. Other privacy and consumer laws may also apply depending on your location and our activities.

2. Information involved in using Taroter

Account information includes your email address, account identifier, sign-in details, and any name, picture or profile information you provide. If you choose Google sign-in, Google supplies an identifier and the profile information authorized during that flow, such as your email, name and picture. We do not receive your Google password.

Session information includes prompts, conversation history submitted for generation, chosen characters/cards and saved reading content. Newly generated voice uses the text supplied for speech generation. Saved or cached content and technical reports can also contain information you submit. Avoid providing sensitive health, financial, identity or other personal details that are not necessary for entertainment.

Saved readings are private until you explicitly enable a sharing link. Anyone with an enabled link can read that session, including its questions and conversation, and may copy it. Deleting the saved reading or closing your account removes access through the link, but cannot retrieve copies other people have already made.

Purchase information includes transaction references, membership status, billing-period dates, payment customer identifiers and usage balances. Payment details are entered with our payment providers. Taroter does not store your complete card number or security code.

Technical information can include IP address, browser/device details, request timestamps, authentication and guest identifiers, errors and service usage. Optional analytics and performance measurement can collect page and device information when you enable them. We do not require your date of birth or precise device location to create a standard account. The Android and iOS apps display the same service and do not request access to your location, contacts, photos, camera or microphone.

3. Purposes and legal bases

We use information to authenticate accounts, provide AI conversations and voice, save content you request, process memberships and extra usage, measure available allowances, prevent abuse, handle support and privacy requests, and comply with legal obligations. Optional analytics helps us understand and improve service performance.

Where a law requires a legal basis, providing the requested service generally relies on performance of the contract, required recordkeeping relies on legal obligations, and proportionate security and fraud prevention may rely on legitimate interests. We seek consent where required, including for non-exempt optional tracking. You can withdraw optional consent without losing ordinary account access. This does not undo processing that was lawful before withdrawal.

4. AI, voice and other service providers

To generate a response, relevant prompts, conversation history and instructions are sent to the configured AI provider. Text for synthetic speech is sent to the configured voice provider. Depending on the model or feature, providers can include Google, Vercel AI Gateway, OpenRouter and its selected model providers, Cerebras, and Inworld. The provider used can change with model configuration. AI and voice are automated services; they do not make employment, credit or other similarly significant eligibility decisions about you.

Convex provides application data, authentication and file services. Supabase remains involved in legacy accounts, records or features during migration. Vercel hosts the website and provides optional analytics/performance tools. Google supports optional sign-in. Stripe processes website payments, and RevenueCat helps administer purchases and entitlements. Purchases in the mobile apps are processed by Apple (App Store) or Google (Google Play), which share the purchase records needed to grant your membership. Cloudflare Turnstile and Google reCAPTCHA help protect sign-up, sign-in and contact forms from automated abuse. Email and support infrastructure processes communications needed to respond to you.

Providers receive information needed for their role and may keep records subject to their contracts, settings and legal duties. Payment providers can act independently for their fraud-prevention and regulatory purposes. Provider retention and model-training practices vary; do not assume a conversation is confidential professional advice or that every provider has identical policies. Contact us for information about the providers relevant to a request.

We may disclose information when legally required, to address fraud or threats, or in a business transaction subject to applicable protections and notice. We do not sell your reading content or use it to target advertising. We do not use this policy as consent to future unrelated marketing.

5. Cookies, local storage and choices

Essential cookies and storage support sign-in, guest allowances, security and purchase continuation. These identifiers allow the requested service to work. Blocking them can prevent sign-in or correct usage accounting.

Optional site analytics and performance measurement are off until you choose to enable them. You can decline or change the choice through Privacy choices in the footer. Declining does not stop the essential operation of the service or third-party payment and sign-in features you request. Your browser also provides controls for cookies and stored data.

6. Retention, account closure and security

Account profiles and saved readings are kept to provide your account until you delete the content or close the account, subject to legal and security needs. Account closure starts removal of app profiles, saved content, usage records and account access. Removal runs in batches; closing an account is not a promise that all copies held by every provider disappear immediately.

Transaction references and records needed for accounting, tax, refunds, disputes, fraud prevention or legal obligations may be retained after closure. App-side billing references are separated from the deleted profile. Payment providers may keep legally required transaction records. Support, security records and backups may also be retained for their necessary purposes, restricted from ordinary account use, and removed when no longer needed. Contact us to request a review of retained information; statutory retention or legal holds can limit erasure.

We use access controls and other safeguards appropriate to the information handled. No internet service can guarantee absolute security. Do not share your sign-in credentials or submit unnecessary sensitive information. Report suspected unauthorized account access to support@taroter.app.

7. International processing

Our service providers may process or store information outside Alberta or Canada, including in the United States and other countries where they operate. Information can be subject to the laws and lawful access requirements of those countries.

Cross-border processing must meet the requirements that apply to the transfer, including appropriate contractual or other safeguards where required. Contact support@taroter.app about processing locations or to request information about relevant safeguards. We do not promise that all data remains in Canada.

8. Your requests and complaints

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction, or object to particular processing. These rights can have exceptions, including legal recordkeeping and the rights of others. We may need proportionate verification before releasing or changing personal information. We respond within the applicable legal time limits and explain any lawful refusal or extension.

You can close your account from Account settings on the website or in the Android or iOS app; step-by-step instructions are at taroter.app/account/delete. For other requests or if the closure tool is unavailable, email support@taroter.app. Do not email a password, complete card number or identity document unless a secure and necessary verification process has been agreed.

You may raise a complaint with the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada where applicable, or the data-protection authority with jurisdiction where you live. Contacting us first does not remove that right.

9. Age and policy updates

Taroter is intended for adults aged 18 and older. We ask users to confirm eligibility; this is an age declaration, not verification of a government identity document. If you believe a child has supplied personal information, contact support@taroter.app so we can investigate and handle deletion as appropriate.

The date above identifies this policy version. We will give notice of material changes and seek fresh consent when required for a new purpose or processing that requires consent. An update does not retroactively authorize incompatible use of information already collected.