Privacy Policy

Controller and contact

The controller of your personal data is BTCinvest s.r.o., Company ID 19764359, with its registered office at Svatopluka Čecha 1179/35, 612 00 Brno, Czech Republic (referred to as “Arcana”, “we”, or “us”).

For privacy questions and requests, contact us at contact@learnarcana.com.

Information we process and its source

• Account and sign-in: email, display name, internal user ID, and sign-in provider and method.
• Learning: completed lessons, cards, XP, streak, level, achievements, and settings.
• Content you create: journal entries, reflections, and Grimoire notes.
• AI Oracle: your question or prompt, selected cards, reading context, and generated response.
• Premium: entitlement status, plan, offer, and purchase or transaction identifiers. Full payment-card details are processed by Apple or Google, not Arcana.
• Technical and diagnostic information: device type, operating system, app version, event time, crash logs, error states, and related technical identifiers from Firebase Crashlytics.
• Support and website: messages you send us and essential server logs used to deliver, secure, and protect the website.

We obtain information directly from you, automatically when you use the service, and from sign-in and purchase providers.

Purposes and legal bases

• Contract performance: account creation and management, sign-in, progress synchronization, Journal, Grimoire, AI Oracle, Premium, purchase restoration, and support.
• Legitimate interests: service security, abuse prevention, essential server logs, and crash diagnostics; our interest is to operate a safe and stable service. You may object to this processing.
• Consent: only where we expressly request it for an optional feature; you may withdraw consent at any time without affecting prior lawful processing.
• Legal obligations and claims: accounting or other mandatory records, responding to lawful requests, and establishing, exercising, or defending legal rights.

Private reflections and AI Oracle

We do not sell journal content or personal notes or use them for targeted advertising. AI Oracle sends the OpenAI API only the content needed to generate the requested response, such as your question, selected cards, and reading context. Under the API terms, these inputs and outputs are not used to train models by default; OpenAI may retain them for a limited period, generally up to 30 days, to provide the service, ensure safety, and prevent abuse, unless longer retention is legally required. Do not submit that content if you do not agree to its processing for this purpose.

Do not enter passwords, payment details, third-party data without authority, or sensitive information intended for emergency, medical, legal, or financial assistance in notes or AI Oracle. Automatically generated output may be inaccurate and is not reviewed by a person before display.

Recipients and service providers

We disclose data only as necessary to: Google Firebase and Google Cloud for authentication, database, backend, and Crashlytics; Apple and Google for sign-in, distribution, and payments; RevenueCat for subscription management; OpenAI for AI Oracle; our website hosting provider; and professional advisers where necessary to protect rights or comply with law. We require processors to provide appropriate contractual, security, and confidentiality safeguards.

We may disclose information to public authorities only when required by law or a valid legal request. We do not sell personal data.

Transfers and retention

Some providers may process information outside the European Economic Area. Where required, we use a valid transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, together with supplementary safeguards where appropriate.

• Account, progress, Journal, and Grimoire: for the life of the account, then until deletion is completed and the data is removed from active systems.
• Purchase and transaction records: as needed to manage the subscription and afterward for statutory accounting, tax, and consumer-claim obligations.
• Support, security logs, and diagnostics: as long as needed to resolve the request, secure the service, and defend legal rights; afterward they are deleted or anonymized.
• Backups: deleted data may remain for a limited period in protected rotating backups and is not used for any purpose other than disaster recovery.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, and portability, object to processing based on legitimate interests, and withdraw consent. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects; Arcana does not carry out such decision-making.

We will respond without undue delay, normally within one month. We may reasonably verify your identity first. You may lodge a complaint with the Czech Office for Personal Data Protection or the supervisory authority in your country of habitual residence.

Account deletion instructions

Account deletion

You may delete your account and associated data in the app or request deletion through the Delete Account page. Uninstalling the app does not itself delete the account or cancel a subscription. We may retain limited data where required by law or necessary for security, fraud prevention, or legal claims; such data is restricted and no longer used for ordinary service delivery.

Security

We use technical and organizational measures appropriate to the information and risks, including access controls and secure transmission. No internet service is completely secure. If a personal-data breach occurs, we follow applicable notification requirements.

Children

Arcana is not directed to children under 16, and we do not knowingly collect their personal data. If we learn that we collected such data without valid authorization, we will take steps to delete it.

Policy changes

We may update this policy when the service, legal requirements, or our data practices change. The latest revision date appears above. Where required by law, we will provide appropriate advance notice of material changes.

Contact

Send privacy questions and requests to contact@learnarcana.com.