Soiree Privacy Policy

Last updated 11 October 2026 — covers "Black Cat Soiree Tarot Reading" (Japanese name: 黒猫のソワレ ― タロット占い) for iOS and Android

"Black Cat Soiree Tarot Reading" ("the App") is an app in which Soiree, a black cat reader, turns tarot cards and answers your question in writing. This policy explains, in plain language, what the App keeps, where it keeps it, what it sends out, and when it is deleted.

Effective date: 12 October 2026

1. The most important points (summary)

2. What is saved on your device

The device stores journal entries such as questions, drawn cards and orientations, readings, follow-up questions and answers, and dates; Card of the Day and reversal settings; an authentication key for server communication; and device-verification keys. Journal entries have no expiry. The original question is also stored in its journal entry.

A follow-up from the journal sends that entry's original reading text back to the server. You can erase journal entries individually, through account deletion, or by removing the App. Data included in OS backups is managed by Apple / Google, rather than synchronized as a whole journal to the developer. On iOS, the authentication key is stored in a device-only Keychain item.

3. What the developer's server holds

The developer uses Cloudflare Workers / D1 for the server and database. The main data, purposes and retention rules are below.

Data	Contents	Purpose, retention and deletion
Authentication device identifier	A hash of a random device token issued by the server, not an advertising ID	Authentication and management of counts, purchases and consent. No fixed retention period. Account deletion removes the device row, device rate limits, consent and activity-date records
Trial-management key and device-verification material	Verification processes App Attest evidence and key IDs and DeviceCheck device tokens on iOS, and ANDROID_ID (SSAID) and Play Integrity evidence on Android. The server retains App Attest key IDs, public keys, receipts and signature counts; management keys derived by hashing key IDs / SSAIDs with a server secret and their mappings; and used-trial records. Used-trial marks are also managed through Apple DeviceCheck / Google device recall	Limits the trial to once per device and prevents repeated claims. Proofs and tokens are sent to verification providers. Verified keys, trial ledgers and key mappings have no fixed retention period and survive account deletion. The trial is unavailable if verification fails
Device-verification operation records	Request hashes, operation identifiers and status, links to the device, and temporary challenge values	Deduplication and retries. Account deletion removes the device link. After 24 hours from the last update, a process running every minute removes device links and related values and deletes old unused operations without trial-ledger references. Challenges have separate expiry times. Daily verification aggregates are cleaned up after 90 days
Purchase, ticket and refund ledgers	Store transaction identifiers and purchase tokens; contract status and expiry; verification, refund, revocation and refund-reversal records; ticket issue dates, quantities, balances, expiry, revocation and associated reading identifiers	Payment verification, balances, restoration, refunds, preventing double grants, and sales totals. No fixed retention period. Account deletion removes direct device links but retains ledgers; restoration may link them again
Usage dates and counts	Activity dates per device (one entry a day), reading dates and types, ticket use and follow-up counts	Managing counts and tickets; measuring next-day and seven-day return rates and improving the App. Activity dates have no fixed expiry and are deleted on account deletion. Reading-management records remain with their direct device links removed
Reading and follow-up answer text (temporary)	Generated text, which may include details from your question	Redelivery and follow-up context. A process running every minute deletes text after ten minutes from receipt of the request. Account deletion also removes it
Reading fingerprint and drawn cards	SHA-256 hash of the reading text, and card identifiers and orientations. The hash is not used to reconstruct the text	Verifying that text sent back from the journal matches the original and using the same cards for the follow-up. These remain in management records after the ten-minute text deletion. No fixed expiry; account deletion removes direct device links
AI usage, performance, safety and audit data	AI used, token counts, estimated cost, response time, safety results, consent version and time, and events such as grants and deletion. Ordinary question and reading text is not logged	App functionality, cost control, performance checks, abuse prevention and troubleshooting. No fixed expiry. Account deletion deletes consent records and removes direct device links from AI and audit records

The source IP address is processed when receiving a connection. An identifier derived from connection information is used for rate limiting and abuse prevention. The App's rate-limit storage uses an IP hash combined with a server secret, rather than storing the raw IP. Expired rows are removed by a process running every minute after the counting period of one hour or one day ends, normally within about two minutes; outages may delay this. Infrastructure providers such as Cloudflare also handle connection data under their own policies.

4. Using third-party AI for readings

Readings and follow-up answers are written by Gemini, an AI made by Google LLC. Only the second stage of the safety check in section 5 is performed by Claude, an AI made by Anthropic PBC. Neither is written by a person. What is sent:

Recipient	When	What is sent
Google (Gemini)	Each time you draw	The question you typed. The cards drawn, and whether each is upright or reversed
Google (Gemini)	When generation stops partway through and a continuation is requested	The reading or answer generated so far is sent back
Google (Gemini)	When you ask a follow-up question	Your follow-up question. The original question and cards for that reading. The original reading text (the temporary copy in section 3, or that entry’s text sent back from the journal). The clarifying card
Anthropic (Claude)	For the second-stage safety check of readings and follow-up questions	The question for a reading, or the new question for a follow-up (including when no reading is produced — section 5). Journal reading text is not sent through this safety-check route

We do not ask for your name, email address, phone number, or location in separate fields, and we do not send device identifiers or the full text of your journal to the AI companies. If your question, follow-up or reading text sent back from the journal contains personal details, that content is sent to the AI companies as shown in the table.

• This disclosure appears in three places: the consent screen at first launch, the settings screen, and the store listing. No reading begins before you agree. The fact that you agreed is kept separately, as the consent record in section 3.
• Each company also retains what it receives and the text it returns for a period. See each company's published documentation for its retention period and whether it uses the information for AI training.
• Each company handles what it receives under its own privacy policy (Google, Anthropic).
• The developer uses your question to produce the reading and follow-up answers and to check for safety, and does not provide it for the purpose of AI training. Under the paid Gemini API terms, Google does not use prompts or responses to improve its products (including AI training); it logs them for a limited period for abuse monitoring and related purposes. By default, Anthropic does not use inputs or outputs from its commercial API to train its models (see the paid Gemini API terms and Anthropic's commercial product policy).

5. Safety messages

If your question or follow-up question contains wording about harming yourself or someone else, the App does not produce a reading and shows a list of helplines instead. That check runs in two stages: a wordlist match on the server, and a check by Anthropic's AI, and only the fact that it fired is recorded as a count. Neither input is stored as a separate field on the developer's server in this case either (retention by the AI company is as described in section 4). Purchase prompts are hidden on that screen.

6. Reporting a reading

If a reading is upsetting, you can report it from the reading screen. This meets Google Play's requirement for apps whose core feature is generative AI.

• By default the report does not include the text. The reason you selected and identifiers for the reading and the AI call concerned are sent. The server records the reason, the report date and time, the device key and the AI call identifier.
• There is a checkbox to attach the question and the reading. Only when you tick it yourself does the developer receive that one piece of text. This is the only case in which your question is kept on the developer's server as a separate field (for the temporary copy of the reading, see section 3; for retention by the AI companies, see section 4).
• Attached text is deleted by a daily process after 90 days have elapsed. The report record (reason, date and time, device key and AI call identifier) remains. See section 8 for what happens when you delete your account.

7. Purchases

• Everything is sold as an in-app purchase through the App Store or Google Play. Apple and Google process the payment; the developer never receives card details.
• One three-card Soiree's Tarot Reading can be tried free, once per device. Other readings are bought as a ticket or on the subscription (the Card of the Day is free every day and uses up nothing). A subscription never starts on its own.
• You can cancel a subscription from your App Store or Google Play account settings. The App's settings screen links straight there.
• With "Restore purchases" in Settings, when the purchases can be verified under the same Apple Account or Google account you bought with, your available remaining tickets and an active subscription can be restored on a new device. Purchased tickets may not be restorable.
• Family Sharing and the Google Play family library are not supported. Purchases work on the buying account only, so that draws and entitlements are counted correctly per subscription.

8. Deleting your data

To erase only a journal entry, delete it individually in the journal screen. This removes the local entry; it does not erase server ledgers or information already sent to AI providers.

Use Settings → Delete account to leave the service. The App erases local journal entries and settings after confirming the server has completed deletion. If the result cannot be confirmed, it keeps local data and checks the result again. Contact section 14 if the issue continues. Removing the App alone does not request server-side account deletion.

Server-side account deletion removes the device row, consent and activity-date records, and device rate limits. It also removes temporary reading text and attached report text. The following remain:

• Trial-management keys, used-trial marks, key mappings and verified device-attestation keys and receipts. These have no fixed retention period, to prevent repeated trials after reinstalls or deletion. Direct device links in verification-operation records are removed on account deletion (section 3).
• Purchase, ticket, contract, refund and revocation ledgers, with no fixed retention period. Direct device links are removed, but restoring purchases may re-link transactions, ticket ledgers, readings paid for with those tickets and related AI usage records to a new device. Ticket expiry is separate from ledger retention.
• Daily usage counters created on deletion. These contain keys and numbers only, but a key may include a store transaction identifier. A process running every minute deletes them after 24 hours from the last update. Hashes of deletion receipts used to check the result are also removed by the every-minute process after 24 hours.
• Reading-management records (including text hashes and card data), AI usage, cost and response times, safety and audit records, and report reasons, dates and call identifiers. These have no fixed expiry and remain with direct device links removed. They may be re-linked through purchase ledgers, so they are not necessarily fully anonymous.

Information retained independently by Google, Anthropic, Apple, Google Play or Cloudflare, and OS backups, is not all immediately erased by local or account deletion. We cannot promise a uniform deletion deadline or confirm deletion of information held by those companies. Section 14 covers inquiry-data deletion.

Account deletion or removing the App does not stop subscription billing. Cancel with App Store / Google Play first if you have an active subscription.

9. Who else receives anything

Party	Role	What reaches them
Google LLC (Gemini API)	Writes the reading and follow-up answers	Your question, the cards drawn, your follow-up question, the reading just delivered and the clarifying card (section 4); retained for a period
Anthropic PBC	Second-stage safety check	Your question and your follow-up question (section 4); retained for a period
Cloudflare, Inc.	Server and database	The values in section 3, a temporary copy of the reading text (about ten minutes), and traffic in transit. Your question is not stored as a separate field. However, the temporarily stored reading text may contain details from your question. The original reading text sent back from a journal entry is also relayed. Text you attach yourself when reporting is also stored (section 6)
Apple (App Store)	Distribution, payments and device verification	Purchase status and transaction identifiers; App Attest evidence and key IDs; DeviceCheck device tokens and used-trial marks (payment stays inside Apple)
Discord	Managing tester ticket grants (when notifications are enabled)	The grant identifier linked to the device, ticket type, quantity and period may be sent to the operator’s notifications. Questions and reading text are not sent
Google (Google Play)	Distribution, payments and device verification	Purchase status and purchase tokens; Play Integrity evidence and request hashes; device recall used-trial marks (payment stays inside Google)

Every company listed here is headquartered in the United States, so the information above goes to recipients outside Japan. Nothing is provided or sold to anyone else. No advertising or analytics company receives anything, because none is built into the App. See the policies of Google, Anthropic, Cloudflare, and Apple.

The developer engages Google (Gemini API) and Anthropic to process AI requests, and Cloudflare to provide the server and database. Apple (App Store) and Google (Google Play) handle distribution and payment through their own services. Device verification uses Apple App Attest / DeviceCheck and Google Play Integrity / device recall. The United States has no single federal law covering personal information in general as Japan's Act on the Protection of Personal Information does; protection comes from sector-specific and state laws (see the U.S. system summary of Japan's Personal Information Protection Commission). The recipients publish these safeguards:

• Google (Gemini API): Under its paid API terms, prompts and responses are not used to improve its products and are processed under its data processing terms. Google specifies encryption, restricted personnel access, and confidentiality duties (Gemini API terms; data processing terms).
• Anthropic (Claude API): Commercial API inputs and outputs are not used for training by default. Anthropic publishes information on external audits and certifications covering the Claude API (commercial training policy; Trust Center).
• Cloudflare: Its data processing terms require technical and organizational measures against unauthorized access, alteration, and disclosure of personal data, with regular third-party audits (data processing terms).
• Apple (App Store): Apple limits access to personal data according to business need and uses administrative, technical, and physical safeguards (privacy policy).
• Google (Google Play): Google publishes encryption in transit and limits access to personal information to personnel who need it (privacy policy).

At first launch, the consent screen explains: “We use AI from Google in the United States to write the text and AI from Anthropic in the United States for safety checks. Your question and follow-up questions are therefore sent to both companies; the cards drawn are sent to Google.” A link to this policy appears below that text. We ask for your agreement to these two recipients, their location in the United States, and what each receives before you use AI. For follow-ups, Google also receives the original question and cards, the clarifying card and the original reading (temporarily cached or sent back from the journal). For the second-stage safety check, Anthropic receives the question for a reading or the new question for a follow-up (section 4).

The third parties with which this App shares user information are Google (Gemini) for text generation, Anthropic for safety checks, Apple and Google (Google Play) for distribution, purchases and device verification, Cloudflare for the server and database, and Discord for managing tester ticket grants when notifications are enabled. We have confirmed that the listed companies other than Discord, under their published privacy policies and terms of service, provide protection for user information that is the same as or equal to that stated in this policy and required by the App Store Review Guidelines.

10. Minimum age

The minimum age for using the App is 18, in line with the terms of the AI services used by the App. It is not for anyone under 18.

11. What a reading is

Readings are text written by an AI, based on traditional ways of reading tarot. They do not predict future events. The App gives no medical, legal, or financial advice. For anything concerning your health, money, or legal position, please consult a professional.

12. If you need someone to talk to

These helplines operate in Japan. Numbers were checked against their official sites on 13 September 2026.

• Yorisoi Hotline 0120-279-338 (from Fukushima Prefecture, 0120-279-226) — 24 hours
• #Inochi SOS 0120-061-338 — 24 hours, every day
• Inochi no Denwa (toll free) 0120-783-556 — daily 16:00–21:00; on the 10th of each month, 8:00 to 8:00 the next morning
• Childline (up to age 18) 0120-99-7777 — daily 16:00–21:00, closed 29 December to 3 January
• DV Consultation Plus (DV Soudan Plus) 0120-279-889 — phone line open 24 hours
• 24-hour Children's SOS Line 0120-0-78310 — 24 hours
• For a sudden medical emergency, call 119. At night, or when it feels like an overreaction, it is still fine to call.

13. Changes to this policy

This policy may be revised as the App changes. Significant changes will be announced through an App update and by changing the "last updated" date on this page. If a change would add a recipient or add to what is sent, this policy is updated first, and consent is requested again where needed.

14. Contact

• Provider: Takuto (independent developer)
• For the operator's address and other details, see About the operator.
• Email: iguchi.apps@gmail.com
• For the rules of use, see the Soiree terms of use.
• For how to use the App, see Soiree Support.

Your email address and message are used to answer your inquiry and investigate problems. We retain inquiry information for responding, investigating problems and necessary recordkeeping, and delete it when it is no longer needed. Contact the same email address to request deletion. If a legal retention obligation prevents deletion, we will explain why. Do not send passwords or card numbers.