Miravela — Privacy Policy
Effective date: October 6, 2026
This policy explains what data Miravela ("the app") handles, why, and what you can do about it. The app is published by Yabin Alejandro Lagunes Cuevas, trading as The Alchemist Code ("we", "us"), who is responsible for your data (the "controller"). Contact: contact@thealchemistcode.org.
The short version
- No sign-up. We never ask for your name or a password. The first time the app talks to our server, it creates an anonymous ID for your installation.
- Your readings, interpretations, journal notes, daily cards, memory summary and settings stay on your phone.
- When you ask for an AI reading, the app sends your question, the cards you drew and a few preferences to our server, which asks Anthropic's Claude to write the interpretation. We do not store your question or your reading on our server.
- The app only does this after you confirm you are 18 or older and give your explicit consent. Without it, the free daily card, the card library and the journal still work.
- Our server keeps only what it needs: your anonymous ID, usage counters, your verified Premium status, reports you send us, and the waitlist forms if you choose to fill them in.
- The app shows ads to free users and uses analytics and crash reporting from Google.
- Settings › Delete all my data erases everything on your phone and on our server.
Data stored on your phone
- Your readings: date and time, the spread, your question and intention, the cards and their orientation, the deck, the interpretation, any follow-up questions and answers, and your notes.
- Your daily ritual: the card of the day, your journal sentence and your weekly constellation (streak).
- Your memory summary (Premium, can be turned off): a short summary of the themes and cards in your recent readings, so new readings can take them into account. You can view, delete or turn it off in Settings.
- Settings: language, deck, reversed cards, the tone of the AI, reminder time, haptics, sound, reduced motion, and the dates when you confirmed you are 18+ and gave your AI consent.
- The Classic 1909 deck, if you choose it: the app downloads the card images from our website (see "Our website" below).
Daily reminders are scheduled on your phone; no server sends them. Share as image creates a picture with the cards and the headline of a reading (not your question) only when you tap it, and you choose where to send it.
Android backup: if backup to your Google account is turned on in your phone's settings, Android may include the app's data in your device backup so it comes back when you change phones. Android makes that backup and stores it encrypted in your Google account. We have no access to it.
What our server receives, and why
Our server runs on Google Firebase (Cloud Functions, Cloud Firestore, Authentication and App Check) in the United States.
| Data | When | Why | How long we keep it |
|---|---|---|---|
| Anonymous ID (Firebase Authentication) | The first time the app contacts our server | To apply usage limits, link your Premium purchase and protect the service from abuse | Until you delete your data, or 12 months after it was last used |
| App Check token (Google Play Integrity) | With every request | To check that requests come from the real app on a real device | We don't store it |
| Your reading request: your question, intention, chosen tone, the spread and cards, the app's language, your device's country setting and, with Premium memory on, your memory summary | Each AI reading or follow-up | To write your interpretation. The country is used to show helplines for your country | Not stored. Passed to Anthropic and discarded once your reading is delivered |
| A digest of your recent readings | Every 5 readings, only with Premium memory on | To refresh your memory summary, which is sent back to your phone | Not stored |
| Purchase details: Google Play purchase token, product, status and expiry date | When you buy or restore Premium, and from time to time after that | To confirm your Premium with Google Play, so your reading limits match your plan. One purchase unlocks one anonymous ID at a time | Until you delete your data, or 12 months after your ID was last used |
| Usage counters: how many readings of each type you requested per day and month | Each AI request | Free and fair-use limits | Until you delete your data, or 12 months after your ID was last used |
| Reports: the text of the interpretation you report, the reason and your optional comment | When you tap Report this interpretation | To review harmful or wrong outputs and improve safety (Google Play requires this button) | Up to 24 months, or until you delete your data |
| Waitlist (optional): language, topics, preferred format (call, video, chat) and price range; for tarot readers also your stage name, languages, years of experience, specialties, country and a link to your website or social profile; your email if you give it | Only if you fill in "I want a reading with a person" or "I'm a tarot reader" | To measure interest in readings with real readers and, if you gave your email, to tell you when they open in Miravela. Nothing else, no marketing | Until the reader service launches or you delete your data, and no longer than 24 months |
| Technical logs: time, function, result and error codes, and the IP address of the request | With every request | To keep the service running and secure | 30 days. Never the text of your question or reading |
If your question suggests you may be in crisis or thinking about self-harm, our server does not send it to the AI: the app shows a support message with helplines instead.
The AI: Anthropic as our processor
Interpretations are written by Claude, an AI model from Anthropic, PBC (United States). Anthropic processes your reading request on our behalf and only to generate the reply, under its commercial terms:
- It does not use this data to train its models.
- It deletes the requests and replies automatically within 30 days. If its safety systems flag a request as a possible violation of its usage policy, it may keep it for up to 2 years.
- It receives only the reading request and a pseudonymous code (a one-way hash of your anonymous ID) that helps it detect abuse. It does not receive your advertising ID, your email or your Google account.
Every interpretation is generated by AI and labeled as such. You are interacting with an AI system, not a person (as required by Article 50 of the EU AI Act). The AI can be wrong. Readings are for reflection and entertainment, not advice; see our Terms of Use.
Sensitive information and your consent
Tarot questions often touch on love, health or beliefs. Your questions may therefore reveal sensitive data, such as information about your health, your sex life or sexual orientation, or your religious or philosophical beliefs. We do not ask for this information, but you might write it.
That is why, before your first AI reading, the app asks for your explicit consent (a box that is not pre-ticked) to process your questions with AI for this sole purpose. This consent is our legal basis for sensitive data under Mexico's Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP, 2025), Article 9(2)(a) of the EU General Data Protection Regulation (GDPR) and Article 11(I) of Brazil's General Data Protection Law (LGPD).
You can withdraw your consent at any time: stop requesting AI readings, use Settings › Delete all my data (which also erases the consent record, so the app will ask again before any new AI reading), or write to us. Tip: you don't need names or personal details to get a good reading.
Data collected by third-party services
| Service | What it collects | Why |
|---|---|---|
| Google AdMob (ads, free users only, in the Journal and the Library) | IP address (used to estimate approximate location), Android advertising ID and app set ID, interactions with ads and the app, performance diagnostics | Showing ads, measuring them, preventing fraud |
| Google Analytics for Firebase | App-instance ID, advertising ID, approximate location derived from a masked IP address, screen views, sessions and purchase events | Understanding how the app is used |
| Firebase Crashlytics | Crash stack traces, device metadata at the time of a crash, app state, an installation identifier | Finding and fixing crashes |
| Firebase Remote Config | Country, language, time zone, OS and app version | Adjusting app settings remotely |
| Firebase Authentication, App Check, Cloud Firestore and Cloud Functions | Your anonymous ID, IP address and user agent, and a Play Integrity token | Running our server securely (see the table above) |
| Anthropic (Claude) | Your reading request, as described above | Writing your interpretation |
| Google Play Billing | Payment details, your purchase and your subscription status | Processing your Premium subscription or one-time purchase (we never see your card) |
All of this data is encrypted in transit. Each provider handles it under its own privacy policy:
- Google: https://policies.google.com/privacy
- How Google uses data from apps that use its services: https://policies.google.com/technologies/partner-sites
- Anthropic: https://www.anthropic.com/legal/privacy
Our website. When the app downloads the Classic 1909 deck from miravela.alekla.com, our web
host records standard access logs (IP address, time, file requested and user agent) for security.
Legal bases (EEA, UK and similar laws)
- To provide the app you asked for (contract): your reading requests, Premium verification and usage limits.
- Explicit consent: sensitive data in your questions, personalized ads (asked through Google's consent form), and the waitlist.
- Legitimate interests: security and abuse prevention, crash reports, analytics and handling your reports.
International transfers
Google and Anthropic process data in the United States and other countries. They do so under their data processing terms, which include safeguards such as the European Commission's standard contractual clauses. Under Mexican law, sending data to providers that process it on our behalf (encargados) does not require your consent.
Your choices and rights
- Delete everything: Settings › Delete all my data. See Delete your data.
- Memory: view, delete or turn it off in Settings.
- Ad personalization (EEA, UK, Switzerland): the app asks for your consent before showing personalized ads, and you can change your choice anytime in Settings › Ad privacy options.
- Advertising ID: reset or delete it in your Android settings under Privacy › Ads.
- Notifications: the daily reminder is optional; deny or revoke the permission anytime.
- Premium removes all ads.
- Subscriptions: Premium is sold as an annual or monthly subscription, both with a 7-day free trial, or as a one-time purchase. Google Play manages the subscription: cancel it anytime in the Google Play Store under Payments & subscriptions › Subscriptions. If you cancel before the free trial ends, you are not charged. Uninstalling the app or deleting your data does not cancel a subscription.
- Your rights: you can ask to access, correct or delete your data, object to or restrict its processing, take a copy of it, and withdraw consent (in Mexico, your ARCO rights). Write to contact@thealchemistcode.org. We answer within 20 days at most. Because the app has no sign-up, we can only find server data through the app itself or the email you gave on the waitlist; the in-app option is the fastest way.
- Complaints: you can also contact your data protection authority: in Mexico, the Secretaría Anticorrupción y Buen Gobierno; in the EU, your national authority (in Spain, the AEPD); in Brazil, the ANPD.
Security
Data travels encrypted. Each anonymous ID can only read its own data on our server. Our AI key is kept in Google Secret Manager, never in the app. Requests must come from the genuine app (App Check) and carry a valid sign-in token.
Adults only
Miravela is for people 18 and older. The app asks you to confirm your age. If we learn that a minor has used it, we will delete the server data linked to that installation.
Changes
If this policy changes, the new version will be posted at this address with an updated date.
Contact
Yabin Alejandro Lagunes Cuevas (The Alchemist Code), Mexico · contact@thealchemistcode.org