Privacy Policy

Vedic Cards by OccultSanctum

Last updated: March 2026

🔒 Your privacy matters to us. Vedic Cards collects only the minimum data necessary to operate your account, deliver learning content, and process payments. We do not collect birth data, location, photos, or any sensitive personal information.

1. Who We Are

Vedic Cards is operated by OccultSanctum ("we," "us," "our"), based in Perth, Western Australia, Australia. Vedic Cards is an educational platform for learning and practising Jyotish (Vedic astrology) through structured courses, an interactive card system, and AI-powered explanations.

For any privacy-related inquiries, contact us at occultsanctum@gmail.com.

2. What We Collect

Vedic Cards is intentionally minimal in the data it collects. We do not collect date of birth, time of birth, location, photographs, palm images, or any health-related information.

2.1 Account Information (Collected at Sign-Up)

Data	Source	Purpose
Name	Google / Apple sign-in	Account identification, display
Email address	Google / Apple sign-in	Account identification, transactional emails, support
Google ID / Apple User ID	OAuth providers	Unique account linking

We never store your Google or Apple password. Authentication is handled entirely by those providers.

2.2 Billing and Credits

Data	Purpose	Retention
Credit balance	Tracks available credits for course unlocks and AI explanations	Active while account exists
Transaction history	Billing records, dispute resolution	Retained for legal and accounting requirements
Payment processing	Handled entirely by Apple or Google — we never store card details	Per provider retention policy

2.3 Learning Progress

Data	Purpose
Course and lesson completion	Tracking your progress through the curriculum
Quiz scores and submissions	Assessing knowledge and awarding XP
XP, level, and streak data	Gamification and motivation features
Badges earned	Achievement tracking
Bookmarked lessons	Personal study organisation
Daily challenge history	Tracking challenge participation

2.4 Card Spreads and Practice

Data	Purpose
Saved card spreads	Your practice journal — review past draws and continue AI analysis
Topic selections	Contextualising your card practice

2.5 AI Interaction Data

When you request an AI-powered explanation or chat with the AI about a card spread, your queries, card data, and topic context are sent to Anthropic (Claude) via their API to generate responses. This data:

Is used solely to generate and return your explanation.
Is stored on OccultSanctum servers to provide your conversation history within the App. Conversation data is retained while your account is active and permanently deleted upon account deletion.
Is processed by Anthropic under their own privacy policy and API terms.
Is not used to train AI foundation models per Anthropic's current API terms.

See Anthropic's Privacy Policy for full details.

2.6 Automatically Collected Data

When you use the app, we may automatically collect:

Session tokens — to keep you signed in. No tracking or advertising cookies are used.
Basic server logs — IP address, request timestamps, and device type. Used for security monitoring and debugging. Rotated and deleted every 30 days.
Device information — operating system and app version, used to ensure compatibility and diagnose issues.
Push notification tokens — only if you opt in to notifications. Used solely to deliver notifications you have requested.

3. How We Use Your Information

We use your data exclusively for:

Account management — authentication, credit balance, profile display.
Learning delivery — tracking course progress, lesson completion, quiz scores, XP, levels, badges, and streaks.
Card practice — saving spreads, generating AI explanations, providing practice history.
Billing — processing credit purchases and maintaining transaction records.
Transactional communications — payment receipts, credit notifications.
Security and fraud prevention — detecting unauthorised access and payment abuse.
App improvement — anonymised usage patterns to improve content and performance.
Legal compliance — meeting applicable regulatory obligations.

We do not use your data for: targeted advertising, selling to third parties, training AI models, or building unrelated profiles.

4. Third-Party Services

We share limited data with the following providers, solely for the purposes stated:

Service	Provider	Purpose
Authentication	Google, Apple	Account sign-in
AI Explanations	Anthropic	Generating AI-powered card explanations
Payments	Apple In-App Purchase, Google Play Billing	Credit purchases
Email	Resend	Receipts, notifications
Hosting	Render	Running the platform

Each provider operates under their own privacy policy. We do not control how these providers handle data once transmitted to them.

5. Data Storage and Security

Your data is stored on servers managed by Render, Inc. We implement:

Encrypted data transmission (HTTPS/TLS) for all communications.
Secure authentication via OAuth 2.0 and Sign in with Apple — we never store your password.
Server-side session management with secure, httpOnly cookies.
Payment processing handled by PCI-DSS compliant providers — we do not store card details.
Access controls limiting data access to authorised personnel only.
Regular security monitoring and log review.

In the event of a data breach likely to result in risk to your rights, we will notify affected users by email within 72 hours and, where required, notify the relevant data protection authority.

6. Data Retention

Account data — retained as long as your account is active.
Learning progress — retained as long as your account is active (XP, lessons, quiz scores, badges, streaks).
Saved card spreads and AI conversations — retained as long as your account is active.
Transaction history — retained for a minimum of 7 years for legal and accounting compliance.
Server logs — rotated and deleted every 30 days.
Session tokens — expire upon sign-out or after a period of inactivity.
Push notification tokens — retained while you have the app installed; removed upon uninstallation or opt-out.

Upon account deletion, all personal data — including your profile, learning progress, saved spreads, AI conversation history, and credit records — is permanently and immediately deleted. You may rejoin at any time as a new user.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — request correction of inaccurate data.
Deletion — request deletion of your account and associated data.
Portability — request your data in a portable format where applicable.
Objection — object to certain processing activities.
Opt out of push notifications — via your device Settings at any time.

To exercise any of these rights, contact us at occultsanctum@gmail.com. We will respond within 30 days.

8. Children's Privacy

Vedic Cards is intended for users aged 17 and over. We do not knowingly collect personal information from anyone under 13. If we become aware that a child under 13 has provided personal information, we will delete it promptly. If you believe a child has provided us with their data, please contact us at occultsanctum@gmail.com.

9. Australian Privacy Act Compliance

We comply with the Australian Privacy Principles (APPs) as set out in the Privacy Act 1988 (Cth). Australian residents can contact the OAIC at oaic.gov.au if they believe their privacy has been breached.

10. International Users

OccultSanctum is based in Australia and operates under Australian Privacy Law. If you access Vedic Cards from outside Australia, your data may be transferred to and processed in Australia and other countries where our service providers operate. By using the app, you consent to this transfer.

Users in the European Economic Area (EEA) or United Kingdom have additional rights under GDPR/UK GDPR, including the right to lodge a complaint with your local data protection authority.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For significant changes, we will notify you via email or an in-app notice. Your continued use of Vedic Cards after changes are posted constitutes acceptance of the updated policy.

12. Contact Us

OccultSanctum — Privacy Enquiries
Perth, Western Australia, Australia
occultsanctum@gmail.com

For unresolved complaints, Australian residents may contact the OAIC at oaic.gov.au/privacy/privacy-complaints.