1. Who we are
Arcana Express is provided by Boreal Tech AB, Gothenburg, Sweden. We are the data controller for the information described here.
Contact for any privacy question, or to exercise the rights in section 8: privacy@arcanaexpress.se.
2. What we collect
2.1 What you give us
| Data | Where it goes | Why |
|---|---|---|
| Email address | Supabase Auth; mirrored to profiles.email |
To create your account, sign you in, and send password resets. It is your login identifier. |
| Password | Supabase Auth only | Stored as a salted hash. It is never stored in readable form and nobody at Arcana Express can read it. |
| Display name | profiles.display_name |
Shown to you in the app's greeting and profile. |
| Date of birth | profiles.date_of_birth |
Used to derive your Western and Chinese zodiac signs, which the app's content is built around. It is not used to verify your age. |
| Gender | profiles.gender |
Collected during profile setup. |
| Questions you ask a reading | readings.question |
Saved with the reading so your past readings stay meaningful when you look back at them. |
| Journal notes on a lucky card | lucky_card_draws.note |
Saved so your card history keeps the thought you wrote with it. |
| Coloring artwork you save | The private artworks storage bucket, plus a saved_artworks row holding the name you gave it |
So your finished artwork is still there next time you open the app. |
Free text you write is personal to you. The question you ask a reading and the note you keep with a lucky card are the two places in this app where you write in your own words, and people write things there they would not write elsewhere. They are stored under the same row-level access rules as everything else — only your account can read them — and they are erased when you delete your account.
2.2 What use of the app produces
- Readings and the cards they drew (
readings,reading_cards) — the spread you chose, when, and which cards came up, so your past readings list works. - Daily lucky card draws (
lucky_card_draws) — one card per day, kept as your card history. - Your streak and daily activity (
user_streaks,daily_activity) — which days you were active, so the app can show a streak. - Coloring template events (
coloring_template_events) — when a template is opened, downloaded or shared, recorded against your account so we can tell which templates are worth making more of. - Credit balance and its full history (
wallets,credit_transactions) — every credit you buy, spend or are granted, as an append-only ledger. This is the record that proves your balance is correct, so it is written for every movement and never rewritten. - Purchases and subscriptions (
store_purchases,subscriptions,owned_special_games) — what you bought, when, on which platform, the store's transaction identifiers, and the raw purchase notification the store sent us, which we keep as evidence of the transaction.
2.3 What we do not collect
These are worth stating plainly, because many apps in this category do collect them:
- No profile photo ever leaves your device. The app lets you pick one during profile setup, but the image is held only in the app's memory on your phone and is never uploaded — there is no avatar file on our servers for any user. (See "Known gap" below.)
- No advertising identifier and no advertising SDK. Nothing in this app is used to target ads.
- No third-party analytics SDK. There is no Google Analytics, no Firebase Analytics, no Amplitude, no Mixpanel and no equivalent. The only usage data we hold is the app's own rows listed in 2.2.
- No location data, of any precision.
- No contacts, calendar, microphone or call data.
- No health data.
- We never see your card number. Payment is handled entirely by Google Play; we receive only confirmation that a purchase succeeded and the store's identifiers for it.
We do not collect a profile photo. Earlier builds let you pick one, but the image was never uploaded and never appeared on your profile, so the feature has been removed for this release rather than left to look as though it worked. The app therefore does not ask for camera access at all.
3. Why we are allowed to process it (GDPR legal bases)
| What | Basis |
|---|---|
| Account, authentication, and the app's core features (readings, lucky cards, streak, coloring, journal) | Performance of a contract — you cannot have the service without them. |
| Purchases, credits, subscriptions and their ledger | Performance of a contract, and legal obligation for the parts we must keep for accounting and tax. |
| Date of birth, gender | Performance of a contract — the zodiac content is the product. |
| Coloring template events | Legitimate interests — understanding which templates are used, so the catalog improves. You may object; see section 8. |
4. Who else receives it
We do not sell your personal data and we do not share it for advertising. These are the only recipients, each a processor acting on our instructions:
| Recipient | What they receive | Purpose |
|---|---|---|
| Supabase | Everything in section 2 — they host our database, authentication and file storage | Hosting. Our project runs in Supabase's eu-west-1 (Ireland) region, so this data is stored in the EU. |
| RevenueCat | Your account's internal user identifier (a random UUID) and your purchase and subscription events. Not your email, name, date of birth, or anything you write in the app. | Validating purchases with the store and telling our server what you are entitled to. |
| Google Play Billing | Your payment, handled under Google's own terms | Taking payment and issuing refunds. |
Some of these providers are US companies and may process data outside the EU/EEA. Where that happens, transfers rely on the European Commission's Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.
5. How long we keep it
Your account data is kept for as long as your account exists. When you delete it, section 6 applies.
Your lucky-card history is not deleted on a schedule. Without a paid tier the app shows you the last 7 days of it, but the older entries are retained on your account, not erased — they become visible again if you buy a plan that extends the window. We say this explicitly because a display limit is easy to mistake for deletion, and it is not.
6. Deleting your account
You can delete your account from inside the app: Profile → Delete Account. It takes effect immediately and does not need a support request.
What is erased:
- Your email address, replaced with a non-identifying placeholder in both the authentication record and your profile.
- Your display name, date of birth and gender.
- Your readings and the questions you asked them.
- Your lucky card draws and every journal note in them.
- Your saved coloring artwork — both the database rows and the image files themselves, removed from storage.
- Your streak and activity history.
- Your account is then blocked, so it cannot be signed into again.
What is kept, and why: records of purchases, credits, and subscriptions are retained. We are legally required to keep transaction records for accounting and tax, and they are what allows a refund or a chargeback to be handled after an account is gone. They are kept de-identified — the account they belonged to no longer carries your name, email, date of birth or anything you wrote, so what remains is a financial record, not a profile of you. This is a deliberate design decision, not an oversight: deleting an account destroys the personal data and preserves the accounting.
If you have an active subscription, deleting your account does not cancel it. Only the store can stop a store subscription. Cancel it in the Google Play Store first, or you may keep being charged for an account you no longer have. The app warns you about this before you confirm.
If you cannot open the app, you can still ask us to delete your account by writing to privacy@arcanaexpress.se from the address the account uses. See our account-deletion page for what is erased, what is kept for accounting and tax reasons, and how long that takes.
7. Security
- Every table holding your data is protected by row-level security, evaluated by the database itself, so a request can only ever read rows belonging to the account that made it — the check does not depend on the app asking correctly.
- Saved artwork lives in a private storage bucket whose access policy checks the folder against your own account identifier. Files are not publicly linkable.
- Traffic between the app and our servers is encrypted with TLS.
- Passwords are stored only as salted hashes.
- Administrative actions on user accounts are recorded in an audit log naming who did what and when.
No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal data, we will notify the Swedish supervisory authority (IMY) and, where the risk to you is high, you directly — within the deadlines the GDPR sets.
8. Your rights
If you are in the EU/EEA or the UK, you have the right to: access a copy of your data; correct it; erase it (section 6 does this immediately); restrict or object to its processing, including the legitimate-interests processing in section 3; portability, receiving your data in a machine-readable form; and to withdraw consent where processing rests on consent.
To exercise any of these, write to privacy@arcanaexpress.se. We will respond within one month.
You also have the right to complain to a supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY) — imy.se.
9. Children
Arcana Express is not for children under 13. We do not knowingly collect personal data from anyone under 13, and you must be 13 or older to create an account.
Thirteen is the age below which, in Sweden, a parent or guardian must consent before a child's personal data can be processed. We ask for a date of birth during sign-up because the zodiac content depends on it, and that is the only thing it is used for.
If you believe a child under 13 has created an account, write to privacy@arcanaexpress.se and we will delete it.
10. Permissions the app asks for
| Permission | What it is used for |
|---|---|
| Photos / Storage (write) | Saving your finished coloring artwork to your phone's gallery, when you ask for it. On Android 9 and below this requires the storage permission; from Android 10 it does not. |
| Internet / network state | The app's content and your account live on our servers. |
The app does not request the camera, location, contacts, microphone or any other sensitive permission.
11. Changes
If we change this policy we will update the effective date at the top, and — for any change that materially affects what we collect or who receives it — tell you in the app before it takes effect.
12. Contact
privacy@arcanaexpress.se Boreal Tech AB, Gothenburg, Sweden