1. 定义

在本政策中，「TarotDome」「我们」指 TarotDome 穹顶塔罗网站（tarotdome.com）的运营者；「服务」指本网站及其提供的全部功能；「你」指访问或使用服务的个人；「个人信息」指与已识别或可识别的自然人有关的任何信息。

使用服务，即表示你已阅读并理解本政策。如你不同意本政策，请停止使用服务。

2. 我们收集的信息

我们只收集提供服务所必需的信息，具体包括：

• 账号信息：注册时提供的电子邮箱地址和密码。密码仅以经过加盐的单向哈希形式保存，我们无法得知你的原始密码。
• 第三方登录信息：当你选择使用 Google 登录时，我们从 Google 获取你的账号标识、姓名和电子邮箱地址。
• 身份验证信息：发送到你邮箱的一次性验证码，以及用于保持登录状态的会话凭证（仅保存其哈希值）。
• 使用情况信息：解读服务的使用次数，以及为保障安全和防止滥用而处理的网络地址（IP 地址）、浏览器类型、设备信息、访问时间等技术信息。
• 你提交的解读内容：你输入的问题，以及抽到的牌和所选牌阵。这些内容用于即时生成解读，详见下文「人工智能解读」。
• 你与我们的通信：你通过电子邮件联系我们时提供的信息。

部分信息仅保存在你自己的设备上（浏览器本地存储），包括抽牌记录、生日、语言偏好和今日之牌的翻开状态。这些信息不会上传到我们的服务器，你可以随时通过清除浏览器数据将其删除。

3. 我们如何使用信息

• 提供、运营和维护服务，包括生成塔罗解读、管理账号和登录；
• 计算和执行免费额度及使用限制；
• 发送登录验证码、账号安全通知等与服务相关的必要邮件；
• 保障服务和用户的安全，识别、预防和处理欺诈、滥用、攻击及其他违规行为；
• 分析整体访问情况，以改进网站的性能和体验（使用不依赖 Cookie 的聚合统计）；
• 遵守适用的法律法规、响应合法的政府或司法要求，以及维护我们的合法权利。

我们不会将你的个人信息用于广告投放，也不会基于你的个人信息进行对你产生法律效力或类似重大影响的自动化决策。

4. 处理信息的法律依据

如你位于欧洲经济区、英国或其他有类似要求的地区，我们依据以下法律基础处理你的个人信息：为履行与你订立的合同（向你提供服务）所必需；为实现我们的合法利益（例如保障服务安全、防止滥用、改进服务），且该利益不凌驾于你的权利之上；为履行法律义务；以及在适用情形下，基于你的同意。你可以随时撤回同意，但撤回不影响此前基于同意进行的处理。

5. 人工智能解读

当你请求 AI 解读时，我们会将你输入的问题、抽到的牌及牌阵发送给我们的人工智能服务提供商，以生成解读文本。发送的内容不包含你的账号信息。我们不在服务器上存储这些问题和解读，也不将其写入日志。

人工智能服务提供商会按照其自身的条款和隐私政策处理上述内容。为保护你的隐私，请不要在问题中填写身份证号、联系方式、健康状况等敏感个人信息或他人的个人信息。

6. 我们如何共享信息

我们不出售你的个人信息，也不会为跨情境行为广告的目的共享你的个人信息。我们仅在以下情形下共享信息：

• 法律要求：为遵守法律法规、法律程序或政府的强制性要求；
• 保护权利与安全：为保护 TarotDome、用户或公众的权利、财产或人身安全，在法律允许的范围内；
• 业务变更：如发生合并、收购、资产转让等交易，个人信息可能作为交易的一部分被转移，我们会要求接收方继续遵守本政策或向你另行告知；
• 经你同意：在获得你同意的其他情形下。

7. 信息的跨境传输

我们的服务提供商可能在你所在国家或地区以外处理和存储信息，包括美国、中国及其他国家或地区，这些地方的数据保护法律可能与你所在地不同。我们会依据适用法律采取适当措施（例如与服务提供商签订数据处理条款），确保你的个人信息得到与本政策一致的保护。

8. 信息的保存期限

我们仅在实现本政策所述目的所需的期限内保存个人信息，法律另有要求的除外：

• 账号信息：在你的账号存续期间保存；你删除账号后，我们会在合理期限内删除或匿名化处理，法律要求保留的除外；
• 验证码：10 分钟内失效，并在之后自动删除；
• 会话凭证：最长 30 天，或在你退出登录时失效；
• 使用次数和防滥用计数：按日计算，约两天后自动删除；
• 解读问题和内容：不在我们的服务器上保存。

9. 信息安全

我们采取合理的技术和管理措施保护你的个人信息，包括全站 HTTPS 加密传输、密码和会话凭证的哈希存储、访问控制、请求频率限制，以及数据最小化原则。但请理解，任何互联网传输或存储方式都无法保证绝对安全。

10. 你的权利

根据你所在地的法律（例如欧盟《通用数据保护条例》、英国数据保护法、美国加利福尼亚州消费者隐私法、中华人民共和国《个人信息保护法》等），你可能享有以下权利：

• 访问和获取你的个人信息副本；
• 更正不准确或不完整的个人信息；
• 删除你的个人信息及注销账号；
• 限制或反对我们对你的个人信息进行某些处理；
• 数据可携带；
• 撤回你此前作出的同意；
• 向你所在地的数据保护监管机构投诉。

如需行使上述权利，请使用你的注册邮箱发送邮件至 privacy@tarotdome.com。为保护你的账号安全，我们可能需要核实你的身份。我们会在适用法律规定的期限内答复，且不会因你行使权利而歧视你。

11. Cookie 与类似技术

我们仅使用网站运行所必需的 Cookie 和浏览器本地存储，不使用广告 Cookie 或跨站追踪技术。访问统计采用不设置 Cookie 的聚合方式。

由于上述 Cookie 均为提供服务所必需，禁用它们可能导致登录或解读功能无法正常使用。

12. 未成年人

服务不面向 13 周岁以下的儿童（或你所在地法律规定的更高年龄）。我们不会在知情的情况下收集儿童的个人信息。未满 18 周岁的用户应在父母或监护人的同意和指导下使用服务。如你认为我们无意中收集了儿童的个人信息，请联系我们，我们会尽快删除。

13. 第三方网站和服务

服务中可能包含指向第三方网站或服务的链接（例如社交分享）。我们不对第三方的内容和隐私做法负责，建议你在使用前阅读其隐私政策。

14. 本政策的变更

我们可能不时更新本政策。更新后的政策将发布在本页面，并更新顶部的生效日期；如有重大变更，我们会通过网站显著位置或电子邮件等方式提前告知。变更生效后你继续使用服务，即表示你接受更新后的政策。

15. 联系我们

如你对本政策或你的个人信息有任何疑问、意见或请求，请通过电子邮件联系我们：privacy@tarotdome.com

1. Definitions

In this Policy, "TarotDome", "we", "us" and "our" refer to the operator of the TarotDome website (tarotdome.com); the "Service" means the website and all features it provides; "you" means any individual who accesses or uses the Service; and "Personal Information" means any information relating to an identified or identifiable natural person.

By using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with it, please do not use the Service.

2. Information We Collect

We collect only the information needed to provide the Service:

• Account information: the email address and password you provide when you register. Passwords are stored only as salted one-way hashes; we never know your actual password.
• Third-party sign-in information: if you choose to sign in with Google, we receive your Google account identifier, name and email address.
• Authentication data: one-time verification codes sent to your email, and session credentials that keep you signed in (stored only as hashes).
• Usage information: how many readings you have used, and technical information processed for security and abuse prevention, such as IP address, browser type, device information and access times.
• Reading content you submit: the question you enter and the cards and spread drawn. This is used to generate your reading in real time; see "AI Readings" below.
• Communications: information you provide when you contact us by email.

Some information is kept only on your own device (browser storage), including your reading history, birthday, language preference and card-of-the-day status. It is not uploaded to our servers, and you can delete it at any time by clearing your browser data.

3. How We Use Information

• To provide, operate and maintain the Service, including generating tarot readings and managing accounts and sign-in;
• To calculate and apply free allowances and usage limits;
• To send verification codes, security notices and other essential service emails;
• To protect the Service and its users, and to detect, prevent and respond to fraud, abuse, attacks and other violations;
• To understand overall traffic and improve performance and experience, using aggregated, cookie-free analytics;
• To comply with applicable law, respond to lawful requests from authorities, and establish or defend our legal rights.

We do not use your Personal Information for advertising, and we do not make automated decisions about you that produce legal or similarly significant effects.

4. Legal Bases for Processing

If you are in the European Economic Area, the United Kingdom or another region with similar requirements, we rely on the following legal bases: performance of our contract with you (providing the Service); our legitimate interests (such as keeping the Service secure, preventing abuse and improving the Service), where these are not overridden by your rights; compliance with legal obligations; and, where applicable, your consent. You may withdraw consent at any time without affecting processing carried out before withdrawal.

5. AI Readings

When you request an AI reading, we send the question you entered and the cards and spread drawn to our artificial intelligence service provider to generate the reading. This content does not include your account information. We do not store these questions or readings on our servers or record them in logs.

The AI provider processes this content under its own terms and privacy policy. To protect your privacy, please do not include sensitive personal information, such as identification numbers, contact details or health information, or anyone else's personal information, in your questions.

6. How We Share Information

We do not sell your Personal Information, and we do not share it for cross-context behavioral advertising. We share information only in the following cases:

• Legal requirements: to comply with laws, legal processes or mandatory requests from public authorities;
• Protection of rights and safety: to protect the rights, property or safety of TarotDome, our users or the public, as permitted by law;
• Business transfers: in connection with a merger, acquisition or sale of assets, in which case we will require the recipient to honour this Policy or notify you;
• With your consent: in any other case where you have agreed.

7. International Data Transfers

Our service providers may process and store information outside your country or region, including in the United States, China and other jurisdictions, whose data protection laws may differ from those where you live. Where required by applicable law, we take appropriate measures, such as data processing terms with our providers, to protect your Personal Information consistently with this Policy.

8. Data Retention

We keep Personal Information only for as long as necessary for the purposes described in this Policy, unless a longer period is required by law:

• Account information: for as long as your account exists; after you delete your account, we delete or anonymise it within a reasonable period, unless we are legally required to keep it;
• Verification codes: expire after 10 minutes and are deleted automatically afterwards;
• Session credentials: up to 30 days, or until you sign out;
• Usage and abuse-prevention counters: kept per day and deleted automatically after about two days;
• Reading questions and content: not stored on our servers.

9. Security

We use reasonable technical and organisational measures to protect your Personal Information, including HTTPS encryption across the site, hashed storage of passwords and session credentials, access controls, rate limiting and data minimisation. However, no method of transmission or storage over the internet is completely secure.

10. Your Rights

Depending on where you live (for example under the EU General Data Protection Regulation, UK data protection law, the California Consumer Privacy Act, or the Personal Information Protection Law of the People's Republic of China), you may have the right to:

• access your Personal Information and obtain a copy;
• correct inaccurate or incomplete information;
• delete your Personal Information and close your account;
• restrict or object to certain processing;
• data portability;
• withdraw consent you have given;
• lodge a complaint with your local data protection authority.

To exercise these rights, email privacy@tarotdome.com from the address associated with your account. We may need to verify your identity before acting on a request. We will respond within the time required by applicable law, and we will not discriminate against you for exercising your rights.

11. Cookies and Similar Technologies

We use only cookies and browser storage that are strictly necessary for the Service to work. We do not use advertising cookies or cross-site tracking, and our analytics are aggregated and do not set cookies.

Because these cookies are necessary to provide the Service, disabling them may prevent sign-in or readings from working properly.

12. Children's Privacy

The Service is not directed to children under 13 (or a higher age where required by local law), and we do not knowingly collect their Personal Information. Users under 18 should use the Service only with the consent and guidance of a parent or guardian. If you believe we have inadvertently collected a child's Personal Information, please contact us and we will delete it promptly.

13. Third-Party Websites and Services

The Service may contain links to third-party websites or services, such as social sharing. We are not responsible for their content or privacy practices, and we encourage you to read their privacy policies.

14. Changes to This Policy

We may update this Policy from time to time. The updated version will be posted on this page with a new effective date, and for material changes we will give advance notice through a prominent notice on the Service or by email. Your continued use of the Service after the changes take effect constitutes acceptance of the updated Policy.

15. Contact Us

If you have any questions, comments or requests about this Policy or your Personal Information, please contact us at privacy@tarotdome.com.