Aiden Buis makes Imaginalis in the Netherlands, trading as Freeman Studio, and is the controller of the data described here under the EU General Data Protection Regulation (GDPR). “We” in this policy means him. For anything about your data, write tohello@getimaginalis.com.

In short

What stays with you

Your journal. The cards you draw or log, your spreads, your notes and your lesson notes live on your phone. On an iPhone, if you use iCloud, they sync through your own iCloud account, in the app’s private database there. On Android, they go into Android’s own backup in your Google account, if backup is on. We have no access to either, and no servers of our own that hold a copy. There is no sync between an iPhone and an Android phone.

Spoken notes. When you speak a note, your phone turns your voice into text on the device, with the iPhone’s or Android’s own on-device speech recognition. The recording waits on your phone until its words are in, and the app then deletes it. Recordings never go to iCloud, into Android’s backup or to us.

Your chart. If you add your birth date, time and place under Your chart, the app keeps them in one file on your phone, outside iCloud and outside your backups, and sends them nowhere. On Android it stays out of the move to a new phone as well. The list of towns comes with the app, so your birthplace is never looked up online. “Delete my chart” removes the file.

Reminders are set on your phone. The app has no push notifications from a server. The answers you give in the introduction are stored on your phone too. The app sends some of them with the usage statistics below.

The lock. If you turn on the lock in the app’s settings, under Privacy, iOS checks your face or passcode itself, and Android checks your fingerprint, face or screen lock itself. The app only hears yes or no, never sees or stores your face or fingerprint data, and sends nothing anywhere.

Usage statistics

Unless you turn it off, the app sends short records of what happens in it to PostHog, our analytics service. A record says, for example, that someone opened the Journal, reached a step of the introduction, drew a card from their own deck, added a note, finished a lesson or started the free week. With it go the app and iOS or Android version, the kind of device, and a random ID the app makes when you first open it. PostHog keeps a profile for that ID: your answers in the introduction (such as how well you know tarot and what you hope to get from it), your reminder and drawing settings, whether you’re a member and on which plan, and the dates of your first card, note and lesson.

The app never sends the words you write, ask or say: no notes, no questions, no transcripts, no names of your own spreads, no search text. It never sends your birth details. It sends no name, no email address and no advertising ID, and it doesn’t record your screen. It asks PostHog not to work out your location, and leaves out your time zone. We have set PostHog to drop your IP address.

We use these statistics to find bugs and to see where people get stuck or give up, so we can make the app better. Our legal basis is our legitimate interest in improving Imaginalis (Article 6(1)(f) GDPR), balanced by the switch that lets you stop it at any time. No name or account stands behind the random ID, but under the GDPR the data still counts as pseudonymous: the ID ties your records together.

To turn it off, tap the gear on Today, then turn off Share usage statistics under Privacy. The app stops sending at once and forgets its random ID. If you turn it back on, it starts again with a new ID.

Purchases

On an iPhone you buy a membership from Apple, through the App Store. On Android you buy it from Google, through Google Play. Each handles the payment under its own privacy policy. We never see your card, your name or the email address of your Apple Account or Google account.

RevenueCat runs the membership for us. It receives the App Store or Google Play record of your purchases (which plan, when it started, renewals, a free week, a cancellation or a refund) together with a random ID it makes for your install. The app uses this to open the membership and to restore it on a new phone, and we use it to count trials, renewals and cancellations. Our legal basis is our contract with you (Article 6(1)(b) GDPR): the app needs this record to know you’ve paid.

iCloud and Android backup

On an iPhone, Apple stores your journal in your iCloud account under Apple’s privacy policy. We can’t read it. You can turn iCloud off for Imaginalis in your iPhone’s settings, and the journal then stays on that iPhone alone.

On Android, the app lets Android’s own backup copy your journal and settings to your Google account, under Google’s privacy policy, so they come back when you set up a new phone with the same account, or when you copy your data straight to a new phone. Android encrypts this backup end to end with your phone’s PIN, pattern or password. On a phone without a screen lock, the app leaves itself out of the backup altogether. Your chart, waiting recordings and the random ID for usage statistics are left out. We can’t read the backup. If you turn off backup in your phone’s settings, the journal stays on that phone alone.

Our mailing list

When you sign up on this site, we store your email address, the page you signed up on, what you signed up for (such as the letters) and when. Before we send you anything else, we send one mail asking you to confirm. Without that click we send nothing more, and the link stops working after 7 days. We note when we sent it, when you confirmed and when you left, as a record of your consent.

Every mail has a link to unsubscribe. We then keep your address marked as unsubscribed, so we never mail you by mistake. Ask, and we delete it altogether.

To stop people signing up others in bulk, we count sign-up attempts per connection. For that we may keep a scrambled form of your IP address (a hash that changes every day, so it can’t be traced back) for 48hours.

Our basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time by unsubscribing.

This website

Cloudflare hosts this site and handles the technical data any web server needs to send you a page, such as your IP address. The site sets no cookies and runs no analytics. If we start counting visits, we will say so here first.

The free tools work out your cards on the page you asked for. A birth date you enter there is used for that answer and not stored. A few choices, such as today’s card, are kept in your browser’s storage and never sent to us.

When you write to us

If you email us, from the app or elsewhere, we receive your address and whatever you write, and we use them only to answer you. Our mailbox is hosted by Fastmail.

Who processes data

These services process data on our behalf:

Transfers to the United States rely on the EU-US Data Privacy Framework or the EU’s Standard Contractual Clauses. Apple and Google are not our processors. Apple provides the App Store and iCloud to you directly, underApple’s privacy policy. Google provides Google Play and Android’s backup to you directly, under Google’s privacy policy.

How long we keep it

Your rights

Under the GDPR you can ask us for a copy of your data, and ask us to correct it, delete it, or limit how we use it. You can object to our use of it, and you can take data you gave us elsewhere. Write tohello@getimaginalis.com and we answer within a month.

The random ID isn’t shown in the app, so we can’t always tell which usage records are yours. Tell us what you’d like and we’ll do what we can. For a purchase record we may ask for your App Store receipt or Google Play order number, so we can find it. Some things you can do yourself:

You can also complain to a data protection authority: in the Netherlands theAutoriteit Persoonsgegevens, elsewhere in the EU the authority where you live.

Children

Imaginalis isn’t meant for children under 13, and we don’t knowingly collect data from them. If you think a child has sent us data, write to us and we’ll delete it.

Changes

When this policy changes, the new version goes here with a new date. If a change affects what the app sends, we also say so in the App Store and Google Play notes for that update. The terms cover the membership and the rest of the rules.