Privacy

The short version

Sortes keeps what you type and what the cards did, so a later reading can refer back to an earlier one. Nothing is sold, nothing is shared with advertisers, and there are no third-party trackers on this site.

You can export everything or delete everything from your account page, at any time, without asking us.

What is collected

Without an account: a functional cookie that identifies your browser, the questions you ask, the draws that result, and basic usage events (pages opened, buttons pressed).

With an account: your email address, a hash of your password if you set one, and your sessions. If you sign in with Google, Facebook or Apple, we receive your email and display name from them and nothing else.

If you choose to give it: date and time of birth, and a free-text note about yourself. Both are optional and used only to shape readings.

If you upload a palm photo: the image, its measured quality, and the fact that you consented. Photos of faces are refused by design.

For two weeks after a reading we also keep the exact text sent to the language model and the text it returned. This is how we find and fix broken readings; it is deleted automatically after 14 days, and it goes when you delete your account.

Payment details are never seen by us. When payments are switched on, they are handled by a merchant of record who collects them directly.

What is not collected

No advertising identifiers, no analytics from third parties, no fingerprinting. Your IP address is never stored as-is: it is converted to a one-way hash used solely to count requests against abuse limits.

The buttons for Google, Facebook and Apple are ordinary links. Their scripts are not loaded on this site, so those companies do not learn that you visited until you actually press one.

How long it is kept

Palm photos are deleted 30 days after upload, automatically.

Readings, questions and account data are kept until you delete your account. Deletion anonymises your records rather than leaving broken references, and removes your email, name and photos.

Usage events are kept in aggregate for product decisions.

Who else processes it

Hosting: a server in Germany. Email delivery: Resend. Reading text is generated by a language model accessed through an API provider; your question and the drawn symbols are sent for that purpose, and prompt logging is disabled.

Payments, when switched on, are processed by a merchant of record who acts as the seller of record.

DNS and network protection: Cloudflare.

Your rights

If you are in the EU or UK, you have the right to access, correct, export, delete and object. Export and deletion are self-service on your account page; for anything else, write to the address below.

The legal basis is performance of a contract for the service you asked for, your consent for optional data such as birth details and photos, and our legitimate interest in keeping the service running and free of abuse.

Children

Sortes is not intended for anyone under 16.