Expression Privacy Policy
Effective date: 2026-10-20
1. Who we are
Expression is run by Glaring Services Ltd, a company registered in England and Wales (company number 15337798), registered office 86-90 Paul Street, London EC2A 4NE, United Kingdom. We are the “controller” of your personal data: we decide how it is used. This policy covers the Expression app (Android and iOS) and our website www.expressiontarot.com.
Some features differ between app versions. Where they do, this policy says older versions (3.0.9 and earlier) or newer versions (released from October 2026).
Our Cookie Policy lists every cookie and tag on the website. Our Terms of Use and Subscription and refund terms explain the rest of the deal.
2. How to contact us
Email support@expressiontarot.com or write to the address above. We reply within one month.
- India grievance contact: Grievance Officer, support@expressiontarot.com.
3. The short version
- We collect what we need to give you your readings, horoscope, chart and journal, and to run your account and purchases.
- Your journal is yours: not used for ads, not sold, never shown to anyone else, never sent to an AI service.
- Most readings are not written by AI. One exception: in older versions, the Birth chart text is written by Google’s Gemini AI (section 9).
- On our website, nothing beyond what is strictly necessary and a cookie-free visit counter runs in the UK, EU, EEA and Switzerland until you say yes. In other places, analytics and ad measurement start on your first visit and you can switch them off at any time (section 11).
- We do not sell your personal data. Ad measurement through Meta and Google may count as “sharing” in some US states, and you can opt out (section 21).
- You can delete your account in the app at any time.
4. What we collect in the app
| Data | What it includes | Required? |
|---|---|---|
| Account | Name, email, sign-in method (email, Google, Apple or Facebook), account ID, join date, the network (IP) address reported at sign-up. If you signed up with email in an older version, also a mobile number, checked by an SMS code | Yes |
| Password | If you sign in with email, your password is held by Google Firebase Authentication. Older versions also send it to our server over an encrypted connection when you sign up or sign in; we do not store it | If you use email sign-in |
| Birth details | Birth date; birth time and place (a city you pick from our list or, in older versions, a place you type) | Birth date yes; the rest optional |
| Profile | Gender and goals if you give them, country, time zone, reading preferences, reminder times, horoscope focus area, the avatar you pick from our built-in set. In older versions also your state, city and Instagram username if you enter them | Optional, except country in older versions |
| Readings | Cards you drew and when, saved readings, the charts we make for you | Yes, for your history |
| Reading requests | The details a reading needs, such as your birth date, your name (for numerology), your time zone or today’s card | Yes, for that reading |
| Details about someone else | In older versions, a friend’s birth date, time and place if you make a birth chart for them. Only enter them with that person’s agreement | Optional |
| Journal | Words you pick, notes, mood, dates | Optional |
| Soulmate (newer versions, where available) | Your answers, and your portrait journal entries with their notes and moods. Kept on your phone only; we do not receive them | Optional |
| Purchases | Plan, price, store, dates, purchase ID, promo codes you redeem, whether you arrived through an invite or promo link, and your account email (passed to RevenueCat and AppsFlyer, see section 13). We never see card details | If you buy |
| Device and app | Device model, maker and name, system, app version, language, time zone, device identifiers (Android ID or Apple vendor ID), crash reports, app speed, a notification token and app install IDs. Older versions record some of these when the app is first opened, before you sign up. Newer versions also send an app-integrity check result (App Check) | Yes |
| Usage | Screens viewed and features used | See section 11 |
| Ad measurement | Which ad or link led to your install or purchase; advertising ID only where your device allows (iPhone: only if you allow tracking; Android: Expression does not request it) | See section 11 |
| Support | What you send us, including feedback and survey answers, with your email, plan and app version | If you contact us |
What stays on your phone (newer versions): offline copies of your readings and horoscope; changes waiting to sync; your festive region (worked out from your phone’s time zone, only to show seasonal moments such as Diwali or Halloween); your reminder schedule; Soulmate answers and portraits.
How the app talks to our servers: requests to our servers are signed in. Newer versions also add an app-integrity check to every request, make one start-up request that sends nothing personal, and download text updates from our own storage, checking each one before use. Older versions fetch affirmation text from a separate server without signing in; that request carries no personal data apart from your network address.
We do not use GPS location, contacts, camera or microphone. The app may ask for access to your photos or storage only to save an image you choose to download; we do not read or upload your photos.
5. What our website collects
The website is built to collect as little as possible. We group what it does into three consent classes (strictly necessary, analytics, ads measurement) plus a cookie-free visit counter. The Cookie Policy names every cookie.
| Class | What it collects | When it runs |
|---|---|---|
| Strictly necessary | Your cookie choice (stored as exp_consent) and the technical data any website server receives: your IP address, browser type, the page you asked for and the time. Cloudflare, which delivers our site, also uses your IP address to work out your country, so we can show the right cookie banner, and for security |
Always |
| Visit counting (no cookies) | Cloudflare Web Analytics counts page views and page speed. It sets no cookies and builds no profile of you. It sees the page, the referring site, browser and device type, and country | Always. It does not need your consent because it stores nothing on your device |
| Analytics | Google Analytics 4 (GA4): pages viewed, scrolling, clicks on links leaving our site, clicks on app-store buttons and calls to action, FAQ questions opened, browser and device type, approximate location (city-level, from your IP address, which Google does not keep), and where you arrived from. We do not send names, emails, birth details or anything you type into a form | UK, EU/EEA and Switzerland: only if you accept. Elsewhere: from your first visit until you opt out |
| Ads measurement | Meta Pixel and Meta Conversions API, and Google Ads tags (including remarketing): which pages you viewed, which button you pressed, whether you came from one of our ads (the ad click ID), a cookie ID, your IP address and browser details. We send these so we can see which ads work and show our ads to people who visited | UK, EU/EEA and Switzerland: only if you accept. Elsewhere: from your first visit until you opt out |
Before you choose, in the UK, EU, EEA and Switzerland. Google Consent Mode runs in a cookie-free mode. Until you choose, Google tags may send Google a basic signal (page, time, browser type, your consent state and approximate location from your IP address) with no cookies and no identifier on your device. We use it so Google can model the effect of ads without tracking you. If you reject, that is all that is sent.
The Get the app buttons. The App Store and Google Play buttons go through an AppsFlyer link (expressiontarot.onelink.me). When you tap one, AppsFlyer records the tap: your IP address, device type, the page and campaign tags in the link (for example pid=website), so that an install can be matched to the page that sent you, and so the app can open on the right screen. AppsFlyer places no script on our website. Tapping the button is your choice.
Calculators and forms on the site. Free calculators on the site run in your browser. What you type into them (such as a birth date) is not sent to us or to any analytics tool.
Emails you send us. If you email support@expressiontarot.com, we keep the message, your address and our reply to help you. Our support mailbox is hosted by Zoho in its UK data centre.
What the website does not do. It does not read your contacts, camera or microphone; it does not ask for your location; it does not put your journal, birth details, names or emails into any ad or analytics tool.
6. Sensitive information
A journal can reveal health, beliefs or relationships. We treat every entry as sensitive: we only store it and show it back to you, count your own patterns on screens only you see, never use it for advertising, never send it to an AI service, and never put it in notifications. We do not try to infer sensitive facts about you. We do not share journal text, birth details or readings with Meta, Google or any ad tool.
7. Why we use your data, and our legal basis (UK and EU GDPR)
| Purpose | Legal basis |
|---|---|
| Run your account, sign you in, keep offline copies in sync | Contract |
| Calculate your chart, horoscope, moon and number readings; draw and save readings | Contract |
| Birth chart text written by Gemini AI (older versions) | Contract |
| Store your journal | Contract, plus your explicit consent for anything sensitive you choose to write (Art. 9(2)(a)) |
| App purchases, restoring Premium, preventing billing errors | Contract; tax records: legal obligation |
| Confirming your age where the app asks for it | Legal obligation and legitimate interests (protecting children) |
| Reminders you set (newer versions schedule them on your phone; older versions store your reminder times on our server) | Consent |
| Server notifications you turn on (not sent at present) | Consent |
| Website: keeping the site working and secure, delivering pages, choosing the right cookie banner for your country, storing your cookie choice | Legitimate interests (a working, secure site); for the choice cookie, a legal obligation to respect your choice |
| Website: cookie-free visit counting and page speed (Cloudflare Web Analytics) | Legitimate interests (understanding how the site performs) |
| Website: Analytics (GA4) and Ads measurement (Meta, Google Ads) in the UK, EU/EEA and Switzerland | Consent. You can withdraw it at any time (section 11) |
| App: crash reports, app speed, security and app-integrity checks | Legitimate interests (a working, secure app) |
| App: analytics and ad measurement | Legitimate interests, with an easy opt-out (section 11) |
| Marketing push (“Offers and new features” in newer versions, off by default) | Consent |
| Support, legal requests, protecting our rights | Legitimate interests; legal obligation |
India: under the Digital Personal Data Protection Act we rely on your consent, or a legitimate use the Act allows. You can withdraw consent as easily as you gave it.
We make no decisions about you based only on automated processing that have legal or similarly significant effects. Your data never changes the price you see.
8. How personalization works
Calculated readings use your birth details, your name (for numerology) and the date; the same inputs give the same result. Card draws are random. Pattern insights count your own past draws and journal words. In newer versions, tap Why this appears on your horoscope and birth chart to see the inputs used.
9. AI
Readings. Most readings are not written by AI. They come from calculations, random draws and a library written by our team. One exception: in older versions, the Birth chart feature sends the first and last name on your profile, your birth date, birth time and the birth place you type to Google’s Gemini AI, which writes the chart text. If you make a chart for a friend, their birth details are sent, not their name. Google handles this data under the Gemini API terms, which may allow it to use the data to improve its services. We save the result in your account until you delete it. We never send your email or journal to an AI service. Newer versions calculate the birth chart without AI. If we add AI-written readings again, we will update this policy first and label AI-written text in the app.
Images. Some images in the app and on the website are made with AI tools, for example some photos of people on our Premium screens and pages. They show people who do not exist. Soulmate portraits are illustrations, captioned “Illustration from your chart. Not a real person.” We make the Premium-screen and website images before release; none of your data is sent to the tools.
10. Who can see your data inside the company
A few staff can access account data to give support, fix problems or meet the law. They read journal text only if you ask us to or the law requires it.
11. Analytics, ad measurement and your choices
In the app, Firebase Analytics, AppsFlyer and Meta App Events run as follows. You can limit them as described below.
| Tool | Company | What it does |
|---|---|---|
| Firebase Crashlytics, Performance Monitoring | Crash reports and app speed (always on; no journal text) | |
| Firebase Analytics | Usage statistics | |
| AppsFlyer | AppsFlyer Ltd | Measures installs and purchases from ads and links; makes invite links |
| Meta App Events | Meta | Measures ad results |
- iPhone: Apple’s tracking prompt controls the advertising ID (Settings → Privacy & Security → Tracking).
- Android: Expression does not request the advertising ID. You can delete or reset it in your Google settings.
- Anywhere: email us to object to analytics or ad measurement, and we will stop it for your account.
On the website, your choices depend on where you are. We take your country from your connection when the page is delivered (Cloudflare tells us the country; we do not keep it against your name).
| Where you are | What happens |
|---|---|
| UK, EU/EEA, Switzerland | A cookie banner appears on your first visit with equal buttons: Accept all, Reject all and Choose (Analytics, Ads measurement). Nothing beyond strictly necessary storage and the cookie-free visit counter runs until you choose. Rejecting is as easy as accepting |
| Everywhere else (including the US) | A notice bar tells you we use cookies. Analytics and ads measurement run from your first visit. You can switch them off at any time with Cookie settings in the footer. In the US, the footer also has Do not sell or share my personal information (section 21) |
| Global Privacy Control | We honour the GPC signal your browser sends as a request to switch off Ads measurement (and any “sale” or “sharing”), and we do not load those tags. In the UK, EU/EEA and Switzerland, Ads measurement is already off unless you turn it on yourself |
We remember your choice for 6 months, then ask again. Change your mind at any time with Cookie settings in the footer of any page, or delete the cookie or site data in your browser. You can also manage ad personalisation in your Google and Meta account settings.
12. Store disclosures
Our Google Play Data safety section and App Store privacy label describe the same data for the app. If you notice a difference, tell us and we will fix it.
13. Who we share data with
We do not sell your personal data. We use these companies to run Expression, under contracts that limit their use:
| Company | Purpose | Role |
|---|---|---|
| Google (Firebase, Google Cloud) | Hosting, database, file storage, sign-in, notifications, crash reports, app speed, analytics, app settings, app-integrity checks | Processor |
| Google (Gemini API) | Writes the Birth chart text in older versions (section 9) | Under Google’s API terms |
| Google (Analytics 4, Google Ads) | Website analytics and ads measurement, only where your choice allows (section 11) | Processor for Analytics; independent controller for its own ad products |
| Google Play, Apple App Store | App payments, refunds, in-app reviews and updates | Independent controllers |
| Cloudflare | Hosting and delivering our website (Cloudflare Pages), security, country detection for the cookie banner, cookie-free visit counting (Cloudflare Web Analytics) | Processor |
| RevenueCat | Managing subscriptions and Premium access (receives your account ID and email) | Processor |
| AppsFlyer | Install and purchase measurement in the app; the Get the app link (section 5); invite links (receives purchase details and your email from the app) | Processor |
| Meta | Ad measurement in the app and on our website (Meta Pixel and Conversions API); Facebook sign-in if you choose it | Independent controller for its ad products; joint controller with us for collection through the Pixel |
| Google, Apple, Facebook sign-in | Signing you in, if you choose that method | Independent controllers |
| Twilio SendGrid | Account and purchase emails | Processor |
| Zoho | Hosting our support mailbox (UK data centre) | Processor |
| Affirmation text server (older versions) | Sends affirmation text; receives only your network address | Service provider |
| Shopify | Our shop at shop.expressiontarot.com, under its own privacy notice | Separate service |
| Advisers, authorities | Where the law requires | As required by law |
Place names come from the public GeoNames database, kept on our own servers; nothing is sent to GeoNames.
14. International transfers
Some of these companies process data outside the UK and EU, including the United States and Israel. Where needed we rely on adequacy decisions, the EU-US Data Privacy Framework and its UK Extension where the company is certified, or Standard Contractual Clauses with the UK Addendum (or the UK International Data Transfer Agreement). Cloudflare delivers our website from servers close to you, in many countries. You can ask us for a copy of the safeguards for a transfer.
15. How long we keep data
| Data | How long |
|---|---|
| Account, birth details, readings, charts, avatar choice | While your account is open |
| Journal | Until you delete it or your account |
| Soulmate answers and portraits (app) | On your phone until you delete them or the app |
| Offline copies | Until replaced, or until you delete the app |
| Purchase records | 6 years, for tax law |
| Crash reports | Up to 90 days |
| App analytics | Up to 14 months |
| Website analytics (GA4) | 14 months |
| Website cookies | As listed in the Cookie Policy; your cookie choice lasts 6 months |
| Cloudflare Web Analytics | Counts only, with no identifier for you; held by Cloudflare under its terms with us |
| Website server logs | We keep none; Cloudflare keeps short-lived security logs under its terms with us |
| Meta and Google Ads data | Held by those companies under their own terms |
| AppsFlyer link-tap records | Held by AppsFlyer under its terms with us |
| Support emails | Up to 3 years after our last reply |
| Server notification logs | 30 to 45 days; your own send log keeps 7 days |
| Record that an account was deleted | Reasons chosen, comment, sign-in method, join month, date. No name, email, birth details or account ID |
16. Security
Encryption in transit for your personal data (older versions fetch public affirmation text without encryption; nothing personal is sent), access rules so only your own account can read your data, app-integrity checks, checked content updates in newer versions, and restricted staff access. Our website is served over HTTPS. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the regulator as the law requires.
17. Your rights
Under UK and EU GDPR you can ask us to:
- access your data and get a copy;
- correct it;
- delete it;
- restrict how we use it;
- move it to another service (portability);
- object to uses based on legitimate interests, including analytics and ad measurement; and
- withdraw consent at any time (this does not affect what we did before).
How:
- In the app, open Profile (older versions) or You (newer versions), then Settings: Edit profile to correct; Delete account (“Delete your account” in older versions); Notifications to turn off notifications or offers.
- On the website, use Cookie settings in the footer to change analytics and ad choices.
- For anything else, including a copy of your data or a request on the website, email support@expressiontarot.com.
We do not charge, and we reply within one month (we may extend by up to two months for complex requests, and will tell you). We may need to check it is really you before we act.
18. Deleting your data
- In the app: open You → Settings → Delete account. This removes your profile, birth details, charts, readings, journal, avatar, notification settings and other account records from our database, then your sign-in account.
- Not yet automatic: data held by RevenueCat, AppsFlyer, Google Analytics and Meta, and install and sign-up records kept by device (device details, notification token and, on some older records, your name and email). Email us and we will delete them and ask those companies to delete theirs.
- Journal only: email us.
- Soulmate: in the app it lives on your phone; clear it in the feature or delete the app.
- Subscriptions: deleting your account does not cancel a subscription. Cancel it in Google Play or the App Store first.
- Without the app: email support@expressiontarot.com from the address on your account with “Delete my account”, or use our delete account page.
- Website visitors without an account: we hold no profile for you. Delete the cookies in your browser; for any request about data linked to a cookie ID, email us.
- What we must keep: purchase records for tax (section 15).
19. Marketing
We send marketing only where you agreed. Newer versions have an Offers and new features switch in notification settings, off by default. We do not send marketing push to older versions. We do not send marketing by email, SMS or WhatsApp today; if we start, we will ask first, per channel, and every message will have an unsubscribe. Account and billing messages are not marketing. Showing you our ads elsewhere (remarketing through Google or Meta) is controlled by your choice in section 11, not by email consent.
20. Children’s privacy
Expression is not meant for anyone under 18, and the website is not directed at anyone under 18. We do not knowingly collect personal data from people under 18. If you believe someone under 18 has given us personal data, email support@expressiontarot.com. We will review it and may delete that data. If the person is under 13, we will delete it.
21. US state privacy rights
If you live in California or another US state with a privacy law, you can ask to know what we hold, to correct or delete it, to opt out of the “sale” or “sharing” of personal data, and to limit our use of sensitive data (we do not use it to infer things about you). You can appeal if we turn down a request: reply to our answer with “Appeal”. We will not treat you differently for using these rights. You can use an authorised agent; we may ask for proof.
Do we sell? No. We do not sell personal data for money.
Do we “share”? On our website, Meta Pixel and Google Ads tags, and in the app Meta and AppsFlyer, may pass identifiers and activity data to those companies for cross-context behavioural advertising. Under some US laws that counts as “sharing” or a “sale”. You can opt out:
- on the website, click Do not sell or share my personal information in the footer (it switches off Ads measurement, and does so for this browser);
- turn on Global Privacy Control in your browser: we treat it as a valid opt-out request;
- in the app, email support@expressiontarot.com with “Do not share” and, on iPhone, choose “Ask App Not to Track”.
| What we collect (last 12 months) | Source | Used for | Sold or shared? |
|---|---|---|---|
| Identifiers (IP address, cookie IDs, device IDs, email, account ID) | You; your device | Account, purchases, measurement | Shared (cookie IDs, IP, device IDs) with Meta and Google through ad tags, unless you opt out |
| Internet and app activity (pages, clicks, screens) | Your device | Analytics, ad measurement | Shared with Meta and Google through ad tags, unless you opt out |
| Commercial information (plan, purchases) | You; the stores | Billing, support | Not sold |
| Approximate location (country, city-level) | Your connection | Cookie banner, analytics | Not sold |
| Sensitive data (journal, birth details) | You | Running your readings | Not sold or shared; never sent to ad tools |
Categories of recipients are in section 13, purposes in section 7, and retention in section 15. We offer these rights to all US users. We reply to requests within 45 days; we may extend once by 45 days and will tell you.
22. Complaints
Please contact us first. You can also complain to the UK Information Commissioner’s Office (ico.org.uk), your EU data protection authority, the Data Protection Board of India, or your US state attorney general.
23. Changes to this policy
The date at the top shows the latest version. If we make a significant change, we will tell you in the app or on the website before it applies, and ask again for consent where needed.
| Version | Date | Change |
|---|---|---|
| 1.0 | 4 October 2026 | First Expression policy; replaces the previous website page |
| 2.0 | [set at publication] | Adds the new website (consent classes, cookie choices, new partners), US opt-out rights and the Global Privacy Control |