Arcana — Privacy Policy
Effective date: August 27, 2026 · Last updated: August 27, 2026
1. Who we are
Arcana is a mixed-reality astrology, tarot and contemplative-practice application for Meta Quest headsets, published by Quixotical, LLC ("we", "us").
- Quixotical, LLC is based in the United States. A postal address for legal correspondence is available on written request via the privacy contact below.
- Privacy contact: veronica@quixotical.world
This policy explains what Arcana collects, why, who else receives it, how long it is kept, and how you can have it deleted.
2. The short version
- Arcana asks for your name, birth date, birth time and birth place, because an astrological chart cannot be calculated without them. This is the core of the app.
- Readings are generated by third-party AI services. Your birth details, the questions you ask, and your voice are sent to those services to produce them.
- If you choose to upload a photo of your face, that photo is sent to a third-party AI image service so you can appear in your own tarot imagery. This is entirely optional and Arcana works fully without it.
- We do not sell your data, do not show advertising, do not use third-party analytics or tracking SDKs, and do not build advertising profiles.
- Your voice notes — the in-app journal — never leave your headset.
3. What we collect, and why
3.1 Information you give us
| What | Why | Where it goes |
|---|---|---|
| First name, last name, preferred name | Addressing you, and labelling your chart | Stored in our database; included in reading requests |
| Birth date, birth time, birth place (and the latitude, longitude and time zone we derive from it) | Required to calculate an astrological chart — the app's core function | Stored in our database; sent to AI services to generate readings |
| Current city (and derived latitude/longitude) | Local sky positions, planetary hours, and timing suggestions | Stored in our database; sent to AI services |
| Your stated experience level with astrology | Pitching explanations at the right level | Stored in our database |
| Questions, intentions and affirmations you speak or type | Generating the reading you asked for | Sent to AI services |
| Your voice, while a voice reading is active | Speech recognition and live conversation | Sent to AI services (see §4) |
| A photo of your face — optional | Placing you inside your own tarot card imagery | Uploaded from your phone, downloaded to your headset, then deleted from our servers; sent to an AI image service each time a personalized card is generated |
| An email address — optional | Only if you ask us to email you the photo-upload link instead of scanning a QR code | Passed to our mail-sending function to send that one message |
3.2 Information from Meta
When you run Arcana on a Meta Quest headset, we receive the following through the Meta Platform SDK:
| What | Why |
|---|---|
| Your app-scoped user ID — an identifier unique to Arcana. It is not your Meta account ID and cannot be used to identify you in other apps | Confirming you own Arcana, and attributing and restoring in-app purchases |
| Your age group — a single bucket: child, teen, or adult | Deciding whether real-money purchase options are shown. If you are not an adult, purchase options are hidden. Nothing else in the app changes |
| Purchase records for Arcana — including, if you subscribe, your subscription status and billing-period start and end times | Delivering what you bought, keeping subscriber features unlocked while your subscription is active, restoring access after a reinstall or on a new device, and recovering purchases interrupted by a crash or a closed app |
We do not request or receive your Meta username, profile photo, friends list, or any other Meta profile information. Your age group is evaluated on the headset and is never stored, logged, or transmitted onward.
3.3 Information collected automatically
| What | Why | Note |
|---|---|---|
| Approximate location derived from your IP address | Pre-filling your current city so you do not have to type it | See §7 |
| Basic technical error information | Diagnosing crashes | Not tied to your identity |
We do not use cookies in the app, advertising identifiers, cross-app tracking, or any third-party analytics SDK.
3.4 Information that never leaves your headset
- Voice notes recorded with the journal feature — audio and transcripts are stored only in Arcana's private storage on your device.
- Your uploaded face photo, after your headset has downloaded it.
- Your practice history, collected items, and in-app currency balance.
Uninstalling Arcana deletes all of it.
4. Who else receives your information
We use the service providers below. We do not sell your information to anyone, and none of these providers is permitted to use it for their own advertising.
| Provider | What they receive | Purpose |
|---|---|---|
| OpenAI | Birth details, your questions, your voice audio | Generating readings; live voice conversation; speech-to-text |
| Google (Gemini) | The same, when OpenAI is unavailable; your face photo, if you uploaded one | Fallback readings and speech-to-text; personalized card imagery |
| ElevenLabs | The text to be spoken aloud | Text-to-speech |
| Stability AI | Image prompts; your face photo, if you uploaded one | Generating tarot and zodiac imagery |
| Google Firebase | Your profile (§3.1), your anonymous account identifier, and temporarily your uploaded photo | Database, file storage, and the server functions that produce readings |
| HERE Technologies | The birth place and current place text you enter | Converting a place name into coordinates and a time zone |
| ip-api.com | Your IP address | Approximate current location |
| QR Server (goqr.me) | A one-time upload link containing a random session code — no personal information | Rendering the QR code you scan with your phone |
| Meta Platform | Purchase and subscription transactions | Processing in-app purchases and subscriptions |
Arcana signs in to our own backend anonymously. We do not store your Meta identity, and the profile we hold is linked only to a random identifier generated on your device.
5. Sensitive information — please read this part
Birth date and birth time. Your full name combined with your exact date and place of birth is information commonly used to verify identity. We store it because the app cannot function without it, but you should know that we hold it.
Your face. Uploading a photo is optional and Arcana is fully usable without it. When you use the feature:
- The photo travels from your phone to our storage, is downloaded by your headset, and the copy on our server is deleted immediately afterwards.
- The copy on your headset is sent to an AI image provider each time a personalized card is generated, so that provider can render you into the artwork.
- We do not perform facial recognition, do not create a faceprint or face-geometry scan, do not attempt to identify you from the image, and do not use it to train any model.
- You can delete it at any time (§8).
6. How long we keep things
| Data | Retention |
|---|---|
| Your profile — name, birth details, places | Until you ask us to delete it, or 24 months after you last open the app |
| Uploaded face photo, on our servers | Deleted immediately after your headset downloads it; automatically purged after 24 hours if never collected |
| Uploaded face photo, on your headset | Until you delete it or uninstall Arcana |
| Voice and text sent to AI providers | Retained by those providers under their own API data policies; we do not opt in to any provider's model-training use of your content |
| Voice notes you record | On your headset only, until you delete them or uninstall |
| Purchase records | As required for tax and accounting purposes |
7. Security, stated honestly
We use HTTPS for our backend, our AI providers, and geocoding. Our database restricts each account to its own record.
One current exception, disclosed deliberately: the approximate-location lookup (ip-api.com) is made over unencrypted HTTP, because that provider's free tier does not offer HTTPS. Your IP address and the approximate city returned for it could in principle be observed by others on your network. It carries no name, birth data, or account identifier. We plan to replace this provider with an encrypted one; this paragraph will be removed when that happens.
No system is perfectly secure, and we cannot guarantee absolute security.
8. Your choices and rights
Anyone, anywhere, can:
- Skip the face photo entirely.
- Delete everything held on your headset by uninstalling Arcana.
- Ask us to delete your stored profile, your uploaded photo, or both, by emailing veronica@quixotical.world. We will action it within 30 days.
If you are in the EEA, UK or Switzerland, you have the right to access, correct, delete, restrict, port, and object to our processing, and to complain to your local data protection authority.
If you are in California, you have the right to know, delete, correct, and to opt out of "sharing" as the CCPA defines it. We do not sell or share personal information as the CCPA defines those terms.
To exercise any of these, email veronica@quixotical.world. We will not treat you differently for asking.
9. Children
Arcana is not directed to children and we do not knowingly collect information from anyone under 13, or the applicable age in your region. Meta's age group signal is used to withhold real-money purchasing from non-adult accounts. If you believe a child has provided us with information, contact us and we will delete it.
10. International transfers
We are based in the United States, and our providers process data in the United States and elsewhere. Where required, transfers rely on appropriate safeguards such as the providers' standard contractual clauses.
11. Changes
We will post changes here and update the "Last updated" date. Material changes will be announced in the app before they take effect.
12. Contact
Quixotical, LLC
United States — postal address available on written request
veronica@quixotical.world