Privacy Policy

The controller for data processing on arcanapath.net within the meaning of the GDPR is:

Cloudwards e.K.
Inhaber (Owner): Oliver Sinz
Klostersteige 15
87435 Kempten
Germany

Contact: info@cloudwards.de or hello@arcanapath.net. See also our legal notice.

This website is hosted by Vercel Inc. (San Francisco, USA). When you visit any page, Vercel technically processes your IP address, browser and device information, and the pages you request in order to deliver the site securely and reliably (server logs). We access such logs only for operating and securing the service. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in providing a secure, functioning website. Log data is retained only for a short period as configured by our host.

To understand which pages are useful and how the site performs, we use Vercel Web Analytics, a privacy-friendly statistics service provided by our host. It works without cookies and without persistent identifiers: page views are counted using an anonymized hash that cannot be linked to you across days or across websites, and no advertising or cross-site tracking takes place. We only ever see aggregated numbers (page views, referrers, country-level location, device type). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in measuring and improving our own website. Because no information is stored on or read from your device, no consent banner is required for this.

Creating a study account is optional. If you do, authentication is handled by Clerk (Clerk, Inc., USA), which processes your email address, optional profile details, sign-in method (email code or Google), and technical sign-in metadata on our behalf, and sets strictly necessary cookies to keep your session active. These cookies are required for the service you requested and are not used for tracking or advertising. Legal basis: performance of the user agreement (Art. 6(1)(b) GDPR). If you sign in with Google, Google's own privacy policy applies to that sign-in step. You can delete your account at any time by contacting us; this removes your account and associated study data.

When you use the study app while signed in, we store your review history and scheduling state, quiz results, and journal entries, linked to your account. This data exists so the app can do its job — scheduling repetitions and showing your progress (Art. 6(1)(b) GDPR). It is stored in a PostgreSQL database hosted by Supabase in the EU (Frankfurt, Germany). Journal entries are private to your account; we do not read them except where technically unavoidable for operating the service or legally required. Study data is kept until you delete it or your account.

The AI tutor is a premium feature. When you send the tutor a message, that message — together with the reference material for the card or spread you are asking about and, depending on the mode, a summary of your study statistics (review counts, quiz accuracy; never your journal entries) — is transmitted to Anthropic, PBC (USA) for processing by the Claude language model, so the tutor can answer you (Art. 6(1)(b) GDPR). We do not store your tutor conversations on our servers; your current conversation lives only in your browser until you leave the page. We record usage metadata (timestamp, mode, message size) to enforce fair-use limits. Anthropic does not use API data to train its models by default and retains API inputs and outputs only for a limited period for abuse prevention; see Anthropic's privacy policy for details. Please don't include sensitive personal data (e.g. health details) in tutor messages.

Paid subscriptions are processed by Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). Your card or payment details go directly to Stripe — we never receive or store card numbers. We store your subscription status, Stripe customer reference, and billing period so the app knows what you have access to (Art. 6(1)(b) GDPR). Invoicing and payment records are retained as long as tax law requires (§ 147 AO). Stripe acts partly as an independent controller for payment processing; see Stripe's privacy policy for details.

If you sign up for our free email course, we process your email address and the signup source to deliver the course and occasional related updates. This happens only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time — every email contains an unsubscribe link, or you can simply write to us. We use Loops (Loops, Inc., USA) as our email service provider to store the address and send the emails. We keep your address until you unsubscribe or ask us to delete it.

The 3-card reading tool runs entirely in your browser. Your draws — which cards appear, and any question you hold in mind — are never transmitted to, seen by, or stored on our servers.

If you email us, we process your address and the content of your message to respond (Art. 6(1)(b) and (f) GDPR). Our mailboxes are hosted by Fastmail (Fastmail Pty Ltd, Australia, with servers in the USA). We keep correspondence only as long as needed to handle your request and any follow-ups, or as required by law.

We use only strictly necessary cookies: when you sign in, our authentication provider sets session cookies so you stay signed in, and the payment flow may set technically required cookies of its own. Strictly necessary cookies need no consent banner (§ 25(2) TDDDG). We set no advertising, analytics, or tracking cookies of any kind, and there are no third-party ad trackers on this site. If anything consent-requiring is ever added, we will ask first.

Our free study tools (such as the no-account flashcards) save progress in your browser's local storage; that data stays on your device, is never sent to our servers, and disappears if you clear your browser data.

Some of our service providers (Vercel, Clerk, Stripe, Loops, Fastmail, Anthropic) process data in the United States; your study database is hosted in the EU (Frankfurt). Where personal data is transferred outside the EU/EEA, we rely on recognized safeguards such as an adequacy decision under the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses (Art. 44 ff. GDPR).

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15 GDPR),
• have inaccurate data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21),
• withdraw any consent at any time, with effect for the future,
• lodge a complaint with a data protection supervisory authority — the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

To exercise any of these rights, email hello@arcanapath.net.

We do not sell personal data, do not use it for automated decision-making or profiling, and do not direct this website at children under 16. We may update this policy as the site evolves — the date above always reflects the current version.