Privacy Policy

Ogham Oracle

Version: 1.0 Effective date: August 9, 2026 Last updated: August 9, 2026

At a glance

Ogham Oracle is built local-first. Most of what the app knows about you never leaves your phone. This summary is not a substitute for the full policy below, but it is accurate.

Four commitments:

1. Your birth date is never stored and never transmitted. You type it, the app calculates your tree and your moon phase on your device, and the date itself is discarded. The same applies to the second date you may enter for a compatibility reading.
2. We do not sell your personal information, and we do not share it for advertising. Ogham Oracle contains no advertising networks, no ad identifiers, no cross-app tracking, and no data brokers.
3. Your readings are yours. You can delete any single record, clear all local data, or delete your account and everything in it, from inside the app.
4. We do not use your content to train AI models, and our AI providers are contractually barred from doing so.

1. Who we are

Ogham Oracle (the “App”) is provided by Runic Oracle & Ogham Oracle, an independent app developer based in Novi Sad, Serbia (“we”, “us”, “our”).

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), we are the data controller for the personal data described in this policy.

Privacy and general support: runicoracle.app@gmail.com Website: https://runicoracle.web.app/ogham/

2. Scope of this policy

This policy covers the Ogham Oracle mobile application on iOS and Android, and our website at https://runicoracle.web.app/ogham/.

It does not cover:

• The Apple App Store or Google Play, which handle your purchase and payment under their own privacy policies;
• Third-party websites we may link to;
• Any separate app we publish, which has its own policy.

3. What we process, and why

3.1 Data that stays on your device and is never sent to us

The following is stored locally on your device (in the App’s private storage) and is not transmitted to us or to anyone else:

• Your birth date, and any second person’s birth date you enter for a compatibility reading. These are held only for as long as the calculation takes. The App derives your birth tree and your birth moon phase, saves those results, and discards the date. The date is not written to durable storage and is not synchronised to your account. If an older version of the App stored a birth date on your device, that value is erased automatically the next time the App starts.
• Your language selection.
• Your notification preferences and the time of day you chose for the daily omen. Notifications in the current version are scheduled locally by your device; we do not operate a push server and do not receive a device push token for them.
• Sound, haptics and display preferences.
• Cached lore articles, spread definitions and catalogue content downloaded from our content storage.
• A local cache of your subscription status, so the App works offline.
• Local counters used to enforce free-tier limits.

We cannot see any of this. It is deleted when you use “Clear local data” or uninstall the App.

3.2 Account data (Firebase Authentication)

The App creates an account for you so that your readings survive a reinstall and can follow you to a new device.

• Anonymous account. On first launch, the App creates an anonymous account identified by a random user identifier (“UID”) and a creation timestamp. It contains no email address, no name, and nothing that identifies you personally.
• Signed-in account (optional). If you choose Sign in with Google or Sign in with Apple, we additionally receive: your account UID, the email address associated with that sign-in, and a display name if the provider supplies one. If you use Apple’s Hide My Email, we receive only Apple’s private relay address and never your real one.
• We never receive or store your Google or Apple password.

Why: to create and secure your account, to synchronise your history across devices, and to link your PRO entitlement to you. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

3.3 Your grove data (Cloud Firestore, keyed to your UID)

The following is stored on your device and mirrored to your account so it is not lost:

• Derived identity: your birth tree identifier, your birth moon phase, your quiz results (for example your patron or your bird), your chosen display name and avatar, and the date you joined. Note again: the birth date itself is not part of this.
• History records, of four kinds — a spread reading, a compatibility reading, a quiz result, and a daily omen. Each record may contain: the record type, the spread or quiz identifier, the symbols drawn and the positions they landed in, a timestamp, the language you were using, the question you typed (if you typed one), and the interpretation text produced for that reading.
• Counters such as the number of readings you have cast and your usage of free-tier allowances.

Why: to give you a history you can return to, and to make it available across your devices. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

3.4 Purchase and subscription data (RevenueCat, Apple, Google)

We use RevenueCat, Inc. to manage subscriptions. When you buy or restore a PRO membership, RevenueCat processes on our behalf:

• A pseudonymous app user identifier (tied to your account UID);
• Store transaction and receipt data received from Apple or Google, including product identifier, purchase, renewal, cancellation and expiry dates, trial and introductory-offer status;
• Your entitlement status (PRO or not);
• Store country, platform, App version, device type and operating system version;
• Your IP address, from which an approximate country is derived.

We never receive your card number, bank details, or billing address. Payment is taken entirely by Apple or Google under their own terms and privacy policies.

Why: to sell and manage the subscription, to unlock what you paid for, to handle restores and refunds, and to prevent fraudulent access. Legal basis: performance of our contract with you (Art. 6(1)(b)) and our legitimate interest in preventing fraud (Art. 6(1)(f)).

3.5 Usage analytics (PostHog)

We use PostHog to understand how the App is used, so we can fix what is broken and build what people actually reach for. PostHog processes on our behalf:

• A pseudonymous analytics identifier;
• Product events — for example: a screen was opened, a spread was cast, a quiz was completed, a paywall was shown, a subscription was started or dismissed;
• App version, operating system and version, device model, screen size, language and locale;
• An approximate country or region derived from your IP address.

We configure PostHog so that IP addresses are not retained beyond deriving that approximate region, and we do not enable session recording, heatmaps, or any form of screen capture.

We do not send the text of your questions, your reading content, your interpretation text, your name, or your email address to PostHog.

Why: to measure stability, understand which features are used, and improve the App. Legal basis: your consent where consent is required (EEA, UK and similar jurisdictions) — you can turn analytics off at any time in Settings → Privacy & Data; elsewhere, our legitimate interest in improving our product (Art. 6(1)(f)).

Website audience counters

The website does not load PostHog, Google Analytics or another third-party audience-measurement SDK. It does not use analytics cookies, local storage, advertising identifiers, fingerprinting or cross-session visitor identifiers.

For basic first-party measurement, the website sends a small request when a page is viewed or a download link is used. The request is immediately added to daily aggregate counters. The analytics database does not contain a visitor record, IP address, full User-Agent, full referrer URL, question, reading, name, email address or account identifier. Stored dimensions are limited to the page category, app, store destination, CTA placement, coarse device/platform category, language, and sanitized campaign/source labels.

Why: to know which public pages and campaigns are useful and whether visitors reach an app-store destination. Legal basis: our legitimate interest in operating and improving the website (Art. 6(1)(f)).

3.6 AI-generated interpretations

Parts of the App — presented to you under names such as “the whisper of the grove”, “the voice of the symbols” or similar — are produced by generative artificial intelligence systems. We disclose this plainly here because you are entitled to know when you are reading machine-generated text.

Two providers are involved:

What is sent to the AI provider:

• The symbols drawn and the positions they occupy;
• The name and structure of the spread;
• Your derived identifiers where relevant — your birth tree, your birth moon phase, your patron;
• Your chosen language;
• The question you typed, if you typed one.

What is never sent:

• Your birth date, or any birth date;
• Your name, email address, or account identifier;
• Your location;
• Your stored history archive.

Provider commitments: both providers process this content as our processors under data-processing terms that prohibit using it to train or improve their models. Content may be retained by the provider for a short period for abuse detection and legal compliance — in OpenAI’s case, generally up to 30 days — after which it is deleted from their systems.

A caution: the question field is a free-text field, and we cannot control what you type into it. Please do not enter information you would not want processed by a third-party AI service — in particular medical details, financial account details, government identifiers, or another person’s private information.

Legal basis: performance of our contract with you (Art. 6(1)(b)); for the optional custom-question feature, your explicit request to use it.

3.7 Support correspondence

If you write to us, we hold your email address and whatever you choose to tell us, for as long as it takes to help you and to keep a record of the issue. Legal basis: our legitimate interest in responding to users (Art. 6(1)(f)).

4. What we do not do

For the avoidance of doubt, Ogham Oracle:

• Contains no advertising SDKs and shows no third-party ads;
• Does not collect the IDFA, the Android Advertising ID, or any equivalent advertising identifier, and does not present the App Tracking Transparency prompt;
• Does not track you across other companies’ apps or websites;
• Does not sell your personal information, and does not share it for cross-context behavioural advertising;
• Does not access your contacts, photo library, microphone, camera, calendar, health data, or precise location;
• Does not perform automated decision-making that produces legal or similarly significant effects about you;
• Does not knowingly collect data from children (see section 11).

5. Who your data is shared with

We share personal data only with the service providers below, only to the extent needed, and only under written data-processing agreements.

We may also disclose personal data:

• Where we are legally required to, by a valid order from a competent authority — and where we are permitted to tell you, we will;
• To establish, exercise or defend legal claims;
• To a purchaser or successor in the event of a merger, acquisition or sale of assets, in which case we will notify you before your data becomes subject to a different policy.

We do not share personal data with anyone else.

6. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States.

Where personal data is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on:

• The European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, incorporated into our agreements with each provider;
• Adequacy decisions where they apply;
• Supplementary technical measures — encryption in transit, encryption at rest, and access controls.

You can request a copy of the relevant transfer safeguards by writing to runicoracle.app@gmail.com.

7. How long we keep things

8. Your rights

Wherever you live, you can, from inside the App:

• Delete a single reading — swipe it away in your history;
• Clear all local data — Settings → Privacy & Data;
• Turn analytics off — Settings → Privacy & Data;
• Delete your account and everything in it — Settings → Account → Delete account. This removes your Firestore record, your authentication account, and your local data. It is permanent and cannot be undone.

If you can no longer open the App, you can ask us to delete your account and data, or to send you a copy of it, at https://runicoracle.web.app/ogham/support/. See section 8.1 for how we verify that a request comes from you.

Deleting your account does not cancel your subscription. Subscriptions are managed by Apple or Google and must be cancelled in your store account settings — see section 7 of our Terms of Use.

8.1 If you are in the EEA, the UK or Switzerland

Under the GDPR you have the right to:

• Access your personal data and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”);
• Restrict processing in certain circumstances;
• Object to processing based on our legitimate interests;
• Portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Lodge a complaint with your national supervisory authority. A list is at edpb.europa.eu/about-edpb/board/members_en. In the UK, the Information Commissioner’s Office at ico.org.uk.

To exercise any right, write to runicoracle.app@gmail.com with the subject line “Data Protection Request”. We will respond within 30 days, and will tell you if we need to extend that period. We may need to verify that the request comes from you — usually by asking you to write from the email address on your account, or to confirm your account identifier from inside the App. We do not charge for this unless a request is manifestly unfounded or excessive.

8.2 If you are in California

Under the CCPA/CPRA, in the last 12 months we have collected the following categories of personal information: identifiers (account identifier, email address if you sign in), commercial information (subscription and purchase records), internet or other network activity (App usage events, device and version metadata), geolocation data (approximate country only, derived from IP), and inferences — none, we draw no profiles about you. The sources, purposes, and recipients are described in sections 3 and 5.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

You have the right to know, to delete, to correct, to limit the use of sensitive personal information (we do not collect any), and not to be discriminated against for exercising these rights. Exercise them at runicoracle.app@gmail.com, or through the in-App controls above. An authorised agent may act for you with written permission.

California residents may also request information under California Civil Code §1798.83 (“Shine the Light”) — we disclose no personal information to third parties for their direct-marketing purposes.

8.3 Other regions

If you are in Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act), Japan (APPI), South Korea (PIPA), Serbia (Law on Personal Data Protection), or another jurisdiction with equivalent rights, you have substantially the rights set out in section 8.1 and can exercise them the same way.

9. Security

• All traffic between the App and our providers uses TLS encryption.
• Data at rest with Google, RevenueCat and PostHog is encrypted by those providers.
• Firestore security rules restrict every document to the account that owns it — no user can read another user’s readings.
• Access to production systems is limited to the people who need it and is protected by multi-factor authentication.
• We never hold payment card data.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and notify you without undue delay where the law requires it.

10. Legal bases — summary

11. Children

Ogham Oracle is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, write to runicoracle.app@gmail.com and we will delete it.

12. Changes to this policy

We may update this policy. When we do, we will change the “Last updated” date at the top.

If a change materially affects how we handle your personal data, we will notify you inside the App at least 14 days before it takes effect, and — where the law requires consent for the change — we will ask for it rather than assume it. Continuing to use the App after a change takes effect means the updated policy applies to you.

Previous versions are available on request from runicoracle.app@gmail.com.

13. Contact

Runic Oracle & Ogham Oracle Novi Sad Serbia

Privacy and support: runicoracle.app@gmail.com Website: https://runicoracle.web.app/ogham/

This document is published in English. Translations may be provided for convenience; in the event of any conflict, the English version governs.