Privacy Policy

This policy explains what personal information Heathen Heritage LLC (“we”, “us”) collects when you use Heathen Heritage at https://www.heathen-heritage.com, how we use it, who we share it with, and the choices you have. It is part of our Terms of Service, and by creating an account or using the Site you agree to it. The Site is for people 18 and over and is run from the United States.

What you give us

• Account: your email address, an optional display name, and your password (we keep only a one-way hash of it, never the password itself). Optional profile picture and public profile choices. If you turn on two-step sign-in, the secret key your authenticator app shares with us (encrypted) and your backup codes (kept only as one-way hashes).
• Readings: the spread you used, the cards, runes or houses drawn, your question if you asked one, the category, the date, the reading we generated, and the notes you add.
• Birth details (if you use the astrology features): your birth date, birth time (or that you don’t know it), birthplace, the time zone worked out from it, and the chart calculated from them. If you ask for a compatibility reading, the other person’s name and the signs and aspects of the two charts are kept; their birth date, time and place are used to work out the chart and are not stored. Only enter another person’s details if they are happy for you to.
• Journal: your entries, tags, moods and outcomes.
• Community: forum threads, replies, reports, blog comments, and anything else you post.
• Purchases and bookings: your plan, what you bought, booking and delivery details, and the email you give. For Rune Credits: each reload, purchase, refund and adjustment on your balance, with the date and what it was for, and the rewards you earned in the forum. Card details go straight to Stripe; we never see or store your full card number.
• Messages: what you send us when you email us, and the private messages you send on the Site to another member or to the staff (with who sent them to whom, and when), and the members you block.
• Staff notes: our staff may keep short, factual notes on your account to help with support, for example that you asked for a refund or reported a problem, with who wrote the note and when. Only our staff can see them, they are never shown publicly, and they are deleted with your account. You can ask for a copy (section 9).

What is collected automatically

• Your IP address and basic request and device information (browser type, pages used, time), kept in server logs and with some actions such as saving a reading, for security, abuse prevention, daily limits and fixing problems.
• Cookies and similar storage (see section 7).
• Your browser’s time zone (for example “America/Los_Angeles”), so daily and weekly reading allowances reset at your own midnight. It is saved on your account and can change at most once every 30 days.
• Your approximate location only if you press “Use my location” on the Sky Calendar, and then only inside your browser to work out sunrise and planetary hours; we do not receive it.

• To run the Site: make an account, sign you in, deliver and save your readings, work out your charts, enforce plan limits, take payments, and deliver and book One-On-One and Recorded readings.
• To write AI-assisted readings (section 4).
• To keep the Site safe: spot spam, fraud and abuse, enforce our Terms, and protect people and the Site.
• To send you service emails, such as verifying your address, resetting a password, booking and delivery notices, receipts and changes to our terms or policies. We do not send advertising email without asking you first.
• To improve the Site, find and fix errors, and plan costs (for example, counting how many readings are written).
• To follow the law and respond to legal requests, and to establish or defend our legal rights.

We do not sell your personal information, and we do not share it with advertisers. The Site runs no advertising or cross-site tracking.

Some written readings are put together by an AI model (Claude, from Anthropic, PBC) as explained in the Disclaimer. To do that, our server sends it:

• the cards, runes or houses you drew and their positions, with our own written descriptions of them;
• your question or the short follow-up question you ask, if any;
• for astrology readings, the planet positions, signs, houses and aspects worked out for you (and for a compatibility reading, the other person’s first name or the name you entered, and the facts of the two charts).

We do not send your email address, password, payment details or your birth date, time or place to the AI provider. But anything you type in a question is sent as you wrote it, so do not put private, sensitive or identifying information in a question. Under Anthropic’s terms for its business interface, as we understand them, what is sent through it is not used to train its models, and it is kept only for a limited time under its own policies, which apply to it. We cannot control the provider’s handling beyond that.

We keep the text it returns, the model used, a count of tokens and the cost, so we can show you your reading again, enforce limits and watch spending.

Only as needed to run the Site, with:

• Service providers that work for us: our web host and email delivery; Stripe (payments); Cloudflare Turnstile (checking that you are human at sign-up and sign-in); Anthropic (AI, section 4); and Cal.com (booking One-On-One readings). Each handles data under its own terms and privacy policy. Place search uses the GeoNames dataset stored on our server. What each one receives is set out in section 13.
• Other people on the Site, for what you choose to make public: your forum posts, replies and comments, your display name and picture. Your journal, notes, birth details, charts and readings are not public.
• Private messages go only to the member you write to. Messages you write to the staff are read by our administrators. The staff do not read conversations between members, with one exception: when a member reports a message, the staff see that message and up to five messages before it in the same conversation, so they can decide whether it breaks our rules and remove it. We email you when a new message arrives, saying who it is from but not what it says.
• Authorities and others, where we believe the law requires it, to enforce our Terms, to protect rights, safety and security, or in a sale, merger or reorganization of our business.

• Traffic between your browser and the Site is sent over HTTPS. Passwords are stored only as one-way hashes.
• Two-step sign-in (optional). You can turn it on under My Account, so that signing in also needs a code from an authenticator app on your phone, or one of your one-use backup codes. The key shared with your app is encrypted on our server like your journal, and the backup codes are stored only as one-way hashes. We email you whenever it is turned on or off. If you lose both your phone and your backup codes, our staff can turn it off once they are satisfied that the request really comes from you.
• Server-side encryption. The most sensitive things you write, journal entries, notes on readings and private messages, and the key for two-step sign-in, are encrypted on our server before they are stored. The key is kept apart from the database, outside the web-accessible files. Other account data is protected by access controls, limited access, and the hosting provider’s security. This is server-side encryption, not end-to-end encryption: the server must be able to open your entries to show them to you, so anyone who gained access to both our database and our server settings could read them.
• We limit who can reach the data, keep software up to date, and verify new sign-ups with Turnstile. Administrator access to member data needs a separate sign-in, and changes administrators make on the Site are logged. Database backups are kept outside the web-accessible files.
• Payment card numbers never reach our server: they are entered on Stripe’s pages.

We use only what the Site needs to work. We do not use advertising or analytics cookies.

• A session cookie that keeps you signed in. It ends when you close the browser, or lasts 30 days if you ticked “Remember me” (which also sets a small cookie recording that choice).
• A guest cookie that counts daily draws for people who are not signed in.
• A look and feel cookie if you pick a different theme.
• Browser storage on your device for conveniences such as an unsent journal draft, your last birth details used in the horoscope form, and progress on hidden finds.
• Cookies or similar storage set by Cloudflare Turnstile (the human check on sign-in and sign-up).

You can block or clear cookies in your browser, but signing in will not work without the session cookie. We do not respond to “Do Not Track” signals because the Site does not track you across other sites.

We keep your information while your account is open. When your account is deleted (section 9) we delete the information tied to it, except what we must or may keep: payment, tax and accounting records the law requires, records needed for security, fraud prevention or to settle a dispute, and copies in backups until they are overwritten in the normal backup cycle. Posts on the public forum may be deleted or detached from your name. Information that does not identify you may be kept.

• Export. Everything the Site generated for you, your readings, horoscopes and journal, and your private messages, can be exported and saved. Please do that before you delete your account, because we cannot recover it afterwards.
• Delete. Every user can delete their account together with all of their data. Ask from My Account. The account and its data are deleted once you have not signed in for seven days after asking. If you sign in again during that week, the request is cancelled. You can also email [email protected].
• Deletion requests under the law. If a law gives you a right to have your information deleted, you can ask by emailing [email protected] from the address on your account, whether or not you can still sign in. We will confirm that the request is yours and reply within the time the law sets (generally 30 days, or 45 days in California, extended only as far as the law allows, and we will tell you if we need longer). We delete your information from our systems and ask the providers that hold it for us to delete it too, except what we must or may keep (section 8). Telling us you want your data erased counts as a request: you do not need to wait seven days or sign in again, and we will tell you what we deleted and what we kept, and why.
• Access and correction. You can see and correct most of your details in My Account. For anything else, including a copy of any staff notes on your account, email us.
• Emails. Service emails are needed while you have an account.

Where the law (for example the UK or EU GDPR) requires a legal basis for using personal information, ours are below. Where no such law applies to you, this still explains why we use it.

• To provide what you asked for (performing our contract with you): account details, readings, birth details and charts, journal, purchases and bookings, plan limits and service emails.
• Our legitimate interests in running, securing and improving the Site: IP address and request records, abuse and fraud prevention, daily limits, fixing errors, and counting readings and cost. We weigh these against your interests and rights, and you can object (see “Your privacy rights by place”).
• Your consent, where we ask for it: using your device location for the Sky Calendar, and any promotional message (see “Marketing and promotional messages”). You can withdraw consent at any time; that does not undo what was done before.
• Legal obligations: keeping payment and tax records, answering lawful requests, and handling data protection requests.
• Sensitive information. Birth details, journal entries and the questions you ask can reveal sensitive things (for example about health, relationships or beliefs). We do not ask for them. If you put such information into a question or journal entry, you choose to give it to us, and we use it only to provide the feature you are using.

You do not have to give us your information, but without an email address and password we cannot make an account, and without birth details the astrology features cannot work.

• We do not send promotional email or text messages today. Creating an account does not sign you up for any. We send only the service messages described in “How we use it”.
• If we start sending news, offers or other promotions, we will ask you first with a separate, unticked choice that is not a condition of signing up or buying, and we will record when and how you agreed.
• Every promotional email will include a working unsubscribe link and our identity and postal or contact details, and we will honor an opt-out promptly (within 10 business days at the most). You can also write to [email protected] at any time. Opting out of promotions does not stop service messages such as receipts, password resets and changes to our terms.
• We will not send promotional text messages, and we do not buy or rent email lists.

If we discover or suspect that personal information has been accessed, lost, changed or disclosed without authorization, we will:

• act at once to stop it and limit the harm (for example, closing the access, changing keys and passwords, signing sessions out, and involving our hosting provider);
• find out what happened, what information and which people are affected, and keep a written record of it;
• tell the people affected, usually by email to the address on the account and without unreasonable delay, saying what happened, what information was involved, what we are doing, and what you can do (for example, change your password); and
• tell the authorities and others where the law requires: for example, a UK or EU supervisory authority within 72 hours of becoming aware of a breach likely to put people at risk, and the state authorities and attorneys general that U.S. state breach laws name, within their deadlines.

If you think your account or information has been compromised, or you find a security problem, email [email protected] straight away. Please do not publish the problem or probe other people’s accounts.

These companies help us run the Site. Each acts for us on a limited task, and we rely on the data processing terms that are part of its standard agreement with business customers. Where the law requires safeguards for moving data between countries, we rely on those our providers offer, such as standard contractual clauses or the EU-U.S. Data Privacy Framework. We do not allow them to sell what we give them.

• Our web host and email delivery (United States): everything we store, as described in this policy, and the emails we send you.
• Stripe (payments): your email, the plan or reading you buy, and the card and billing details you enter on Stripe’s own pages. For its own fraud prevention and legal duties Stripe also acts on its own account.
• Anthropic, PBC (AI): the reading facts and questions described in section 4. Not your email, password, payment details or birth details.
• Cloudflare Turnstile (human check): that you visited the sign-in or sign-up form, your IP address and browser details, and the result of the check.
• Cal.com (booking One-On-One sessions): what you enter to book, such as your name, email and chosen time.

We do not give your information to data brokers or advertisers. We review this list when we add or change a provider, and we will update this section if a new one receives personal information.

• Where: in a database and files on our hosting provider’s servers in the United States, with backups kept outside the web-accessible files.
• What is kept, in groups: account (email, display name, password hash, plan, sign-up time, the time, version and IP address recorded when you accepted our terms, and, if you turn it on, the encrypted two-step sign-in key and hashed backup codes); readings (spread, cards, question, category, date, the written reading, notes); birth details and charts; journal entries; private messages (encrypted) and the members you block; forum, blog and profile content; purchase and booking records; reports and moderation records; and records of security-relevant actions such as usage limits and administrator changes, and sign-in attempts (the email address typed, your IP address, the time and whether the password or two-step code was wrong; kept 90 days, to slow down and spot password guessing).
• Not kept: your full card number, the plain text of your password or of your two-step backup codes, and another person’s birth date, time or place from a compatibility reading.
• Protection: see “How we protect it, and the limits”. How long each is kept is in “How long we keep it”.

Depending on where you live (for example California and other U.S. states, the UK or the EU/EEA), you may have the right to know what we hold about you, get a copy, correct it, delete it, object to or limit some uses, and not be treated worse for using these rights. We do not sell or “share” personal information for advertising. To use a right, email [email protected] from the address on your account; we may need to confirm that it is you, and we will answer within the time the law sets. If you are not happy with our answer, you can complain to your local data protection authority or your state’s attorney general. Where the law requires a legal basis for processing, ours are performing our contract with you, our legitimate interests in running and protecting the Site, your consent where we ask for it, and legal obligations.

Your information is stored and processed in the United States and by providers in other countries. If you use the Site from elsewhere, you understand that your information goes there.

The Site is not for anyone under 18, and we do not knowingly collect information from people under 18. If you think a child has given us information, email [email protected] and we will delete it.

We may update this policy and will post the new version here with a new “last updated” date; for important changes we will tell you on the Site or by email. Questions or requests: Heathen Heritage LLC, [email protected]. For credits and licences of the software, fonts and data the Site uses, see Acknowledgements.