Privacy Policy

Who is responsible?

Clayfold is operated by Jesko von Dessauer, a sole proprietor registered in the Netherlands and trading as Luami. Jesko von Dessauer is responsible for the personal data described in this policy and is the controller in data-protection terms.

• Legal name: Jesko von Dessauer
• Trading name: Luami
• KVK number: 88447405
• Business correspondence:
• Privacy email:

What data does Clayfold handle?

Optional personalized readings

AI personalization is off by default. If you enable it, Clayfold sends the following to our backend:

• your written question;
• the chosen spread, cards, positions, and upright or reversed state;
• your app language; and
• a random installation ID, used for daily limits and deletion. It is created once and kept on your device, and is not your name, email address, advertising ID, or Apple or Google account ID.

Your question is first checked by an AI moderation service. If allowed, the question and reading details are sent to an AI model to create the personalized interpretation.

We do not store your written question on our servers, with one exception: a question you choose to send with a report about a reading (see below). So that retries and repeat readings work, we do store the reading generated from it and the safety-check response, which can include a note or a suggested rewrite of your question. Both can repeat personal details from your question. They expire 30 days after they were last used and are then deleted automatically.

For each AI request we also keep a usage measurement: the time, the feature and AI model used, the spread and app language, and token counts showing how much text was processed, together with the installation ID. These measurements never contain your question or any reading text.

In the Android app, you can report a personalized reading, for example if you think it could be better or something in it feels wrong. A report reaches us with the reading it is about, the cards you drew, your app language and version, your installation ID, and a note if you write one. Your question is included only if you choose to send it with the report. We keep a report for 90 days and use it to look into what went wrong and to improve how readings are written. Reports are never sent to an AI service.

Your subscription

If you subscribe in the iOS app, Apple sells and bills the subscription. Apple also sends our server a notice each time it starts, renews, changes, fails to renew, ends or is refunded. From each notice we keep Apple’s identifier for your subscription, the product, its purchase, renewal, expiry and any refund dates, whether it will renew or a payment failed, whether a free trial applies, the price and currency, and your App Store country. The notices never include your name, email address or Apple ID, and we do not link them to your installation ID. We use them to know whether your subscription is active and to count trials, renewals, cancellations and refunds.

To check your subscription, the iOS app also sends Apple’s signed record of it with each personalized reading request. That record holds Apple’s identifiers for your subscription, the current renewal and your download of the app, along with the product, the purchase and renewal dates, whether it is a free trial, your App Store country, and the price and currency. It never includes your name, email address or Apple ID. Our server checks Apple’s signature on it and does not store it.

If you subscribe in the Android app, the subscription is bought and billed through Google Play. The app asks Google Play on your device whether your subscription is active. To check your subscription, the Android app also sends Google Play’s token for your purchase with each personalized reading request. Our server asks Google whether that purchase is active. Google’s answer holds the state of the subscription, its order number, the product and offer, the start and renewal dates, the price and your Google Play country, and, if you cancelled it, when and the reason you gave Google. Our server does not store the token or the answer. Google’s developer console shows us a record of each order: its number, the product and offer, the price and tax, the date, whether it was charged or refunded, the model of the device it was bought on, and your country. In countries where we, rather than Google, are the seller, it also shows your city and postcode. We do not link these records to your installation ID. We use them for bookkeeping, refunds and support.

Daily limits are counted per subscription. Our server keeps each day’s count under a protected identifier for your subscription.

If you enter an access code in the Android app, it is sent to our server to be checked, when you enter it and with each personalized reading request after that. It is not stored with anything about you.

Readings you choose to save

In the iOS app, a saved reading is stored on your device using Apple’s storage system and syncs to your private iCloud database when iCloud is available, where we cannot read it. If iCloud is unavailable, Clayfold uses local storage instead.

In the Android app, a saved reading is stored on your device. If Android backup is on, your saved readings are included in the backup Android keeps in your Google account, where we cannot read it, so they can be restored if you reinstall Clayfold or move to a new phone.

Daily Reading and card meanings

Daily Reading uses fixed interpretation text that ships with the app, whether or not AI personalization is on. Its reading details are never sent to an AI service. The same is true of the short card meanings you see when you browse the deck or draw a card without a question: fixed, written text, never generated for you.

To keep that text current, Clayfold downloads updated wording for your app language from our content host. Those requests contain no question, card, reading, or installation ID — they ask only for the text file for a language, and they happen whether or not you ever open a reading.

Anonymous usage statistics

Separately from the reading data described above, Clayfold records anonymous statistics about how the app is used — for example that a daily card was opened, a question was asked and which spread, or that a reading finished or failed — together with the device model, iOS or Android version, app version, language setting, and whether you subscribe. This measures the action, not its content: it never includes the words you typed, the cards you drew, or the reading you received, and it carries no persistent identifier — only random values that exist while the app is open and are discarded when it closes — so it cannot be traced back to you or linked to the reading data above. So that we can count how many people use the app, and see whether people who started in a given month keep using it, your device remembers the month (never the date) you first opened it and when you last did each thing we count. The statistics include that month and whether something happened for the first time ever or that day, week, month, quarter or year; the times your device keeps never leave it. Your IP address is used only to work out which country the statistics come from and is then discarded; it is not stored. The statistics are handled by PostHog, which acts only on our behalf, uses no cookies and no cross-app tracking, and stores the data in the European Union.

Website and support

The Clayfold website measures how its pages are used, so we can tell which parts people read and which links they follow. It records page views and clicks — the action, not who you are. There is no session recording, no advertising or cross-site tracking, and no profile: we never ask it to identify you, so no visitor profile is created. This is handled by PostHog in a separate project from the app’s, and stored in the European Union.

Whether we need your permission first depends on where you are, so we ask Cloudflare which country the request arrives from. That happens at Cloudflare’s own network edge, where your request already is: nothing is sent to a third party to look you up, and the answer is not stored. Where the law requires permission — the EU and EEA, the United Kingdom, and the US states that ask for it — nothing is measured and no analytics cookie is set unless you choose Allow analytics, and declining collects nothing at all. Elsewhere, measurement is on when you arrive and a notice offers a one-click opt-out that we remember for that browser. A Global Privacy Control signal from your browser is treated as an opt-out everywhere, whether or not you have been asked.

You can change your choice at any time with Website privacy choices at the bottom of any page.

Like most websites, its hosting provider may receive technical request data such as your IP address, browser, device type, and request time. If you email us, we receive your email address and anything you include in the message.

Why do we use this data?

• to provide, update, restore, save, and sync the features you ask for;
• to moderate and generate personalized readings when you consent;
• to look into a reading you report and improve how readings are written;
• to apply fair daily limits, prevent misuse, keep the service secure, and fix failures;
• to measure how the AI features are used and what they cost to run;
• to know whether your subscription is active, to keep our accounts and handle refunds, and to measure how subscriptions do;
• to measure how the website is used, where you allow it or have not opted out; and
• to reply when you contact support or exercise a privacy right.

For people covered by the GDPR or similar laws, our legal bases are: performing the service you request; your consent for optional AI personalization and for any reading reports you decide to send, including your explicit consent to process special-category details you choose to include in a question or a report; our legitimate interests in security, misuse prevention, reliable operation, understanding usage, costs and how subscriptions do, and support; your consent for website analytics wherever consent is required for them; and compliance with legal obligations where required.

You can withdraw your permission at any time by turning off Enable AI readings in the app’s settings. This stops any new question or reading data leaving your device. It does not undo processing that already happened, and it does not cancel your subscription, which stays active until you cancel it with Apple or in Google Play. Because withdrawing clears your permission, turning AI back on asks for it again. To also remove data that was already processed, use Delete Server Reading Data in the app’s settings.

Your choice about website analytics is separate from this and is changed with Website privacy choices at the bottom of any page. Turning it off stops any further measurement in that browser and clears the analytics cookies it had set.

Where does the data go?

• Google Cloud / Firebase runs Clayfold’s backend. Cloud Functions and the usage-measurement records are configured in Frankfurt, Germany, and the Firestore database is configured in a European multi-region.
• OpenAI processes questions and reading details for moderation and personalized interpretations. Clayfold requests that responses are not stored as retrievable API application state. OpenAI says API data is not used to train its models by default, but it may keep prompts and responses in abuse-monitoring logs for up to 30 days unless law requires longer retention.
• Apple iCloud / CloudKit stores saved readings in your private iCloud database when you choose to save and sync them.
• Google (Android backup) stores saved readings in your Google account’s backup when Android backup is on.
• Apple (App Store) sells and bills subscriptions in the iOS app under Apple’s terms, and tells us when yours changes.
• Google (Google Play) handles subscription purchases and billing in the Android app under Google’s terms, shows us a record of each order, and answers our server’s check of a subscription.
• Cloudflare hosts the Clayfold website and the interpretation-text updates (Daily Reading text and card meanings), and processes ordinary technical request data such as your IP address when delivering them. It also tells the website which country a request arrives from, so the right privacy choice can be offered.
• PostHog (PostHog Inc.; data stored in the European Union, in Frankfurt) processes anonymous usage statistics on our behalf, in separate projects for the app and the website. In the app it uses no cookies, device identifiers, or cross-app tracking, and your IP address is discarded on arrival once the country has been derived from it. On the website it sets its own cookies only while analytics are actually running — after you allow them, or until you opt out in the regions where they start on — and it never tracks you across other sites.

Google Cloud / Firebase, OpenAI, Cloudflare and PostHog process data on our behalf under data processing agreements that require them to give it the same or equal protection that this policy describes. Saved readings stay in your own iCloud or Google account under Apple’s or Google’s terms. Some processing may take place outside your country or the European Economic Area. Where required, those transfers use recognized safeguards such as adequacy decisions or standard contractual clauses; PostHog Inc. is also certified under the EU-U.S. Data Privacy Framework. We may also disclose data if the law requires it or to protect people, rights, and service security.

How long is data kept?

• Server reading and safety data: expires 30 days after the last time it was used, then is deleted automatically.
• Reading reports (Android app): kept for 90 days, then deleted automatically.
• Daily-limit counts: expire at the end of the UTC day they apply to, and are not used to enforce limits on a later day.
• Usage measurements: kept for up to 24 months, then deleted automatically.
• Subscription status (iOS app): kept until 30 days after the subscription ends, then deleted automatically.
• Subscription history (iOS app): kept for up to 24 months (90 days for TestFlight test purchases), then deleted automatically.
• Google Play order records (Android app): kept in Google’s developer console under Google’s terms. Any copy we keep for our accounts is kept for as long as tax law requires.
• Anonymous usage statistics: kept by PostHog for up to seven years as anonymous data that cannot be traced back to you. Website analytics are kept on the same basis.
• Saved readings: kept on your device, and in iCloud or your Android backup, until you delete them.
• Installation ID: in the iOS app, kept in the Keychain and may remain on the same device after the app is reinstalled; in the Android app, deleted when the app is uninstalled.
• First-open month: kept on your device on the same terms as the installation ID.
• Support email: kept only as long as reasonably needed to answer the request and meet legal or security needs.
• OpenAI processing: subject to OpenAI’s API controls, including default abuse-monitoring retention of up to 30 days.

Expired records are not used or returned by Clayfold.

Deleting your data

You can delete an individual saved reading inside Clayfold. In the iOS app, this removes the local record and its iCloud copy through Apple’s sync system. In the Android app, it removes the reading from your device, and from your Android backup the next time Android backs up Clayfold.

To remove server reading data linked to this installation, open Settings → Delete Server Reading Data. This removes the installation’s links to question-based AI readings, deletes cached readings that are not shared with another installation, deletes any reading reports you sent, and deletes older usage records. Current-day limit counts are reduced to the minimum needed so that deleting data cannot reset that day’s limits; they expire at the end of the day.

The same action removes the installation ID from stored usage measurements, leaving only anonymous totals. Measurements recorded in the hours just before your request may keep the installation ID; they are deleted on the schedule above in any case.

The anonymous usage statistics described above contain nothing that could identify you or your installation, so they are not affected by these actions.

Delete Server Reading Data does not remove subscription records: they are not linked to your installation ID, so we cannot tell which are yours. They are deleted on the schedule above.

We do not store the written question itself, except in a reading report you chose to send it with. A cached safety-check response may contain a note or suggested rewrite that echoes details from it. Data used to enforce daily limits may link that response to this installation until the end of the UTC day. Choosing Delete Server Reading Data removes the link immediately but keeps the request count needed to preserve that day’s limit. It does not delete the response itself because another installation may use the same cached response; it is deleted automatically after 30 days. Because Clayfold has no account system and these responses use protected identifiers, we may not be able to identify a particular response as yours.

For help, or to make a broader privacy request, email . Because Clayfold has no account system, we may need information from your installation to locate the right records, and we may be unable to connect some pseudonymous records to you.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to certain uses. You may also withdraw consent and complain to your local data-protection authority. We will not treat you differently for exercising a privacy right.

Clayfold does not sell personal information or share it for cross-context behavioural advertising. It does not use your data for targeted advertising.

Security and children

We limit server database access to the backend, use encrypted network connections in production, and use app-and-device attestation to reject requests that do not come from an authentic Clayfold app instance. We also use providers with technical and organisational security measures. No system is perfectly secure, so please avoid putting sensitive or identifying information in a question.

Clayfold is offered for ages 16 and up and is not directed at children. On Google Play, the Android app is offered to adults (18 and over) only. If you believe someone under 16 has provided personal data, contact us so we can review and delete what we can identify.

Changes and contact

We will update this page when Clayfold’s data practices or service providers materially change and will change the date at the top.

Questions, concerns, or privacy requests are welcome at .