Privacy Policy

Effective date: October 18, 2026

This notice explains what data the Norse Runes app ("the App"), provided by Marcana B.V. ("the Developer"), collects, and what happens to it. The App works without an account, and you can use it without giving your real name.

1. What information do we collect?

Details you type into the app

During onboarding, the App asks for a name, your birthday, a gender pronoun, your occupation, and your relationship status, and optionally a partner's name and gender. You choose what to enter, and nothing stops you from using a nickname. These details are stored on your device and are used to personalize your readings, as section 2A describes.

Questions and readings. The questions you type, the runes you draw, and the readings you receive are stored on your device as your reading history. The Developer keeps no copy of your history on its servers. Versions 1.0.7 and older also sent the text of your question to Amplitude and Google Analytics for Firebase as part of a usage event; version 1.0.8 stopped this.

Payment data. Purchases run through Apple's App Store. Apple processes the payment; the Developer never sees your card details. RevenueCat, the Developer's subscription service, receives purchase records tied to a random app user ID so your subscription keeps working.

Information collected automatically

The App uses Amplitude and Google Analytics for Firebase to understand how it is used. They receive usage events (for example which reading type was opened), device identifiers, device model and system version, language, and an approximate location derived from your IP address. The profile answers above (age, gender, occupation, relationship status) and your reminder time are also set as analytics properties. Firebase Crashlytics receives crash reports. OneSignal receives a push token and device information so it can deliver push messages from the Developer. Your daily and weekly reminders are scheduled on your device.

Information collected on this website

This website sets no cookies and runs no analytics.

2. How do we use your information?

• Readings. Your profile details, question, and drawn runes feed the reading you asked for.
• Understanding usage. Analytics events show which parts of the App are used and where it fails.
• Support. If you email us, we use your message and address to reply.
• Reminders. Your chosen reminder time schedules the notifications you asked for.
• Measuring our own ads. Section 2B explains what ad measurement receives and how to say no.

2A. How is personalized AI content generated?

When you request a reading, the App sends your question, the drawn runes, and the profile details from section 1 through the Developer's own server function to OpenAI, which writes the reading. Per OpenAI's API data policy, OpenAI does not train its models on this data and retains it for up to 30 days to monitor for abuse. The Developer's server function forwards the request and stores nothing itself; Google Cloud, which runs it, logs technical invocation data such as the function name and IP address.

2B. How do we measure our own advertising?

The App shows no third-party ads. The Developer does advertise the App elsewhere, and measures whether those campaigns work:

• Google ad measurement. If you allow tracking when iOS asks, Google Analytics for Firebase collects your device's advertising identifier (IDFA) alongside app events such as first open and purchases, so Google Ads can connect installs and purchases to the campaigns that caused them. If you decline, the IDFA is not collected, and Google's on-device conversion measurement reports campaign results without identifying you.
• Apple Search Ads. The App sends Apple's attribution token to RevenueCat. The token reports which Apple Search Ads campaign led to the install and is designed by Apple not to identify you. It does not require tracking permission.

Your choice. Decline when the App asks for tracking permission, or turn it off later in the device Settings under Privacy & Security, then Tracking. The App works the same either way.

3. Will your information be shared with anyone?

The Developer shares data only with the service providers that run the App: OpenAI (readings), Google Firebase (server functions, analytics, crash reports, remote configuration), Amplitude (analytics), RevenueCat (subscriptions and Apple Search Ads attribution), and OneSignal (push notifications). Each receives only what its job needs, as described above.

Legal bases for processing:

• Your consent, for tracking permission and for the details you choose to enter
• Contract performance, to deliver the readings and subscription you paid for
• Legitimate interests, to understand usage, fix crashes, and measure our own advertising
• Legal obligations and law enforcement compliance

Business transfers. Information may be shared during mergers, asset sales, financing, or business acquisitions.

Selling. The Developer does not sell personal information for money. With your tracking permission, device identifiers and app events are shared with Google for ad measurement, which some United States state laws treat as sharing personal information. Section 9 explains your opt-out choices.

4. Do you need an account?

No. The App has no accounts and no sign-in. Your reading history, bind runes, runic formulas, and settings live on your device. Deleting the App deletes them.

5. What is our stance on third-party websites?

The App may link to websites the Developer does not control, and this notice does not cover them. Review their privacy policies directly.

6. How long do we keep your information?

Your profile and history stay on your device until you delete them or the App. Analytics and crash data are retained by the providers in section 3 only as long as needed for the purposes above or as required by law. OpenAI's retention is described in section 2A.

7. How do we keep your information safe?

The Developer uses technical and organizational measures to protect personal information, and all transfers use encrypted connections. No transmission or storage is guaranteed to be fully secure, and you use the App at your own risk.

8. What are your privacy rights?

Residents of the European Economic Area and the United Kingdom have rights including access to personal information, rectification, erasure, processing restrictions, and data portability, and may withdraw consent at any time or complain to their data protection supervisory authority. Swiss residents can contact the Federal Data Protection and Information Commissioner.

Deleting your data. The App's Settings include a delete option that clears your data on the device, including your profile, your questions and reading history, your runic formulas, bind runes, and ambiance mixes, and resets the analytics identifiers, which disconnects past analytics events from your device. In versions before 1.0.8 the delete option left bind runes and ambiance mixes in place; there, remove them by deleting them in the App or deleting the App itself. For anything beyond that, email contact@marcana.app.

9. Controls for tracking

iOS asks for tracking permission through App Tracking Transparency, and you can change your answer at any time in Settings under Privacy & Security, then Tracking. The Developer respects this choice: without permission, the advertising identifier is not collected.

10. Do California residents have specific privacy rights?

Shine the Light law

California residents may request information annually regarding personal information categories disclosed to third parties for marketing purposes and third-party names and addresses.

CCPA privacy notice

Resident definition. California residents are people who are in California for other than a temporary or transitory purpose, and people domiciled in California who are outside the state for a temporary or transitory purpose.

Collected personal information categories:

• Identifiers
• Personal information (the profile details you enter)
• User content (your questions)
• Purchase information
• Usage data
• Diagnostics data

Selling or sharing. The Developer does not sell personal information for money. With tracking permission, the App discloses device identifiers, app events, and purchase events to Google for ad measurement, as described in section 2B. California law may treat this as sharing personal information. You can stop it on your device by declining or turning off tracking. To opt out fully, email contact@marcana.app. The Developer does not knowingly sell or share the personal information of consumers under 16 years of age.

Consumer rights

• Right to deletion. Users may request personal information deletion subject to legal exceptions.
• Right to know. Users may request information regarding collection practices, categories collected, usage purposes, third-party sharing, and business purposes.
• Right to non-discrimination. The Developer will not discriminate against users exercising privacy rights.
• Verification process. Identity verification is required through previously provided information or communication methods.
• Additional rights. Users may object to processing, request data correction or processing restrictions, designate authorized agents, or opt out of future sales of personal information. We act on an opt-out request within 15 days of receiving it.

11. Do we make updates to this notice?

The privacy notice may be updated periodically to maintain legal compliance. Material changes are communicated through prominent notices or direct notification.

12. How can you contact us about this notice?

Email: contact@marcana.app

13. How can you review, update, or delete the data we collect from you?

You can edit your profile details in the App's Profile tab and delete your data in Settings, or email contact@marcana.app for help with access, modification, or deletion requests.