Privacy Policy

1. Information we handle

• Account information. Your email address, account identifier, and authentication information are processed through Supabase and the sign-in provider you choose, such as Apple or Google.
• Onboarding and profile. The details you enter can include your name, pronouns, birthday, zodiac sign, experience, interests, and intentions. Onboarding answers can be stored on your device before sign-in and saved to your account when you sign in.
• Purchases. We keep product and transaction identifiers, verification records, permanent spell ownership, Circe credit grants and balances, and related account records. Apple processes your payment; we do not receive your full payment card number. RevenueCat helps verify and reconcile purchases.
• Spell requests. A Circe request stores the name you enter, its request identifier, and the credit used. Please avoid sensitive information about yourself or another person. We do not use a submitted name to contact that person.
• Support and technical information. We handle messages and attachments you send us, device and app-version details, diagnostic events, and a push-notification token if you enable notifications. Please do not send passwords or payment card details to support.

2. How we use information

We use information to maintain your account, save onboarding choices and spell requests, show your library, verify purchases, manage credits, restore eligible purchases, provide support, prevent duplicate or fraudulent purchase grants, and diagnose errors. Notification permissions can be changed in your device settings.

When transactional email delivery is enabled, Postmark sends welcome and verified-purchase messages to your account email. Production messages also send a private copy to Witchy's owner for account and purchase support. These messages contain basic account or purchase information, but exclude the names submitted in Circe requests.

3. Visiting this website

This informational website has no account registration, checkout, or contact form, and its code does not add advertising or analytics cookies. Railway and Cloudflare provide hosting, domain, and network services and may process technical request information, such as IP addresses, requested pages, and browser information, to deliver and protect the site. Contact links open your email application; App Store and other external links take you to services with their own privacy practices.

4. Service providers and international processing

Supabase provides authentication and database hosting; Railway hosts our website and API; Cloudflare provides domain and network services; Apple handles App Store payments; and RevenueCat supports purchase verification. Sentry processes technical error reports, with filtering intended to remove personal fields. Postmark processes transactional email when enabled. Expo and your chosen sign-in provider process information needed for their enabled features. Our support email provider processes correspondence you send us.

These providers may process information outside India, including in the United States. Access is limited to service providers and people who need it to operate Witchy, or as required to comply with law, protect users, or resolve a dispute.

5. Retention, deletion, and your choices

We keep information for as long as needed to provide the service, resolve purchase or support issues, and meet legal obligations. You can request account deletion in the app's Account screen or email support@thewitchy.app with the subject “Data Deletion Request.” We may need to verify that the account belongs to you.

Account deletion removes your account, profile, saved requests, credit balances, and linked unsent email data. De-identified transaction records may remain for reconciliation, fraud prevention, disputes, or legal obligations. Messages already sent to email providers or our owner, support correspondence, and diagnostics held by providers follow their retention settings and applicable obligations. Deleting your account does not itself request an Apple refund.

You may contact us to request access, correction, or deletion of your information, or to exercise other privacy rights available where you live. Tell us if you need help with a request involving information held by a service provider.

6. Security and children

We use access controls and reasonable safeguards to protect information, but no system can guarantee absolute security. Witchy is not directed to children under 13 or a higher minimum age required where they live. Please contact us if you believe a child has provided personal information.

7. Updates and contact

We update this policy when our services or data practices change and revise the date above. For privacy questions or requests, contact 1MILLIONSTUDIOS, Mumbai, India, at support@thewitchy.app.