Privacy Policy

The controller under the General Data Protection Regulation (GDPR) is Sirio Sperandio, Rechberggasse 1, 1100 Vienna, Austria, email [email protected]. Dear Fortuna is the English sister site of MeinOrakel (meinorakel.com) and is run by the same operator. More details are in the imprint.

All traffic to dearfortuna.com passes through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare delivers the pages as a content delivery network (CDN), forwards requests to our server and protects the site against attacks and automated abuse. For this, Cloudflare processes your IP address, the address of the page you request, technical details of your browser (user agent) and the time of the request.

Cloudflare acts as our processor under its data processing addendum. It handles each request in a data center of its worldwide network, usually the one closest to you, and processes the related technical records in data centers in the USA and in Europe. Transfers to the USA rest on Cloudflare’s certification under the EU-US Data Privacy Framework; if that certification ended, the EU standard contractual clauses would apply.

With our current settings, Cloudflare sets no cookies in normal use. If Cloudflare shows a security check, for example during an attack, it sets a cookie called cf_clearance to record that you passed. That cookie is strictly necessary for security (§ 165 (3) of the Austrian Telecommunications Act 2021, TKG 2021), so it needs no consent.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in delivering the site quickly and securely). Cloudflare sets no fixed period; it keeps this data as long as its business purposes require. Its privacy policy: cloudflare.com/privacypolicy.

Our application runs on servers of netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany, and is managed with Dokploy. This includes the web server of this site, our backend and the small database that counts the daily readings (section 5).

There is no transfer to a third country for hosting; netcup is subject to the GDPR and has contractually committed to complying with it. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running the service securely).

With every request, your browser sends technical data to our server: your IP address (passed on by Cloudflare), the date and time, the requested address, the referrer URL and the user agent. Our reverse proxy and our web server can keep short technical records of these requests. Purpose: operational security, protection against abuse and error analysis. We keep them only as long as these purposes require and do not use them to identify visitors. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable service).

For error and performance analysis of our backend we use Grafana Cloud (provider: Raintank, Inc., doing business as Grafana Labs). It receives minimized technical application logs and server metrics, in particular time stamps, service and version, the endpoint template, the HTTP status, the duration, the type of error and, where needed, pseudonymous request IDs. These logs contain no IP addresses and no browser details, and the content of AI requests is removed before they are sent. Processing takes place in the region Germany chosen for our stack; retention is 14 days. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable service).

Tarot readings and questions to Fortuna are free, with a daily limit for each visitor (see our terms of use). To keep to it, our backend keeps counters in its own Redis database on our servers: one for questions to Fortuna, dream readings and personal answers on the yes or no wheel together, and two for tarot (one for the cards drawn, one for the written interpretations). Each counter is stored under your IP address and the current date (UTC) and holds the number used that day. It deletes itself automatically one minute after midnight UTC, at the end of the day it counts.

Dear Fortuna and our German sister site, MeinOrakel, use the same backend, so these counters are shared: what you use on one site counts on the other.

A separate counter limits how many requests an IP address can send per minute; it deletes itself after 60 seconds. We use these counters for nothing else.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in keeping a free service fair and protecting it against abuse and runaway costs).

To write a tarot reading, an answer from Fortuna, a dream reading or a personal answer on the yes or no wheel, we use the API of OpenAI: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, Ireland. Its affiliated companies in San Francisco, USA, are involved as processors.

Data processed: your question or dream description, if you write one; for the yes or no wheel, also the wheel’s answer; the cards drawn, their positions and the name of the spread; the text the AI writes; and technical metadata (model, number of tokens, response time).

Under OpenAI's contract, requests made through the API are not used to train OpenAI's models. OpenAI may keep inputs and outputs for up to 30 days to check for misuse and then deletes them, unless the law requires it to keep them longer or it is reasonably necessary to protect its services or a third party from harm.

Your reading is not saved in a database or a reading history on Dear Fortuna. There are no accounts and no share links. To keep the service working, the request and the answer are kept for up to 30 days in our AI monitoring, and our AI provider, OpenAI, may keep them for up to 30 days to check for misuse. The AI monitoring is described in section 8.

Before your first reading we ask for your consent to this processing (section 9). Please do not put names, health details or other information that identifies you or other people into your questions or dream descriptions. Dreams can touch on health or other sensitive matters; share only what you are comfortable with.

You do not have to give us any of this: the horoscopes, the yes or no tarot and the wheel without a question work without it. Purpose: writing the reading you ask for. Legal basis: Art. 6(1)(b) GDPR (providing the service you request) and, where a question touches on sensitive matters such as health, Art. 9(2)(a) GDPR (your explicit consent, given in the consent dialog).

Transfer to a third country: USA, safeguarded by the EU standard contractual clauses. OpenAI's privacy policy: openai.com/policies/eu-privacy-policy.

The horoscopes are written in advance for all twelve signs, without any information about you. We do not link the signs or periods you open to you. Opening one is a normal page request: it passes through the delivery and logs described in sections 2 and 4 and is counted anonymously as described in section 11.

The yes or no tarot draws its card in your browser and shows a fixed meaning written in advance. No AI is used when you draw, and the draw is not sent to our backend. Our audience measurement (section 11) counts each draw as an anonymous event with the answer (yes, no or not yet) and whether the card was reversed. Your question is never part of it, because you never type it.

The yes or no wheel turns in your browser, and its answer is chosen at random without AI. If you spin without a question, nothing goes to our backend or to our AI provider. If you type a question, it is sent together with the wheel’s answer to our AI provider to write Fortuna’s personal answer, as described in section 6. Our audience measurement counts each spin as an anonymous event with the answer (yes, no or maybe) and whether a personal answer was asked for, never with your question.

For the technical monitoring of the AI processing we use Logfire, a service of Pydantic Services Inc., in its EU region. It receives the model, the duration, the number of tokens, the costs and technical IDs, and also the content of the AI requests and of the answers generated from them: your question or dream description, the cards and the reading.

We use this content only to find errors and to check the quality of the AI results; it is not used for advertising or to train AI models. It is deleted automatically after 30 days. Where Pydantic transfers data outside the EU, it relies on the EU standard contractual clauses.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in finding errors in an AI-based service) and, where a question touches on sensitive matters, Art. 9(2)(a) GDPR (your explicit consent, section 6). You can object to this processing under Art. 21 GDPR by writing to [email protected].

We set exactly one cookie, mo_ai_consent, and only when you choose "I agree" in the dialog shown before your first AI reading. It stores the version of the consent text you agreed to, your decision and the time of the decision, so that we do not have to ask again on every visit. It expires after 12 months. When the consent text changes, we ask you again.

If you choose not to agree, no cookie is set and no reading is written. You can withdraw your consent at any time with the button at the end of this section or by deleting the cookie in your browser settings; we will then ask again before the next reading. Withdrawing does not affect readings already written.

Storing this cookie is strictly necessary for the service you request (§ 165 (3) of the Austrian Telecommunications Act 2021, TKG 2021). The consent it records is the one described in section 6.

Apart from this cookie we set no cookies and use no local storage, no advertising and no tracking tools. That is why there is no cookie banner. Only if a page fails to load does your browser note the time in its session storage for the current tab, so that the page does not reload itself in a loop; this is strictly necessary and never leaves your device. (On cookies Cloudflare may set, see section 2.)

You have not given this consent on this device.

To find and fix technical errors we use Sentry (Functional Software, Inc., 45 Fremont Street, San Francisco, USA). Our web server reports its own errors to Sentry. If a page fails in your browser, a small script of this site sends the error message, the technical stack trace, the address of the page and your browser’s user agent to our server, which passes them on to Sentry. We do not load Sentry’s own script in your browser, the text you type is not included, and no cookies are set.

In production, our web server also sends performance traces for about one in ten requests to Sentry: the requested address, how long the request took and the technical steps of handling it. They contain no cookies, request headers or request bodies. Sentry keeps this data for up to 90 days.

We use the EU region of Sentry; the data is processed in a data center in the EU (Frankfurt). For any access from the USA, EU standard contractual clauses are in place.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a stable and secure service). You can object to this processing under Art. 21 GDPR by writing to [email protected]. Sentry's privacy policy: sentry.io/privacy.

To measure our reach anonymously (page views, unique visitors, entry and exit pages, referring sites) we run Umami on our own servers (section 3). The script loads from our own address, u.dearfortuna.com. The script stores nothing on your device: no cookies, no local storage and no identifier that would follow you across devices. It sends your screen size, your language, the page title and the referring page to our server, which adds your browser, operating system, device type and approximate location (country, region and city).

Unique visitors are counted with a visitor hash that the server forms from your IP address and browser details and that changes at least once a month. The IP address itself is not stored, and we do not use the hash to identify anyone. Before a page address is counted, every URL parameter except a few campaign and source tags (such as utm_source) is removed. We also count a few anonymous events without their content, for example that a tarot reading was shown or a question to Fortuna was asked; the event for the yes or no tarot also records the answer and whether the card was reversed, and the event for the yes or no wheel records the answer and whether a personal answer was asked for (section 7). The results are only looked at in aggregate, and no data is passed on to third parties.

We keep these statistics as long as we need them to compare the reach of the site over time. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in understanding how the site is used). You can object under Art. 21 GDPR by writing to [email protected].

The fonts of this site are served from our own server; your browser does not contact Google or any other font service. Links to other sites, such as Instagram or MeinOrakel, are plain links: nothing is loaded from those sites until you click one.

We pass data only to the recipients named in this policy. We have data processing agreements under Art. 28 GDPR with our processors. We do not sell or share personal data, and we do not pass it on for advertising.

If you email us, Google, our mail provider, receives your address and your message. We use them only to answer you (Art. 6(1)(f) GDPR) and delete them once the matter is closed.

You can get a copy of the safeguards for transfers to the USA by writing to [email protected].

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and you can withdraw a consent at any time (Art. 7(3)). Because the operator of this site is based in the EU, these rights apply wherever you live.

Right to object: where we rely on our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time, for reasons arising from your particular situation.

Just write to [email protected]. Because there are no accounts and readings are not saved in a database, we usually hold very little that we could link to you.

You also have the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria, [email protected].

We make no automated decisions that have legal or similarly significant effects on you (Art. 22 GDPR). A reading written by AI is not such a decision.

Dear Fortuna is meant for people aged 16 and over and is not directed at children. We do not knowingly process personal data of children under 16. If you believe a child has sent us personal data, please write to [email protected] so that we can delete it where we are able to find it.

We update this policy when our services or the legal requirements change. The current version is always available at dearfortuna.com/privacy.