Privacy Policy

The operator of Threshold is the controller of the limited information described here. For privacy questions, contact privacy@divination.site.

Threshold is built so that a reading needs no server. When you enter a question, choose who is asking, and draw, all of it - the text you typed, the shuffle, and the written interpretation - happens locally in your browser using code already downloaded to your device. That content is not transmitted to us, is not written to any database, and is not visible to us. When you close or reload the page, it is gone unless your own browser has retained it.

Like nearly every website, our web server records a short log entry for each request so the Service can run reliably and be protected from abuse. A log entry may include:

• your IP address and, in coarse terms, the network or region it belongs to;
• the date and time of the request and the page or file requested;
• the referring page, and your browser and operating-system type (the “user agent”);
• the response status and amount of data sent.

We use these logs only to operate, debug, secure, and understand the load on the Service. They are stored on our own server, are not combined with any profile about you, are not used to identify you personally, and are not sold or shared. We rotate and delete them on a rolling basis, ordinarily within about 30 days, unless an entry is needed longer to investigate a security or abuse incident.

To let the app load quickly and work offline, a service worker saves copies of pages, scripts, styles, fonts, and card images in your browser’s cache. This data stays on your device, is not readable by us, and can be cleared at any time by clearing site data for this site in your browser settings, or by uninstalling the app if you installed it.

If we later add optional preferences (for example, remembering a chosen reading style), they would be stored the same way - locally in your browser, not on our server - and this policy will be updated to say so.

The Service sets no cookies. We do not use Google Analytics or any other analytics product. We serve no advertising. There are no social-media pixels, session-replay tools, fingerprinting scripts, or third-party trackers. The app loads no scripts, fonts, or images from third-party servers; everything is served from our own domain.

We use the limited information above only to:

• deliver the pages and files you request;
• keep the Service secure and available, and detect and prevent abuse;
• diagnose technical problems and understand aggregate load;
• comply with law and enforce our Terms.

We do not use it for profiling, advertising, or automated decisions about you.

Where the UK GDPR or EU GDPR applies, we rely on our legitimate interests in operating, securing, and maintaining the Service (Article 6(1)(f)) as the basis for processing server-log data. Because a reading is processed on your device, we do not process that content at all. Where we ever ask for consent, you may withdraw it at any time.

Depending on where you live, you may have the right to access, correct, delete, or restrict processing of personal information we hold about you, to object to processing, to data portability, and to lodge a complaint with your data-protection authority. Residents of California and certain other U.S. states have rights to know what is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights; because we do not sell or share personal information or use it for targeted advertising, no opt-out of those activities is needed.

In practice the only information we hold that could relate to you is a short-lived server-log entry keyed to an IP address. To make a request, email privacy@divination.site from the connection or with detail that lets us locate the entry. We will respond as the law requires. We may need to verify your request, and some data may be exempt (for example, where retention is required to investigate abuse).

Server logs are kept only as long as needed for the purposes above - ordinarily around 30 days - and then deleted or anonymised, except where a specific entry must be retained to address a security incident or to comply with law. We keep no other records about visitors.

The Service is served over encrypted HTTPS connections and sends strict browser security headers, including a Content Security Policy that blocks third-party scripts. We keep our server patched and limit who can access it. No method of transmission or storage is perfectly secure, but because we collect so little, there is very little about you to expose.

The Service is intended for adults and is not directed to children under 13 (or under 16 where that is the local threshold). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

The Service is operated from the United States and hosted on our own infrastructure there. If you use the Service from outside the United States, the limited server-log processing described above takes place in the United States. By using the Service you understand that this processing occurs in the United States.

If the Service links to another site, that site’s privacy practices are its own. We encourage you to read the policy of any site you visit.

If we change this policy, we will update the “Last updated” date above and, for a material change, make the update reasonably prominent. Your continued use of the Service after a change means you accept the revised policy.

For any question or request about privacy, email privacy@divination.site.