Privacy Policy

The Spore Patch Ltd (trading as The Spore Patch) operates The Spore Oracle (thesporeoracle.world) and is the data controller responsible for the personal information collected through this site. The company is being incorporated in England and Wales with its registered office at 66 Paul Street, London EC2A 4NA.

If you have questions about this policy, write to us at hello@thesporeoracle.world.

We collect only what is needed to root the experience in place:

• Account details: email address and authentication status when you create an account or sign in.
• Reading notes: the spreads you draw, card positions and any notes you choose to save in the members' chamber.
• Contact messages: name, email address and message content when you write to us.
• Payment information: handled by Stripe. We do not store full card numbers or bank details on our own servers.
• Technical information: browser type, IP address and session data required to keep the site secure and available.

We use your information to:

• Provide oracle readings, membership access and the journal shop.
• Secure your account and verify your identity.
• Process payments and manage subscriptions through Stripe.
• Answer your questions and respond to your correspondence.
• Keep the site running reliably and protect against misuse.

We do not sell your personal information. We do not use it to train external AI models.

We rely on a small number of trusted service providers to keep the forest alive. Each receives only what is necessary to perform its role, and each is bound by appropriate data-protection and security obligations.

• Lovable Cloud (built on Supabase) — hosting, authentication, database, file storage and server functions.
• Cloudflare — content delivery, edge caching and basic protection against abuse.
• Stripe (Stripe Payments UK Ltd) — payment processing, subscription billing and the customer billing portal.
• Resend — sending transactional and membership emails (receipts, sign-in confirmations, newsletter, Moon Letter).
• Google — optional sign-in via Google OAuth, and Google Fonts delivery.
• Google Analytics 4 — anonymised usage statistics, loaded only after you accept analytics cookies.
• Lovable AI Gateway — text-to-speech generation for the optional "Whispered Draws" audio feature. Card text is sent for synthesis; no personal information is included.
• Zoho Mail — handling email sent to and from hello@thesporeoracle.world.

Some of these providers may process data outside the UK or EEA. Where they do, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or the provider's UK/EU adequacy status.

Under UK GDPR, we rely on the following lawful bases:

• Contract — to deliver your account, membership, purchases and downloads.
• Legitimate interests — to keep the site secure, prevent abuse, send service-related emails and improve the experience.
• Consent — for the newsletter, the Moon Letter, analytics cookies and any optional marketing communications. You can withdraw consent at any time.
• Legal obligation — to keep tax, accounting and payment records as required by law.

We use a small number of cookies and similar technologies:

• Essential — to keep you signed in, remember your consent choices and protect the site. Always on.
• Payment — set by Stripe during checkout to process your payment securely.
• Analytics — Google Analytics 4 (`_ga`, `_ga_*`), loaded only after you accept analytics cookies in the consent banner.

You can change your cookie choices at any time by clearing the consent cookie in your browser, or manage cookies through your browser settings. If you disable essential cookies you may not be able to sign in or save readings.

• Account information: kept while your account is active. You may delete your account at any time by contacting us.
• Saved readings: kept until you delete them or delete your account.
• Contact messages: retained for up to 12 months after we respond, unless you ask us to remove them sooner.
• Payment records: kept as long as required by law for tax and accounting purposes.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and the readings you have saved.
• Export your saved readings in a readable format.
• Object to certain processing or withdraw consent.
• Lodge a complaint with a data protection authority.

To exercise any of these rights, contact us at hello@thesporeoracle.world.

We use industry-standard measures to protect your information, including encryption in transit (TLS), hashed passwords and access controls on our database. No system is completely immune from risk, and we cannot guarantee absolute security.

The Spore Oracle is intended for people aged 16 and over. We do not knowingly collect personal information from children under 16. If you believe we have done so, please contact us so we can remove it.

We may update this Privacy Policy as the site grows. When we do, we will revise the date at the top of this page. If a change is significant, we will also notify you by email or through the site.