Privacy Policy

1. Who We Are

Vesper is operated by Carajillo Solutions LLC, a Texas limited liability company ("Vesper," "we," "us," or "our"). Contact: vesper@caraji.io | Carajillo Solutions LLC, 13423 Blanco Rd, San Antonio, Texas 78216, USA.

2. What Vesper Is

Vesper is a private daily journal for a personal tarot and astrology practice. Each day you may draw a tarot card looking into the day ahead and, if you wish, another looking back; you write a private reflection, record a mood, and see the day's astrological transits read against your natal chart. Vesper keeps every entry so you can look back over time. It is a personal, private practice: there is no social feed and no followers, nothing you write is published or shared with anyone, and it is a learning-and-journaling tool, never a prediction.

3. Information We Collect

We collect only what the service needs:

• Account information: your email address. Vesper has no passwords: you sign in with a single-use magic link sent to your email.
• Your journal: the entries you create: the cards you draw and each card's orientation, the reflections you write, the moods you record, and the day's astrological transits computed for you. Your reflections are encrypted at rest (see Security).
• Your birth data: to compute your natal chart, you give your birth date and birth place, and optionally your birth time (the chart still works without it). From these we compute and store your chart. Your birth data and the chart computed from it are encrypted at rest.
• Your language, reminders and devices: we store your language preference, taken from the language you signed up in and changeable at any time in settings, so that anything we send you reads in it; if you turn on daily reminders, we store your reminder time; for push reminders we store a web-push subscription (an endpoint and its keys) for each device you enable.
• How you arrived: if you reached Vesper by scanning the QR code on a card someone shared, we record that your account arrived that way. It is one fixed label, the same for everyone who arrives from a shared card, and it says nothing about you or about who shared it. Nothing is written to your device.
• A card turned before you have an account: if you turn a card at Vesper without signing in, we store that card, the orientation it landed in, and the date, so it is still there if you come back to it. If you then write about it and ask us to keep it, what you wrote is stored at that moment, in the same request that gives us your email address, and it is encrypted at rest: there is no way for Vesper to hold your writing without an address to send it to. For as long as we hold it, your writing is connected to the address you gave us, because that is what the link is for. It is connected to no account until you confirm. If you confirm and keep the card, it becomes that day's entry in your journal and is kept for the life of your account, unless you had already begun that day's entry, in which case nothing is added to it and the card and your writing are deleted right then; if you do not, the card and your writing are deleted within 24 hours (see Data Retention).
• Technical information: a first-party session cookie (which holds your sign-in; if you turned a card without an account, which card that was; and, for the single page load after you ask us to keep a card, the address we just sent the link to, so the page can show it back to you), a separate first-party cookie that remembers your language, and a CSRF token, plus standard server logs. There are no advertising cookies, no third-party analytics, and no behavioral tracking.

4. How We Use Your Information

We use your information solely to provide Vesper: to store and display your journal, to compute your natal chart and the daily transits, to send magic-link sign-in emails and the reminders you opt into, and to keep the service secure. We never sell personal data, and we never use your reflections or any of your content for advertising.

5. How We Share Information

We share personal data only with the service providers below, and only to operate Vesper:

Provider	Location	Purpose
DigitalOcean, LLC	United States	Cloud hosting
Brevo (Sendinblue SAS)	European Union	Sign-in and reminder email delivery
OpenStreetMap Foundation (Nominatim)	United Kingdom / EU	One-time geocoding of your birth place into map coordinates when you create your chart

Only the birth place you type is sent for geocoding, and only once, when you create your chart. Your email, birth date, and birth time are never sent to the geocoder. If you enable push reminders, the notifications are delivered through your device's own web-push service (such as Apple, Google, or Mozilla). These providers are contractually prohibited from using your data for any purpose beyond providing services to Vesper. We do not sell, rent, or trade your personal data to anyone.

6. Security

All traffic is encrypted in transit (HTTPS/TLS). Your reflections and your birth data (and the natal chart computed from them) are encrypted at rest, so a lost or copied backup yields only unreadable ciphertext. Sign-in magic links are single-use and expire. Access to production systems is restricted and authenticated. To be clear, this is at-rest encryption, not a zero-knowledge system: while Vesper is running, our servers can read your entries in order to show them back to you and to operate the service. No security measure is absolute; if we become aware of a breach affecting your personal data, we will notify you as required by applicable law.

7. Data Retention

• Active accounts: retained for the life of the account.
• After deletion: when you delete your account, your entries, reflections, moods, draws, natal chart, and birth data are permanently erased from our systems within 30 days, and roll out of encrypted backups as those backups cycle.
• Anything kept before you have an account: a card turned without an account, and anything written with it, are deleted within 24 hours of being turned, unless you confirm your address and keep the card and that day's entry is still empty, in which case it becomes that day's entry in your journal and is retained with the rest of your account. If that day's entry was already begun, nothing is added to it and the card and your writing are deleted as you confirm. A sign-in link and the email address you gave us to be sent one are deleted within 24 hours after the link expires, whether or not it was ever used.
• Server logs: rolled after 90 days.

8. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by writing to vesper@caraji.io, or follow the steps on our data deletion page. We acknowledge requests within 5 business days and fulfill them within 30 days. California residents: we do not sell or share personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your privacy rights.

9. Children

Vesper is intended for adults. You must be at least 18 years old to hold an account. We do not knowingly collect personal information from children under 18; if you believe a child has provided us information, contact us and we will delete it.

10. International Data Transfers

Our hosting is in the United States, our email is delivered through a provider in the European Union, and birth-place geocoding is performed by a provider in the United Kingdom / EU. If you use Vesper from elsewhere, your data is transferred to and processed in these locations, protected by the safeguards described above.

11. Changes to This Policy

If we make a material change, we will notify registered users by email at least 30 days before it takes effect. For minor updates (such as adding a new service provider), we will update this page and the "Last updated" date.

12. Contact

• Privacy and support: vesper@caraji.io
• Mailing address: Carajillo Solutions LLC, 13423 Blanco Rd, San Antonio, Texas 78216, USA