Privacy Policy
How Witchr handles your account credentials, browser storage, Oracle queries, and practitioner data.
1. Core Data Philosophy
Witchr is built around personal self-guidance and reflection. We do not sell your personal data, run third-party advertising trackers, or inspect your private ritual reflections. We collect and process only the minimal technical information necessary to authenticate members, manage guest preview access, deliver service emails, and power interactive divination tools.
2. Account Authentication via Supabase
When you register an account or log in to Witchr Sanctum, your authentication credentials and session tokens are managed through hosted authentication infrastructure powered by Supabase Auth.
- Email & Password: If you choose password-based sign-in, your email address and securely hashed password credentials are submitted to Supabase. Witchr application servers do not store or view your plaintext password.
- Continue with Google (OAuth): If you choose Google sign-in, you authenticate with Google using standard PKCE flow. We request only basic identity scopes (
openid email profile) to verify your email address and name. We do not request or receive access to your Gmail messages, Google Drive files, contacts, calendar, or other Google account services. - Authentication Cookies: When authenticated, session tokens (access and refresh tokens) are stored in browser cookies prefixed with
sb-*-auth-tokenmanaged by@supabase/ssr. In production environments, these cookies are markedSecure(transmitted over HTTPS) withSameSite=Lax. They contain signed session tokens accessible to client-side scripts to support both browser state and server-side middleware validation.
3. System Emails via Resend
Transactional account management emails—including initial email verification links and password recovery requests—are dispatched through Resend as our configured SMTP email delivery service.
We transmit only your recipient email address and the secure, single-use authentication callback token required to deliver these service messages. We do not use your address for marketing emails or sell it to third-party lists.
4. Oracle Consultations & AI Processing
When you submit questions to the Oracle in Witchr Sanctum or use the ritual intention synthesizer, your submitted text and practice parameters (such as drawn tarot card identifiers or ritual focus) are processed server-side through our configured third-party artificial intelligence provider (Google Gemini or OpenAI).
Transient Inquest Synthesis: The AI provider processes the prompt server-side to generate a symbolic occult interpretation and returns the synthesized response to your browser. Your conversation history is maintained on your local device.
Sensitive Inquiries: We advise practitioners not to enter personally identifying information, medical records, financial account numbers, or passwords into Oracle inquiry prompts.
5. Guest Previews, Cookies & Technical Storage
Witchr uses limited, purpose-specific cookies and browser storage to operate the platform:
witchr_guest_session)To allow unauthenticated visitors to experience one trial Oracle inquiry before joining the Sanctum, an anonymous, randomly generated session identifier is stored in an HTTP-only, SameSite=Lax cookie (marked Secure in production).
To enforce the single-inquiry preview limit fairly across distributed servers, an anonymous technical record containing your guest session identifier, a reservation lock token, an inquiry counter (questions_count), and timestamps is recorded in our Supabase database. This technical record does not contain your name, email, or question text.
Your guest dialogue is saved locally in your browser’s localStorage. When you register or sign in, this local dialogue is automatically carried over into your account-scoped history in that browser so your inquiry remains intact.
6. Grimoire Entries, Streaks & Local Storage (No Cloud Sync)
A core architectural principle of Witchr Sanctum is that your spiritual journal remains on your device:
Browser-Local Storage: All saved Grimoire readings (Daily Tarot cards, Three-Card spreads, and ritual folios), practice streaks, and Sacred Marks progress are stored exclusively in your browser’s local storage (localStorage).
Account Isolation: When signed in, records are partitioned by your unique account identifier (e.g., witchr_sanctum_grimoire_readings_usr_...). This prevents records from being displayed to other accounts that use the same browser profile.
No Cloud Synchronization: Witchr does not copy, transmit, or synchronize your saved Grimoire entries or streak count to Witchr cloud servers. If you clear your browser cache, browse in private or incognito mode, or switch to a different device or browser, your locally saved entries will not transfer automatically.
7. Data Retention, Erasure & Account Deletion
Because your Grimoire folios, reflection notes, and conversation dialogue are stored client-side in your own browser, you have immediate and direct control over their removal. Clearing your browser’s local storage or site data for witchr.com removes these records permanently from that device.
Note: Deleting server-side account data does not automatically wipe local browser storage on your personal devices; you must clear your local browser storage directly if you wish to remove stored folios.
Your server-side account record (your email address, encrypted authentication credentials, and account identifier) is maintained in Supabase for the duration of your active membership to allow you to log in.
To request formal deletion of your server-side account, please send an email to help@witchr.com from the email address associated with your Witchr account.
- Identity Verification: For your security, we will verify that you control the registered email address before any account deletion is executed.
- Manual Processing: Deletion requests are processed manually rather than through an automated feature. We do not provide a fixed turnaround guarantee, though requests are handled as promptly as practicable.
- Scope of Server Deletion: Upon completion, your authentication account record is deleted from Supabase. As noted above, any folios saved locally in your personal browser must be cleared by you within your browser settings.
8. Operator Information & Contact
Witchr is operated from North Carolina, United States.
If you have questions regarding this Privacy Policy, your personal data, or account deletion, please contact us at: help@witchr.com.