Privacy

Last updated 21 October 2026

Scryway is a small site for divination, perception practice, meditation and study, with a private journal. Most of it works without an account and stores nothing about you. This page explains what changes when you sign in.

Without an account

Drawing cards, casting the I Ching, reading the libraries and sharing a reading link involve no account and no personal data. Settings such as your chosen deck, and anything you type on the numerology page, are remembered in your own browser only. Our hosting provider, Vercel, keeps ordinary server logs (such as IP address, browser type and the pages requested) for a short time to run and secure the service.

With an account

If you sign in, we store:

Your email address, used to sign you in and send sign-in links, and for product news only if you ask for it.
If you fill in your profile: a username, and optionally what to call you, your real name, pronouns, home time zone and how you heard about the site. Your real name is hidden from other people unless you choose otherwise.
If you sign in with Google: your name and profile picture, as provided by Google. We do not post to Google or read anything else.
The sessions you save in each practice and the journal entries made from them: tarot and Lenormand readings (with any question you record), I Ching casts, rune and passage draws, oracle decks you write, remote-viewing and Zener sessions with their notes and sketches, meditation sessions, mantra counts, rituals and routines, and your reflections, tags, investigations and predictions.
Your dream journal, including any voice notes you record. Recordings are kept in private storage that only your account can reach.
If you save a birth chart: the date, time and place of birth you enter (with the place’s coordinates) and the chart worked out from them. A chart can be for someone else, so please save another person’s details only if they are happy for you to.
The notes you write on cards, the spreads you design, your reading bookmarks and your learning progress.
If you make your own deck: the card photos you upload (resized in your browser before upload) and the meanings and notes you write for them.
Follow-up questions you ask about a reading, and the answers, so the conversation stays with that reading.
If you turn on calendar reminders: your reminder times and a private link for your calendar app. The calendar events name the practice and date only; your calendar provider stores them under its own policy.
If you turn on notifications: an address for your device from its browser’s push service, your reminder times and your time zone. Notifications carry only general text, such as the Moon’s phase or “Time to sit”.

Everything you save is private to you. A reading you share shows the standard deck, never your photos, question or names. Nothing you save is shown to other users, used to train anything, sold, or shared with advertisers. We do not run advertising or third-party analytics. You can also encrypt your journal notes with a passphrase from your account page, so that nobody else can read them.

Other services that see some data

Chart calculations are made by Scryway’s own ephemeris service. It receives the moment and the coordinates of the place, never a name or your account, and stores nothing.
Google sign-in: where the Google button is shown, your browser loads it from Google, so Google can see that you opened the sign-in page.
Dictation in the dream journal uses your browser’s own speech service. Some browsers (Chrome, for example) send the audio to the browser maker to turn it into text. Typing, or recording a voice note, avoids this.
Notifications are delivered by your browser’s push service (Google, Apple or Mozilla), which sees only the general text.
Follow-up questions about a reading, where offered: the question, the cards in that reading and the site’s written meanings for them are sent to Anthropic, the AI model provider, to generate the answer. Your email address and account details are not sent. Anthropic’s handling of API data is described in its own privacy policy.
Error reports: when a page breaks, the error message, the page address (without anything after a “?”) and your browser type are recorded so we can fix it. They are not linked to your account.

Where it is kept

Account data, photos and voice notes are stored by Supabase, our database and sign-in provider, on servers in the United States. Access is restricted so that each account can read and write only its own rows and files. Encrypted nightly backups are kept in our GitHub account.

What the site’s operators can see

A small number of administrators can see, for each account: the email address, the profile (including a real name you have hidden from other people), when it was created and last signed in, how it signs in, and how many entries of each kind it has saved, with dates. They may keep private notes on an account, for example about a support request. They can suspend or delete an account and remove a shared spread when it breaks the terms of use. The admin tools do not show what you wrote: your notes, questions, readings, impressions, dreams and photos are not shown, and notes you encrypt cannot be read by anyone without your passphrase. Every admin action is recorded in a log that cannot be edited. As with any online service, the database provider and anyone with direct database access could technically reach stored data; that access is limited to maintaining the service.

Cookies

Signing in sets a session cookie so you stay signed in. Settings and unsent drafts are kept in your browser’s own storage. There are no tracking or advertising cookies.

Deleting your data

Open your account page and choose Delete my account. That removes your account and everything saved with it, including photos and voice notes, straight away. You can also delete individual entries, and download a copy of your journal first.

The database is backed up every night in encrypted form, and each backup is deleted after 30 days, so anything you delete is gone from the backups within 30 days. Backups are used only to recover from a fault.

Children

Scryway is not directed at children under 13 and we do not knowingly collect their data.

Changes and contact

If this policy changes, the date at the top will change with it. Questions about your data can be sent by replying to any sign-in email from Scryway.