Privacy Policy
Fate Loom mobile application
Version 1.5 of 01.10.2026. Effective from 01.10.2026.
This is a translation of the Russian original. In case of any discrepancy, the Russian version prevails.
1. Who processes your data
Data controller / operator of personal data:
Ruslan Radikovich Idrisov, self-employed taxpayer (professional income tax regime, Russian Federation)
INN: 745503928293
Correspondence address: poste restante, post office 143985 (Balashikha 45, 3 Pervogo Maya St.), Balashikha, Moscow Region, Russia
Privacy e-mail: privacy@fateloom.app
General support: support@fateloom.app
The operator has notified Roskomnadzor of personal data processing under Article 22 of Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" and is entered in the register of personal data operators.
2. Core principles
2.1. We collect the minimum data needed to run the Service.
2.2. We do not sell your data and do not pass it to third parties for their own marketing purposes.
2.3. We do not ask for identity document details, home address, phone number or bank card details. We never receive or store your card data — it is handled by payment providers.
2.4. You can use the basic functionality without filling in a single questionnaire.
3. What data we process
### 3.1. Account data
VK ID sign-in: numeric VK user id. We do not request or store your name, phone number or e-mail address from VK ID.
Google sign-in (available outside the Russian Federation): Google account identifier (sub), e-mail address.
Internal account identifier within the Service, registration date.
### 3.2. Questionnaires — filled in voluntarily and stored on your device
A questionnaire describes the person a reading is made for: name or form of address, date of birth, gender, life areas of interest, description of the current situation, main goal, preferences for tone and level of detail. There can be several questionnaires — about yourself and about other people; a reading uses one of them, the one you have selected.
Questionnaires are stored only in your device's memory. We do not save them on our servers: when a reading is created or a follow-up question is answered, one questionnaire — the one selected for that reading — is sent along with the request. It is used to compose the text and is not written to our database. The other questionnaires are not sent from the device. Deleting the app deletes the questionnaires.
Filling in a questionnaire is optional. Within a questionnaire only the name or form of address is required — it is what tells questionnaires apart in the list, and it does not have to be a real name; the other fields may be left empty. You can edit or delete a questionnaire at any time: Settings → Questionnaires.
A questionnaire about another person. By creating a questionnaire about another person, you give us their data on their behalf. Do so only with that person's consent to the data being processed as described in this Policy, including its transfer to the AI model provider outside the Russian Federation (sections 5–7). We cannot verify that consent and rely on your confirmation (clause 8.1.1 of the Terms of Use). To avoid sharing more than needed, a form of address or a nickname instead of a name is enough; the date of birth and the free-text fields may be left empty.
A person about whom a questionnaire has been created may contact us at privacy@fateloom.app (section 9). We do not store the questionnaires themselves, so we cannot find or delete a particular one: it is deleted by whoever holds it on their device.
Please do not enter, in free-text fields, information about health, sex life, religious or political beliefs or criminal convictions — neither your own nor another person's. Such information constitutes special categories of personal data, and the Service is not designed to process it.
### 3.3. Service usage data
The text of your question and follow-up questions; the spread type chosen and the cards drawn; the generated interpretation; interface language; time zone.
How this is stored:
- Reading history in the app — with the texts of your questions and interpretations — on your device only. What remains on the server is only the card meeting journal (next item), without questions or interpretations.
- Card meeting journal for the Arcana section: which cards came up for you — the card, its orientation (upright or reversed), the spread type, the position in it and the date; the facets of the card text you have unlocked; the card you are currently studying; milestones reached and the rewards granted for them. It is stored on the server, tied to your account and deleted together with it. It exists so that your Arcana progress survives reinstalling the app or changing devices.
- The generated interpretation text is stored on the server temporarily so you can reopen it without paying again, and is deleted automatically after 24 hours.
- The question text itself is not stored on the server — only a technical checksum remains, used to find an answer you already paid for.
Deletion in all these cases is automatic and scheduled, not on request.
### 3.4. Account economy data
Thread balance and its change history; Pro Subscription status and end date; daily streak; rewarded ad views credited; referral code and whether it was applied; ownership of appearance items (card backs and decks) bought with Threads or granted for Arcana milestones.
### 3.5. Payment data
Payment system, transaction identifier on its side, product identifier, amount, currency, status, date.
We do not receive card numbers, expiry dates, CVV or any other payment instrument credentials.
### 3.6. Technical data
IP address, operating system type and version, device model, application version, installation identifiers, server request logs, advertising identifier (when advertising is shown).
To determine which sign-in and payment methods are available, the server looks up the country of the IP address in a local database on its own servers; the IP address is not sent to third parties for this. The database used is IP Geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0. The interface language and account data are not used. Ads are served by the Yandex Advertising Network through the Yandex Mobile Ads component built into the app, which itself collects the data needed to serve ads and sends it to YANDEX LLC; the app does not request precise location for ads or provide personalization consent on the user's behalf.
### 3.7. Data that stays only on your device
Questionnaires (clause 3.2), reading history, application settings, access tokens in the device secure storage, local reminders. This data is removed together with the application.
### 3.8. Voice input of a question
You can dictate your question. Voice input starts only when you tap the microphone icon and requires a separate permission to access the microphone; you can revoke that permission in the device settings at any time.
Speech is recognised by the speech recognition service of your device — as a rule, the service of Google LLC on Android devices and of Apple Inc. on Apple devices. The voice recording is processed by that service: it may transmit the recording to its servers, including outside the Russian Federation, and processes it under its own privacy policy. The operator does not receive, store or transfer the voice recording to anyone — only the recognised text is returned to the application.
The recognised text is placed in the input field, where you can correct it. It is transferred to the operator only after you send the question yourself, and is processed as the text of the question (clause 3.3).
If you do not want your speech to be processed by such a service, do not use voice input: you can always type the question on the keyboard.
4. Why we process data and on what basis
| Purpose | Data | Legal basis (RF / GDPR) |
|---|---|---|
| Registration, sign-in, account security | 3.1, 3.6 | Performance of a contract / Art. 6(1)(b) |
| Generating readings and answers | 3.2, 3.3 | Consent; performance of a contract / Art. 6(1)(a), 6(1)(b) |
| Threads, subscription and bonus accounting | 3.4 | Performance of a contract / Art. 6(1)(b) |
| Payments, receipts, refunds | 3.1, 3.5 | Contract; legal obligation / Art. 6(1)(b), 6(1)(c) |
| Support and handling requests | 3.1, 3.3, 3.5 | Contract; legal obligation / Art. 6(1)(b), 6(1)(c) |
| In-app notifications and reminders | 3.1, 3.6 | Consent / Art. 6(1)(a) |
| Advertising and rewarded views | 3.6 | Consent / Art. 6(1)(a) |
| Referral programme | 3.1, 3.4 | Performance of a contract / Art. 6(1)(b) |
| Arcana section: recording card meetings, unlocked facets, milestones and their rewards | 3.3, 3.4 | Performance of a contract / Art. 6(1)(b) |
| Anti-fraud, anti-abuse, multi-account detection | 3.1, 3.4, 3.6 | Legitimate interest / Art. 6(1)(f) |
| Improving the Service on anonymised data | anonymised 3.3 | Legitimate interest / Art. 6(1)(f) |
Operations performed: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion, destruction. Processing is carried out both by automated and non-automated means.
5. Automated text generation (AI)
5.1. The text of a reading is produced by a third-party large language model. It receives: the cards drawn, the spread type, your question and — if any questionnaires exist — the questionnaire selected for that reading.
5.2. It does not receive: your e-mail address, your VK or Google identifiers, your account identifier, payment data, or your IP address. The request carries nothing by which the provider could link it to your account.
5.2.1. The questionnaire passes through to the provider and is not stored on our servers (clause 3.2). How the provider retains it is determined by that provider.
5.3. Text generation is not a decision producing legal effects concerning you and is not solely automated decision-making within the meaning of Article 22 GDPR. The text is entertainment content (section 4 of the Terms of Use).
5.4. If you do not want questionnaire data to reach the AI provider, do not create questionnaires or delete the ones you have: the reading will be generated without a questionnaire. While at least one questionnaire exists on the device, one of them is selected and is sent with the reading.
5.5. The operator does not control how the AI provider stores and uses the text sent to it beyond what is needed to generate the reading. Do not enter into the question or a questionnaire anything you would not want disclosed.
6. Who we share data with
We engage the following processors. Each receives only the scope needed for its function.
| Recipient | What it receives | Purpose | Country |
|---|---|---|---|
| VK LLC (VK ID, INN 7743001840) | Authorization code and device identifier issued by VK ID | Confirming VK ID sign-in | Russia |
| YANDEX LLC (Yandex Mobile Ads) | IP, device and impression data, advertising identifier when available | Serving ads and recording impressions | Russia |
| ROBOKASSA LLC (INN 5047063929) | Amount, order contents, e-mail for the receipt | Payment acceptance and fiscalisation | Russia |
| Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek) | Question text, cards, the questionnaire selected for the reading | Generating the reading text | China |
| Server v arendu LLC (HOSTKEY, INN 7719408546) | Data hosted on the servers | Hosting the server side | Russia |
Data may also be disclosed to public authorities on a reasoned request in the cases and manner prescribed by law.
We do not share data with advertisers, data brokers or other parties for their own purposes.
Independently of the operator, VK LLC, Google LLC and YANDEX LLC receive data directly through their own services and software components (VK ID sign-in, Google sign-in outside the Russian Federation, the ad component) and process it as independent controllers under their own privacy policies published on their websites. The operator is not responsible for such processing for those parties' own purposes.
In the same way, bypassing the operator, the voice recording made during voice input is received directly by the speech recognition service of your device (clause 3.8).
7. International transfers
7.1. The operator transfers personal data outside the Russian Federation to one recipient only — the AI model provider DeepSeek (People's Republic of China) — and only to generate the reading text. The data transferred is listed in sections 5 and 6.
7.2. The operator has notified Roskomnadzor of the cross-border transfer separately from the processing notification, under Article 12 of Federal Law No. 152-FZ.
7.3. The cross-border transfer is carried out on the basis of your separate consent, given as a standalone document by a separate action. The level of protection of data subjects' rights in the People's Republic of China may differ from that established by the law of the Russian Federation.
7.4. Without this transfer the core function of the Service — generating readings — is impossible, so consent to it is a mandatory condition of registration. Withdrawing it ends the processing and leads to deletion of the account in the same way as withdrawing consent to personal data processing.
7.5. The Service's servers are located in the Russian Federation. Collection, recording, systematisation, accumulation, storage, updating and retrieval of personal data of citizens of the Russian Federation are carried out in databases located in the Russian Federation (Article 18(5) of Federal Law No. 152-FZ); the transfer described in clause 7.1 takes place only after such processing.
7.6. For users in the EEA, UK and Switzerland. Transfers of your data outside the EEA are made on the basis of your explicit consent (Article 49(1)(a) GDPR), after you have been informed of the possible risks of such transfers in the absence of an adequacy decision and appropriate safeguards.
8. How long we keep data
| Category | Retention |
|---|---|
| Account data, account economy | Until the account is deleted |
| Questionnaires | Not stored on the server. On your device — until you delete the questionnaire, delete the account, sign in on this device with a different account, or delete the app |
| Generated interpretation text | 24 hours, then deleted automatically |
| Reading history in the app | On your device only, until you clear it or delete the app |
| Card meeting journal and Arcana progress | Until the account is deleted |
| Payment data | 3 years from the payment date; longer if a dispute is pending |
| Server logs, IP addresses | Overwritten as they accumulate, no longer than 6 months. Logs record only request and account identifiers — question texts, interpretations and questionnaires never reach them |
| Consents and acceptance records | 3 years after withdrawal of consent or account deletion |
| Marker of a previously deleted sign-in method | 12 months. What is stored is an irreversible cryptographic fingerprint, not an identifier: it cannot be used to recover your identity or to check whether a particular person has an account. Its only purpose is to stop one-off signup gifts being collected repeatedly |
| Support correspondence | 3 years from the request |
After account deletion, data is deleted or anonymised within 30 calendar days, except data we must retain by law or need to defend an already asserted claim.
9. Your rights
You have the right to:
- obtain confirmation that we process your data, and information about the operator, purposes, methods, retention periods, sources and the list of data processed;
- receive a copy of your data;
- request rectification, blocking or erasure of data that is incomplete, outdated, inaccurate, unlawfully obtained or no longer needed for the stated purpose;
- withdraw consent;
- object to processing based on legitimate interest;
- lodge a complaint with the supervisory authority or a court.
### 9.1. Additional rights under GDPR (EEA, UK, Switzerland)
- Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21);
- withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3));
- the right to lodge a complaint with your local supervisory authority (Art. 77).
We answer requests under GDPR within one month, extendable by two further months for complex requests, with notice to you.
The Service is not directed at users in the EEA, the UK or Switzerland, and no representative under Article 27 GDPR has been appointed. The rights listed above are nevertheless respected for any user who contacts us.
### 9.2. How to exercise your rights
- in the app: Settings → Questionnaires — edit and delete questionnaires; Settings — delete the account;
- by e-mail to privacy@fateloom.app from the address linked to your account, or quoting your account identifier.
We respond within 10 business days of receiving a request. This may be extended by up to 5 business days, with notice to you explaining why.
Withdrawing consent stops the processing for which consent was the only basis. If the Service cannot be provided without that data, withdrawing consent is equivalent to requesting account deletion.
10. How we protect data
We apply legal, organisational and technical measures required by Article 19 of Federal Law No. 152-FZ, including:
- the operator is personally responsible for organising personal data processing;
- the list of persons with access to data is defined and access is segregated;
- data in transit between the app and the server is encrypted (TLS);
- access tokens are held in the device secure storage;
- access and data operations are logged;
- backups and protection against unauthorised access are in place;
- an assessment of potential harm to data subjects and internal compliance control are carried out.
In the event of an incident involving unlawful transfer of data, we notify Roskomnadzor within 24 hours of the incident and within 72 hours of the results of the internal investigation, as required by Article 21(3.1) of Federal Law No. 152-FZ. Where GDPR applies, we notify the competent supervisory authority within 72 hours under Article 33 GDPR and, where required, notify affected users under Article 34.
11. Children
The Service is intended for persons aged 18 or over. We do not knowingly collect children's data. If you believe a child has provided us with their data, write to privacy@fateloom.app and we will delete it.
12. Cookies and similar technologies
The mobile application does not use cookies. It uses device local storage for settings, session and history, and the advertising identifier for serving advertisements. You can reset or limit the advertising identifier in your operating system settings.
The website https://fateloom.app may use strictly necessary technical cookies.
13. Changes to this Policy
We may amend this Policy. New versions are published in the app and at https://fateloom.app/legal/privacy.
If changes affect the data processed, the purposes of processing or the recipients, we notify you in the app and ask you to accept the new version and, where required, to give fresh consent.
14. Where to complain
Please write to privacy@fateloom.app first — we aim to resolve matters without a dispute.
Russian supervisory authority: Roskomnadzor, 7 bldg. 2, Kitaygorodsky proezd, Moscow 109992, Russia; https://rkn.gov.ru
If you are in the EEA, the UK or Switzerland, you may also lodge a complaint with your national data protection authority.