Privacy Policy

Privacy Policy

Effective date: September 24, 2026

Introduction

Brews and Bloom is a small, person-run tarot reading room and shop founded by Dylan W. LaRue. This policy explains what personal information we collect when you visit the site, book a reading, place an order, or use one of the free tools, and how we look after that information once it's in our hands.

We try to collect as little as possible, keep it only as long as we need it, and treat it the way we'd want our own data treated. If anything here is unclear, or you want a copy of what we hold about you, write to us at dylan@brews-and-bloom.com and we'll respond as quickly as we can.

By using the site you agree to the practices described below.

What we collect

The information we hold depends on what you do on the site.

When you request an order or reading: your name, email address, shipping address (for physical items), the items or services requested, the price recorded for your request, and the request and transaction history. Service listings show Free or a price. Paid service arrangements are confirmed by email, and shop requests are unpaid until we agree the total by email and provide PayPal details. Submitting a live booking request does not collect payment or use Wick Credits. This website does not collect payment card numbers or bank details.

When you request an instant reading or dream interpretation: your email address (so we can send the link), the question or dream text you submitted, and the reading or interpretation we generated for you. Each reading has a private share-link containing a long random token. Anyone you give that link to can open the reading. Dylan, the site owner, can also review the submitted text and generated reading in the restricted admin portal for support and reading preparation.

When you request a live reading with Dylan: we save your name, email, appointment, memo, and service-specific preparation with the booking. Birth details, dream descriptions, practical preparation, memos, and access notes are visible to Dylan beforehand. Your optional private question and career or relationship context are sealed until the appointment ends and Dylan marks the reading complete. New private questions are encrypted; they are omitted from confirmation emails and calendar descriptions. After confirmation we create a Google Calendar event and, for online sessions, a Google Meet link. In-person bookings include location and travel details. An assistant may submit a booking only with your permission.

When you subscribe to the newsletter: your email address (and your name if you give it), the date you signed up, and your consent status. Newsletter subscriptions are mirrored to a private Google Sheet so we can keep a backup outside the database.

When you create an account: your email address, name and optional birthday, sign-in and session records, Wick balance and reward information, reading allowance usage, letter preferences, and order, booking, and reading history tied to that account. Sign-in uses an emailed magic link. Guest submissions can appear in an account after its email is verified, unless the record already belongs to another account. Saved automated readings from the same browser can also join your account when you sign in; balances and allowances follow your account across devices.

When you save journal entries, dreams, or cards: we store the content you choose to save, including tarot notes, dream text, interpretations, titles, dates, moods, lucid-dream choices, symbols, and saved-card details. Wishlists, submitted reflections, and community stories are also stored with your account when you are signed in. Your saved journals are not published publicly. Dylan can view them in the admin portal for support and reading preparation. Community stories and reflections intended for publication follow their submission and moderation settings.

When you send a contact message or event inquiry: we save the name, reply-to email, message, and any event, phone, location, date, or group details you submit before attempting to notify Dylan by email. This lets Dylan read your full inquiry even if email delivery fails. Signed-in submissions and verified guest history can be viewed with your account activity.

When you use the free tools (card library, spreads, runes, I Ching, birth chart, Mystic Cards constellation generator): unsaved tool inputs are not automatically copied into your account or the admin portal. We store the information described above when you request a generated reading or choose to save or submit something. For Mystic Cards and live weather we may ask your browser for an approximate latitude and longitude, this is sent on request, used to pick the constellation overhead and the current weather, and not retained on our server.

Automatic information: standard server logs (IP address, user agent, page requested, response time, error traces) that web servers keep for security and debugging. We keep these short and rotate them.

We do not collect special-category data (health, religion, biometric, political) on purpose. The nature of tarot means people sometimes share emotional or spiritual context in the questions they submit. We treat that text the same way we treat any other personal information, privately, and for the purpose you sent it for.

How we use it

We use what we collect to do the things you asked us to do:

• Send you the reading, interpretation, calendar invite, order confirmation, or shipping notice you signed up for.
• Run the booking calendar and avoid double-booking.
• Fulfill orders, including handing your shipping address to the carrier.
• Send the newsletter you subscribed to, and let you unsubscribe at any time.
• Answer your emails and saved messages when you write to support.
• Let Dylan prepare for your reading using your submitted booking answers and relevant saved account activity. Admin access is restricted to the verified owner account, dlarue@brews-and-bloom.com.
• Keep the site working, logs help us find bugs, defend against abuse, and meet our tax and accounting obligations.

We do not use your information to train machine-learning or automated models. We do not sell, rent, or trade personal information to anyone. If we ever change that, we will tell you in advance and ask first.

Third-party services

Brews and Bloom is small, but a handful of trusted services do the heavy lifting. Each one only sees the information it needs.

PayPal may process a shop or service payment after we email the agreed total and payment instructions. PayPal handles the payment information you provide under its own privacy practices. We retain the payment confirmation needed to fulfill and record the order or service. Stripe is no longer used for new website checkout; historical transaction records may remain for earlier purchases, refunds, and accounting.

Google Workspace powers three things behind the scenes:

• Google Calendar, after Dylan confirms a reading request, an event is created on Dylan’s calendar. Virtual sessions also receive a Google Meet link.
• Google Sheets, newsletter signups are mirrored to a private spreadsheet as a backup.
• Gmail API, transactional emails (order requests, payment instructions, booking confirmations, reading links, shipping updates) are sent through Google Workspace authorization or an authorized OAuth connection.

The Calendar and Sheets connections use a Google service account, a non-human identity scoped only to the specific calendar and spreadsheet it needs. The Gmail connection sends only the transactional messages the site is built to send.

Text-generation service. Instant readings and dream interpretations use Google Gemini, through the Gemini API or Google Cloud Vertex depending on configuration. Your submitted question or dream text is sent to Google to generate a response. Google's handling and retention depend on the service and account tier; we do not promise immediate deletion by the provider. See the Gemini API terms and Google Cloud data governance guidance. Avoid including sensitive personal details in these tool inputs.

Open-Meteo is the weather API behind the live weather widget. When the widget asks for the current weather at your approximate location, your latitude and longitude are sent to Open-Meteo to look up the forecast. Open-Meteo does not require an account and does not link the request to your identity.

Plausible Analytics (if enabled) is a privacy-first analytics tool that does not use cookies, does not fingerprint visitors, and does not collect personal data. It records page views and aggregate traffic only.

Google AdSense displays the ads on this site. Google and its advertising partners may use cookies or similar identifiers to show ads based on your prior visits to this site and other sites on the web. Google uses the DoubleClick cookie to serve those ads. You can opt out of personalized advertising by visiting Google's Ads Settings or, for non-Google vendors, the aboutads.info opt-out tool. For visitors in the European Economic Area, the United Kingdom, Switzerland, and California, we use Google's Funding Choices consent management platform to ask for permission before serving personalized ads, declining there causes Google to serve only non-personalized ads, and we honor that signal via Google's Consent Mode v2. You can re-open Funding Choices at any time using the privacy icon Google places in the bottom-right corner of pages where ads appear. Google's advertising privacy practices are described at https://policies.google.com/technologies/ads.

We will keep this list up to date as the site grows. If we ever add a service that handles personal data in a meaningful new way, this section will be updated and the effective date at the top will move.

Cookies and similar technologies

We use a small number of first-party cookies, cookies set by brews-and-bloom.com itself, not by an outside ad network, plus the third-party cookies Google AdSense relies on to serve ads (see the AdSense entry above for opt-out details).

• Cart cookie: keeps the items in your cart while you browse, until you check out or clear them.
• Consent cookie: remembers your choices from the cookie banner so we don't ask again every visit.
• Admin session cookie: only set if you're signed in to the admin panel (Dylan).
• Location preference cookie: remembers whether you let the Mystic Cards tool use your approximate location.

Advertising cookies are described in the AdSense section above. Consent controls let you manage non-essential cookies; essential cookies for sign-in, security, and site preferences support the features you request.

Data retention

We keep personal information only as long as we need it for the purpose we collected it for.

• Orders and bookings are kept for the lifetime of the account, and afterward for as long as tax and accounting rules require (typically seven years in the US).
• Instant readings and dream interpretations are kept under their private share-token URL for as long as the account or order exists, and you may request earlier deletion at any time.
• Newsletter subscriptions are kept until you unsubscribe.
• Server logs are typically rotated within 30 days.
• Location data for Mystic Cards and weather is used in the moment and not stored on the server.

When you ask us to delete data, we delete the records we control and handle relevant requests with the third-party services involved (Google, PayPal, and Stripe for historical transactions), subject to applicable retention requirements.

Your rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you.
• Correct anything that's wrong.
• Delete your data (subject to the retention rules above).
• Export a copy in a portable format.
• Withdraw consent for the newsletter or location features at any time.
• Object to a particular use of your data.

If you live in California, the EU, the UK, or another jurisdiction with specific privacy rights (CCPA, GDPR, UK GDPR), those rights also apply, and we will honor them on the same timelines those laws require.

The simplest way to exercise any of these rights is to email dylan@brews-and-bloom.com with a short note about what you want. We will confirm your request and, where we need to verify your identity, do so in the lightest way that makes sense, usually by replying from the email address tied to the account.

International users

The site is hosted in the United States, and any personal data you send us will be processed there. If you visit from outside the US, you understand that your information will be transferred to and stored in the US, where data protection laws may differ from your home country. We apply the same care to the data of international visitors as we do to US visitors.

We do not currently market the site to residents of the EU or UK, but if you choose to use it from those regions we honor GDPR / UK GDPR rights and respond to requests on the timelines those laws set.

Children

The site is intended for adults. Paid services, live and group readings, deck and print purchases, are available only to people 18 years of age or older. Free tools and instant readings may be used by anyone old enough to navigate the web safely; we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has submitted personal information to us, write to us and we will delete it.

Session recordings and review choices

Sessions may be recorded only with each participant's permission. Recording permission and public-use permission are separate, optional choices; neither is required to book. We save the choices, date, policy version, and wording with the booking. A recording may contain your voice, image, and conversation. Recording-only permission covers session records and quality review. Public-use permission additionally allows editing, excerpts, and publication on Brews and Bloom's website, social channels, and other materials for lawful business, promotional, or educational purposes, without payment. Consent from one person does not cover other participants, and recordings must not misrepresent what someone said.

You can ask to stop recording and contact dylan@brews-and-bloom.com to withdraw permission for future recording or use. We will stop new uses and remove copies we control where reasonably possible; we cannot guarantee recovery of copies already shared by others. The optional private booking-question field and private written feedback are not covered by a recording release. Existing bookings do not gain recording or publication permission when this policy changes.

A next-day follow-up may invite a star rating, private feedback, and an optional public review. Your private answers stay in the restricted admin portal. A public review contains only the rating, public text, and display name you choose to share; your email, booking details, and private answers are excluded. Private feedback is published only after you separately approve a public version, and public reviews are moderated before appearing. Opening an email rating link does not save a rating or grant publication permission. Contact Dylan to withdraw a review's public permission.

Changes to this policy

We will update this policy when the site changes meaningfully, a new third-party service, a new kind of data collected, a new way data is shared. When we do, the Effective date at the top of the page will change. For significant updates we'll also email people on the newsletter or post a notice on the site so the change isn't quiet.

Contact us

For anything related to privacy, questions, requests, complaints, corrections, write to:

dylan@brews-and-bloom.com

Brews and Bloom is operated by Dylan W. LaRue in the United States. We try to reply to privacy requests within seven days, and always within thirty.