Founder Offer Complete Grimoire at €4.90/month for the first 100 members. 100 spots left.

Monna Grimoire
Menu
PricingStart free

Privacy policy

Data collected

Monna Grimoire may collect the following data:

  • - email address;
  • - display name;
  • - hashed password when email registration is used;
  • - Google identifier when Google sign-in is used;
  • - birth date, time, place, and timezone;
  • - reading preferences;
  • - personal journal entries;
  • - tarot reading history;
  • - astrological profile information;
  • - session data and technical data required for operation.

Purposes

This data is used to:

  • - create and secure the account;
  • - personalize readings;
  • - calculate or prepare the astrological profile;
  • - display the journal, histories, and recommendations;
  • - manage subscriber access;
  • - provide maintenance, security, and support.

Birth data and personal journal

Birth data, feelings, journal entries, and reading histories are personal information with sensitive use.

They are used only to provide Grimoire features and must not be resold.

Payment

When online payment is enabled, payment data is processed by Stripe.

Monna Grimoire does not store full bank card numbers.

The site may keep technical payment or subscription identifiers required to track access.

Cookies and sessions

The site uses cookies or equivalent mechanisms necessary for sign-in, security, and display preferences.

Retention

Data is retained as long as the account exists, as long as it is necessary for the service, or as long as a legal obligation requires it.

User rights

Users may request access to, correction of, or deletion of their personal data.

Requests must be sent to contact@project-monna.xyz and include the email address linked to the account.

Security

Passwords are stored in hashed form.

Technical secrets, OAuth keys, and payment keys are stored in environment variables or secure hosting tools.

Your private practice notebook

Seven-step progress, daily intentions, optional feelings, reflections, collections and notes are stored on this server for your account’s functionality, independently of optional audience measurement. You can edit or delete them, export your notebook as JSON, and account deletion removes them. Removing a collection keeps its notes unfiled. These entries are not public and are not sent to an AI provider. They remain until you delete them or your account. The weekly review uses saved observations and counts, not predictions or diagnoses.

Optional measurement may record a practice-completed event after saving, without its content, and estimate return visits in the week after measured sign-up. The public image-sharing tool uses only a public Moon phase and a preset intention; image generation happens in your browser. No private notebook entry is included and nothing is published automatically.

Optional first-party measurement and member feedback

If you accept optional cookies, the site records navigation steps using a random browser identifier, stored as a hash on this server. Only screen categories, event names, dates and one of the approved acquisition channels are recorded. No journal text, birth details, email or IP address is stored in these events. The identifier expires after 90 days; old server events are removed at the next collection. Refusal, withdrawal and Do Not Track stop measurement and request deletion of events associated with this browser. Measurements are not sent to another analytics provider.

The feedback form is optional and linked to your account. Your answer about subscribing stays private. A testimonial is published only with your explicit permission and admin review, under your chosen nickname or an anonymous label. Unchecking permission and saving removes publication. Account deletion also deletes your feedback. Use the cookie preferences button to change optional measurement choices.

Essential account security

When enabled, two-factor authentication uses an encrypted authenticator secret and hashed single-use recovery codes. A short-lived, HttpOnly challenge cookie completes sign-in without granting account access by itself. Security events record action categories, dates and internal account identifiers for up to 90 days, independently of optional audience measurement. These events contain no passwords, authenticator codes, email addresses or journal content.

Anti-abuse counters use hashes of technical identifiers and expire according to the relevant limit, at the next check. They protect sign-in and sensitive forms and are not advertising identifiers. You can manage two-factor authentication and revoke other sessions in your account security page.