What you type into a reading is private, and the way it is handled should be stated plainly. Your inputs travel over encrypted connections, they are stripped of identifying details before they are interpreted, they are never sold to advertisers, and a deletion request is completed within 30 days. This is the structure behind that, which we call the Fortress Architecture.
The digital shield around a personal experience
Most people arrive at a reading looking for a way through something. Telling a platform what you would not tell the people closest to you raises fair questions: what happens to this, and who reads my readings?
When we built Faltastik, the first decision was that careful, in-depth interpretation is not enough on its own. It has to happen inside a system that treats what you entered as something to be guarded rather than something to be mined.
What the Fortress Architecture covers
1. Isolation and anonymisation
The details you enter, your birth data or the cards you drew, are stripped of identifying information before they are sent on for interpretation. The interpreting side does not know who you are or where you live; it works with the symbols and the question. That flow runs over encrypted connections, and the finished reading comes back to you.
2. Live threat detection
Hostile traffic is a fact of running anything on the internet. The platform sits behind a rate limiting shield that measures requests as they arrive. When traffic looks abnormal, the attempt is blocked and the rest of the platform is insulated from it, so a burst aimed at one part does not interrupt anyone's reading.
3. The zero leakage principle
Even error messages can hand an attacker a clue. A global error wrapper runs behind the platform, and when something breaks it never returns technical detail to the outside. The failure is passed instead, within seconds, to our engineering team's closed channels through Sentry and Telegram, with identifying details scrubbed before they leave the platform.
What happens to your data, in plain terms
- In transit: connections are encrypted, with access control policies and periodic security reviews behind them.
- Retention: reading records are deleted one year after they are created.
- Deletion: you can delete your account yourself from Settings, and the data is permanently erased within 30 days. Our account deletion page sets out the steps and what is kept for tax purposes.
- Who is responsible: the data controller is POI369 OÜ (Tallinn, registry code 17460510), a company incorporated in Estonia, so the records sit inside the European Union.
The full list of processors, legal bases and retention periods is written out in our privacy policy rather than summarised away, and the security page covers the same ground from the platform side.
Why we are strict about this
Plenty of applications in this field treat user data as inventory to be shared with advertisers. We ruled that out at the start. Guidance is a space that belongs entirely to the person asking, and it stops being that the moment the answers are resold.
So while you read what the cards or the chart have to say about tomorrow, the material you handed over today is kept behind encryption, access limits and a deletion promise you can hold us to. Every reading also carries its entertainment framing openly, because being straight about what a reading is belongs to the same commitment as being straight about where the data goes.
