Effective 17 July 2026. Dookun Innovations, West Kelowna, British Columbia, Canada operates Velvet Arcana. Privacy requests: privacy@velvetarcana.com.
Information we process
We process account and login data, timezone, intention, readings, journal entries, reflection tone, reminder preferences, ritual completion dates and streaks, reward and Preview Day status, subscription status, security logs and technical device information. PayPal handles payment credentials; we retain subscription and transaction references rather than card details.
Purposes and providers
We use data to provide and secure the service, generate reflections, build Weekly Threads and Velvet Cycle reports, remember preferences, administer subscriptions, prevent abuse and meet legal obligations. Intentions, card context and up to three recent journal lines from the relevant reflection period may be sent to OpenAI. PayPal processes subscription payments. Hosting and notification providers process the minimum data needed.
Cookies and analytics
Essential cookies maintain login and security. Velvet Arcana stores limited first-party product events to understand ritual completion, streak progress, reward use and subscription conversion. These events never contain intention text, journal text or generated reflections. No third-party analytics cookies are currently used; users will be told before non-essential third-party tracking is introduced.
Referral attribution
When an invitation link is opened, we store a secure first-party referral token for up to 14 days and privacy-protected network and device hashes for attribution and abuse review. Referral records include invitation status, account and ritual qualification timestamps, reward grants and risk indicators. They never include intentions, journals, readings or generated reflections.
International transfers
Providers may process data outside your country, including Canada and the United States, subject to required contractual and legal safeguards.
Retention and deletion
Account deletion requests include the reason supplied by the user and are reviewed by an authorized administrator. Once approved, the account is archived and access is closed immediately; intentions, readings and journals are removed from active systems within 30 days. Residual backups expire within 90 days. Security logs are normally retained for 90 days. Inactive free accounts may be deleted after 24 months following notice. Minimized financial records may be kept for six years or as legally required.
Your rights
You may update information, cancel reminders and subscriptions, and permanently delete your account and journals. Depending on location, you may request access, correction, deletion, restriction, portability or objection, and complain to a regulator. Contact privacy@velvetarcana.com.
Age, security and changes
The service is for adults 18 and older. We use reasonable safeguards, but no system is completely secure. Material changes will be posted with a revised effective date.
