Privacy Policy

1. Introduction

The Well of Whispered Wishes ("we," "us," or "our") is operated by Daydream Workshop, LLC, a Texas limited liability company located in Fort Worth, Texas. This privacy policy explains what information we collect when you visit thewellofwhisperedwishes.com (the "Site"), how we use it, and the choices you have. This policy applies to all visitors, regardless of where you live.

This Site offers free rituals — tarot readings, a yes/no oracle, daily reflections — and optional paid offerings through the Wishing Well. We are committed to collecting only what is needed to provide these features and to keeping your information safe.

2. Information We Collect

2.1 Information You Provide

• Feedback submissions. When you share feedback, you may provide a star rating (1–5), a category, a written message, and an optional email address. Your email is only included if you choose to type it.
• Payment information. When you make a paid offering, your payment is processed by Stripe. We do not see or store your card number, CVV, or full card details. Stripe shares with us the transaction result, your name, your email, and your billing and shipping address so we can fulfill the order and calculate sales tax.
• Admin credentials. Site administrators log in with an email and password. Passwords are hashed by our authentication provider and are never stored in plain text.

2.2 Information Collected Automatically

• IP addresses and server logs. Our hosting provider records IP addresses and basic request metadata (browser type, timestamp) in server logs for security, stability, and error diagnostics. These logs are not used to track individual visitors.
• Requests to third-party servers. When your browser loads tarot card images from Wikimedia Commons or fonts from Google Fonts, those providers receive your IP address and standard browser headers. We do not control what they retain; see their respective privacy policies.

2.3 Cookies and Browser Storage

We use minimal browser-side storage to make the Site work. We do not use analytics cookies, advertising cookies, tracking pixels, or fingerprinting.

• Sound preference (localStorage): remembers whether you muted the fountain sound. Stays on your device only.
• Wishing Well state (sessionStorage): temporarily holds your wish text and unlocked-offering list during a visit, including across a Stripe checkout redirect. This data is never sent to any server and is cleared when you close the tab.
• UI layout cookie (optional): a single functional cookie may remember whether a sidebar is open or closed. It does not track you and contains no personal data.

You can clear all of this at any time through your browser's "Clear browsing data" settings.

3. How We Use Your Information

• To operate the free rituals (tarot, oracle, daily reflection) and the Wishing Well.
• To process, verify, and fulfill paid offerings, including calculating and recording sales tax.
• To review feedback you submit and improve the Site based on it.
• To authenticate administrators and protect the admin dashboard.
• To diagnose errors and keep the Site secure and stable.
• To comply with legal, tax, and regulatory obligations.

We do not use your information to build behavioral profiles, sell to data brokers, or send marketing emails unless you explicitly request them.

4. Sharing and Disclosure

We share data only with the service providers we need to run the Site, and only as necessary:

• Stripe — processes payments. When you purchase an offering, Stripe receives your card details, billing information, email, and IP address. Stripe's handling of this data is governed by Stripe's Privacy Policy. We receive only the transaction outcome and the billing address needed for tax records.
• Our hosting and database provider — stores feedback, order records, and admin account data. Access is restricted and protected by row-level security policies.
• Wikimedia Commons — serves the tarot card images. Your browser connects to Wikimedia's servers directly to load these images.
• Google Fonts — serves the typefaces used on this Site. Your browser connects to Google to download font files.
• Google Search Console — provides aggregate search performance data (such as which queries lead to the Site). It does not give us data about individual visitors.

We may also disclose information when required by law, court order, or to protect our rights, property, or safety. We never sell your personal data, and we never share it for advertising purposes.

[If you add additional third-party services in the future, list them here and update this section.]

5. Data Security

• Card data never touches our servers — all payment fields are handled by Stripe's secure checkout.
• Our database enforces row-level security on every table, so visitors can only insert feedback, not read other people's submissions or order records.
• Order records are accessible only to authenticated administrators.
• Admin passwords are hashed by our authentication provider; we never see or store the plain-text password.
• Payment sessions are verified server-side, not trusted from the browser.
• We use HTTPS for all connections between your browser and our servers.

No method of transmission or storage is completely secure, but we work hard to protect your information using industry-standard safeguards.

6. Data Retention

• Feedback: retained for one (1) year so we can review and act on it. You may request deletion at any time (see Section 7).
• Order and tax records: retained for four (4) years to comply with Texas sales tax reporting requirements (Form 01-114) and other tax obligations. These records include transaction details, billing address, and tax amounts — not card data.
• Browser storage: the sound mute preference persists on your device until you clear it; session storage (wish text, offering state) is cleared when you close the browser tab.
• Server logs: rotated and deleted on a routine schedule by our hosting provider.

7. Your Rights & Choices

Depending on where you live, you may have the following rights regarding your personal data:

7.1 GDPR Rights (EU, UK, EEA)

If you are in the European Union, the European Economic Area, or the United Kingdom, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data ("right to be forgotten").
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you previously gave.

You may also lodge a complaint with your local data protection authority. We do not rely on consent as our primary legal basis for processing — we process data to provide the service you request, comply with tax law, and protect our legitimate interests in running the Site.

7.2 CCPA Rights (California)

If you are a California resident, the California Consumer Privacy Act (CCPA) gives you the right to:

• Know — request the categories and specific pieces of personal data we collect about you.
• Delete — request deletion of your personal data.
• Opt out of sale — we do not sell your personal data, so there is nothing to opt out of.
• Non-discrimination — we will not treat you differently for exercising your rights.

7.3 Texas & Other U.S. State Rights

If you are a resident of Texas or another U.S. state with a consumer privacy law (such as the Texas Data Privacy and Security Act), you have similar rights to access, correct, delete, and opt out of certain processing of your personal data. We do not sell personal data or process it for targeted advertising.

7.4 How to Exercise Your Rights

To exercise any of these rights, email us at support@thewellofwhisperedwishes.com. We will respond within 30 days (or as required by your local law). We may ask for information to verify your identity before processing your request.

7.5 Cookie & Storage Choices

You can clear all cookies and browser storage used by this Site through your browser settings at any time. Because we do not use tracking cookies, there is no separate "Do Not Track" signal to configure — your browser's default settings are sufficient.

8. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us at support@thewellofwhisperedwishes.com and we will promptly delete it. This policy is consistent with the requirements of the Children's Online Privacy Protection Act (COPPA).

9. International Users

The Site is operated from the United States. If you access the Site from the EU, UK, or another region with data protection laws that differ from U.S. law, your data will be processed and stored in the United States. By using the Site, you consent to this transfer. We aim to honor your rights under your local privacy laws regardless of where you live.

10. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If we make material changes, we may also provide a notice on the homepage. We encourage you to review this page periodically.

11. Contact Information

If you have any questions about this privacy policy or how we handle your data, please contact us:

This privacy policy does not constitute legal advice. For specific legal questions, please consult a qualified attorney.