Effective 17 July 2026. Dookun Innovations, West Kelowna, British Columbia, Canada operates Velvet Arcana. Privacy requests: privacy@velvetarcana.com.
Information we process
We process account and login data, timezone, intention, readings, journal entries, reflection tone, reminder preferences, ritual completion dates and streaks, reward and Preview Day status, subscription status, security logs and technical device information. PayPal handles payment credentials; we retain subscription and transaction references rather than card details.
Purposes and providers
We use data to provide and secure the service, generate reflections, build Weekly Threads and Velvet Cycle reports, remember preferences, administer subscriptions, prevent abuse and meet legal obligations. Intentions, card context and up to three recent journal lines from the relevant reflection period may be sent to OpenAI. PayPal processes subscription payments. Hosting and notification providers process the minimum data needed.
Cookies and analytics
Essential cookies maintain login and security. If you choose to remain signed in, a secure device credential keeps your account available for up to 30 days; only a non-reversible hash of that credential is stored in our database. Signing out, resetting your password, or closing an archived account revokes it. Velvet Arcana stores limited first-party product events to understand ritual completion, streak progress, reward use and subscription conversion. These events never contain intention text, journal text or generated reflections. We also use Google Analytics to understand aggregated site and app usage. Google may set analytics identifiers and receive technical information such as pages visited, browser or device details, approximate location derived from network information, and interaction timing. We do not send intentions, journals, readings or generated reflections to Google Analytics.
Referral attribution
When an invitation link is opened, we store a secure first-party referral token for up to 14 days and privacy-protected network and device hashes for attribution and abuse review. Referral records include invitation status, account and ritual qualification timestamps, reward grants and risk indicators. They never include intentions, journals, readings or generated reflections.
International transfers
Providers may process data outside your country, including Canada and the United States, subject to required contractual and legal safeguards.
Retention and deletion
Account deletion requests include the reason supplied by the user and are reviewed by an authorized administrator. Once approved, the account is archived and access is closed immediately; intentions, readings and journals are removed from active systems within 30 days. Residual backups expire within 90 days. Security logs are normally retained for 90 days. Inactive free accounts may be deleted after 24 months following notice. Minimized financial records may be kept for six years or as legally required.
Your rights
You may update information, cancel reminders and subscriptions, and permanently delete your account and journals. Depending on location, you may request access, correction, deletion, restriction, portability or objection, and complain to a regulator. Contact privacy@velvetarcana.com.
Age, security and changes
The service is for adults 18 and older. We use reasonable safeguards, but no system is completely secure. Material changes will be posted with a revised effective date.
