Privacy policy

1. Introduction

Malewitch.com ("we," "us," or "our") operates the website www.malewitch.com, a spiritual services platform offering readings, consultations, and educational content rooted in Wiccan tradition. This Privacy Policy describes how we collect, use, and protect personal information when you use our website and services.

By using this website, you agree to the practices described in this policy.

2. Information we collect

2.1 Information you provide

• Name and email address (when registering an account or contacting us)
• Phone number (if provided for appointment reminders)
• Payment information (processed by PayPal, we never store card numbers)
• Messages, reading requests, and consultation content
• Appointment details and preferences

2.2 Information collected automatically

• IP address and approximate geographic location
• Browser type and device information
• Pages visited, time on site, and referring URLs

3. Use of Google APIs and Gmail data

Important: The Google OAuth integration described in this section is an internal administrative tool used exclusively by the owner and authorized administrators of Malewitch.com. It is not part of the service offered to registered customers or site visitors.

3.1 What we access

Our website includes a private, internal email management client that allows our administrators to read, compose, and send email directly from a private admin panel accessible only to authorized personnel. This tool authenticates with Google via OAuth 2.0 and requests the following scopes:

• https://mail.google.com/ — Full IMAP and SMTP access to the authenticated Gmail mailbox, required to read messages, organize folders, and send email on behalf of the administrator.
• email — The Gmail address of the authenticated administrator account, used to identify which account is connected.
• profile — Basic Google profile information (display name), used only for display purposes in the admin interface.

3.2 Who has access

Only the website owner and explicitly authorized administrators of Malewitch.com can initiate the Google OAuth flow. The login page is protected behind the admin panel and is not accessible to registered customers, site visitors, or the general public. No customer data is connected to or processed by this tool.

3.3 How we use Google user data

Data obtained through the Google API (including email message content, metadata, and mailbox structure) is used solely for the following purpose:

• Enabling administrators to read, organize, and respond to business email through the internal admin panel.

We do not:

• Use Google user data to serve advertisements
• Share, sell, rent, or transfer Google user data to any third party
• Use Google user data for any purpose other than operating the internal email client described above
• Allow humans to read Gmail data except as necessary to operate and troubleshoot the email client, and only with the user's explicit permission
• Use Gmail data for training machine-learning or AI models

3.4 Local caching of email data

To improve performance, email metadata (sender, subject, date, snippet, and message body text) is cached in a private, encrypted-connection MySQL database hosted on the same server as this website. This cache is used exclusively to speed up the admin email interface and is not shared with any external service. Cached data is deleted when messages are removed from the mailbox or when the administrator revokes access.

3.5 Token storage

OAuth access tokens and refresh tokens are stored in an encrypted format in our private database, accessible only to the Malewitch.com server. They are used solely to maintain the authenticated IMAP/SMTP session for the Malewitch.com Email Client.

3.6 Revoking access

An authenticated administrator can revoke our application's access to their Gmail account at any time by visiting Google Account Permissions and removing "Malewitch.com Email Client." Upon revocation, all stored tokens are invalidated and deleted from our database.

3.7 Google API Services User Data Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use customer information

For registered customers and site visitors, we use collected information to:

• Provide and manage the services you request (readings, appointments, consultations)
• Process payments and issue receipts
• Send appointment reminders and service-related updates
• Respond to inquiries and support requests
• Improve website functionality and user experience
• Protect against fraud and unauthorized access
• Comply with applicable legal obligations

We do not sell, rent, or trade customer personal information to third parties for marketing purposes.

5. Cookies

We use session cookies strictly to maintain login state and provide a seamless experience. We do not use third-party advertising cookies or behavioral tracking. Disabling cookies in your browser may prevent certain site features from functioning.

6. Third-party services

We use the following third-party services, each governed by their own privacy policies:

• PayPal — payment processing for customer purchases
• Google (OAuth 2.0 / Gmail API) — internal administrator email authentication (see Section 3)
• Amazon SES — transactional email delivery (account confirmations, receipts)

7. Data security

We implement appropriate technical safeguards to protect personal information, including HTTPS encryption for all connections, hashed password storage, session security controls, and restricted database access. No method of internet transmission is completely secure, but we strive to use commercially acceptable means to protect your data.

8. Data retention

We retain customer personal information for as long as your account is active or as needed to provide services. Google API credentials and cached email data (see Section 3.4) are retained only while the OAuth connection is active and are deleted upon revocation. You may request deletion of your account data at any time by contacting us.

9. Your rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of your personal data
• Withdraw consent where processing is consent-based
• Revoke Google API access at any time (see Section 3.6)

10. Children's privacy

Our services are intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy periodically. We will indicate the revision date at the top of this page. Continued use of the website after any changes constitutes your acceptance of the revised policy.

12. Contact us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: