Privacy and retention | Sun Terminal

Scope

This page describes the current anonymous Rider–Waite Tarot HTTP consultation and the public reference pages around it.

A live 78-card Rider–Waite divination instrument that returns card identities and orientations for interpretation by the caller.

Data the operation accepts

A request contains a schema version, the fixed instrument id and version, and structural inputs. Structural inputs contain a count from 1 through 78 and may contain the exact generic sequence position-1 through position-N. The HTTP control headers are Content-Type and a fresh lowercase UUIDv7 Idempotency-Key.

Question text, caller-authored position labels, production seeds, authentication credentials, meanings, interpretations, locale and renderer choices have no accepted request fields. Query parameters and unknown JSON fields are rejected.

Active D1 record

Before D1 storage, application code hashes the raw idempotency key with a namespace and discards the raw key. The active record stores that digest and its issue and expiry times, the request fingerprint and canonical normalized input, instrument and manifest identifiers, encounter state, acquisition and terminal timestamps, and the pending ownership deadline. A final row stores the final encounter id, exact response bytes and response hash.

The final response contains the structural inputs, card identities and orientations, commitment, hashes and receipt needed for exact replay. The private draw seed is neither disclosed nor persisted.

A failed D1 row stores a failure timestamp and one of two bounded internal failure classifications through the existing 24-hour active idempotency window. It stores no exception name, exception message or subsystem-specific cause. The internal classifications are not public error codes.

Pending ownership and terminal failure

A newly acquired pending encounter has a 30-second ownership lease. Reaching the deadline only makes its row eligible for a later matching request with the same canonical input and idempotency key to conditionally record terminal failure; time passing alone does not run a background transition.

A failed encounter is terminal. It returns HTTP 409 encounter_failed with retryable set to false and no Retry-After header, and it will not be redrawn under that idempotency key. Sun Terminal does not create or recommend a replacement consultation.

Active deletion and platform recovery

The active retry window is 24 hours from the UUIDv7 issue time. An hourly scheduled cleanup deletes active D1 rows after expiry. Because cleanup is hourly, this is not a promise of deletion at the exact expiry instant.

Cloudflare D1 Time Travel may retain recoverable database history after active-row deletion; duration depends on the platform plan and configuration.

Cloudflare platform security and access logging is outside the application logging boundary. Its contents and retention have not been represented here as application-controlled deletion.

Rate limiter and connecting IP

Application code passes the connecting IP to the Cloudflare rate-limiter binding as its key. It does not write the IP to D1 or application logs. The current anonymous limit is 10 consultation attempts per 60 seconds at each Cloudflare location; it is asynchronous and not exact global accounting.

Application logging boundary

No request, response, receipt, idempotency key, authorization header, or IP logging is added by application code.

Application code adds no analytics, cookies, beacons or product-event logging to these public pages or the consultation operation. It does not send question text, card results or receipts to a language model or another interpretation provider.