About this plugin
Hedomi Tarot is a free, fully functional tarot-reading plugin for WordPress. org build includes its local reading and optional AI functionality without feature locking or trial restrictions. WooCommerce payment and reading-credit functionality is a separate Pro feature and its functional code is not included in this Free build.
Features include:
- Deck taxonomy and tarot card post type.
- Upright and reversed meanings.
- Keywords and optional Yes/No classification.
- Spread builder with unlimited positions.
- Visual drag-and-drop position preview.
- Manual and automatic card selection.
- Optional reversed cards and configurable probability.
- Secure AJAX validation with nonce and deck verification.
- Responsive frontend and card-reveal animations.
- Reading cards or tabbed interpretations.
- Shortcode: [hedomi_tarot id=”123″]
- Optional OpenAI personalized interpretations using the visitor question and the administrator’s card meanings.
- Required visitor consent for AI personalization, configurable local AI abuse protection, connection test, and traditional-reading fallback.
- One-click creation of the standard 78-card Tarot structure as editable drafts.
The plugin does not include copyrighted card artwork or interpretations. Site owners must provide content they have the right to use.
OpenAI is an optional external service. Traditional readings work without OpenAI and without an API key.
External services
Hedomi Tarot can optionally connect to the OpenAI API to generate personalized tarot interpretations. OpenAI performs the interpretation on its external servers. This service is not required for traditional readings.
The connection occurs only when the site owner configures an OpenAI API key, enables AI, and an AI reading is requested. The visitor must explicitly confirm consent before the question and spread data are sent to OpenAI.
For an AI reading, the plugin may send the visitor question (if provided), spread title, selected card names, card orientation, spread position names and context, card keywords, Yes/No metadata, site locale, card meanings entered by the site administrator, and any additional AI instructions entered by the administrator. The OpenAI API key is sent in the server-to-server Authorization header. It is not exposed in frontend JavaScript.
Requests set the OpenAI store parameter to false; OpenAI’s processing and retention practices remain governed by its own policies. WordPress authentication cookies, authentication keys, salts, and session identifiers are not sent to OpenAI.
When the administrator enables the optional per-visitor AI abuse-protection limit, anonymous requests use a SHA-256 hash of the visitor IP address as a temporary local rate-limit key. The raw IP address is not stored by this feature, the hash is not sent to OpenAI, and the transient expires within one hour. This rate protection affects only optional AI personalization and never blocks traditional readings.
com/policies/terms-of-use/
com/policies/privacy-policy/