Privacy Policy

1What we collect

• Account details. When you sign in with Google or Apple, we receive your name, email address and avatar. Apple may share your name only once, or give us a relay email address. We never see your password.
• Profile. The handle, bio, avatar and language preference you set.
• What you upload. Card images plus titles, descriptions, tags, card type, region, issuer and similar details. We also compute an image fingerprint (hash) to catch duplicates, and store the image’s dominant color for loading placeholders.
• Activity. Likes, comments, reports and the notifications we send you (for example, review results).
• Sessions. To keep you signed in and protect your account, each session record stores the IP address and browser information (user agent) it was created from.
• Technical data. We briefly use your IP address to prevent abuse and count downloads (see IP addresses). Our hosting provider also keeps short-lived operational logs — such as request times, pages visited and errors — to help us fix problems.

We don’t collect payment card details and can’t see the Wallet data on your device. CardArt and AirCard are separate: when you use AirCard on your own device, nothing is sent to us.

2How we handle images

Uploaded images are re-encoded into a standard 1536×969 PNG plus WebP versions for the website. This removes EXIF and other metadata such as camera model, capture time and location. We don’t keep your original file.

Avatars are re-encoded and stripped of metadata in the same way.

3How we use information

• Running CardArt — signing you in, handling uploads, and showing likes, comments and notifications.
• Moderation — automated AI review and human review of uploads and comments, for example to spot sexual content or what looks like real card numbers.
• Safety — rate limiting, bot detection, handling reports and investigating abuse.
• Improving CardArt — aggregate counts such as downloads and likes.
• Contacting you about your account, reports or legal matters when needed. We don’t send marketing email.

We don’t sell your personal information or use it for advertising.

4What’s public

The following is visible to everyone on CardArt: your name, handle, avatar and bio; your published, approved cards and their details; your comments; and like, download and comment counts. Your email address is never shown.

5IP addresses

We use IP addresses for two things:

• Rate limiting. Downloads, uploads, comments and similar requests are counted per IP address or account over short windows to stop abuse. These counters expire quickly and aren’t stored long term.
• Download counts. Each visitor counts once per card per day. If you’re signed out, we tell visitors apart with an irreversible hash of your IP address, the date and a secret key — the raw IP isn’t stored — and delete these records after 60 days.

Separately, as noted above, sign-in sessions record an IP address for account security; it’s deleted when you sign out or the session expires.

6Cookies

We use only the cookies CardArt needs to work:

• Session — keeps you signed in for up to 30 days; cleared when you sign out.
• lang — remembers your language for 1 year.
• theme — remembers your light or dark appearance for 1 year.

We don’t use advertising cookies, third-party analytics or cross-site trackers. When Cloudflare Turnstile (our bot check) runs on pages such as Upload, it may process browser and device signals to tell people from bots.

7Service providers and where data lives

CardArt runs on Cloudflare’s infrastructure:

• Cloudflare Workers runs the website.
• Cloudflare D1 stores accounts, card details, likes, comments, reports and notifications.
• Cloudflare R2 stores card images and avatars.
• Cloudflare Images resizes and converts images and strips metadata.
• Cloudflare Workers AI runs automated review of uploaded images and text (titles, descriptions, tags and comments).
• Cloudflare Turnstile protects against bots.

Sign-in is provided by Google and Apple, and the data they hold is covered by their own privacy policies. Cloudflare operates globally, so your data may be processed and stored outside your country or region.

8How long we keep data

• Your account and content: until you delete them.
• Sign-in sessions: up to 30 days, then cleaned up automatically.
• Download-count records: 60 days.
• Rejected or removed cards and their review records: kept until deleted, to handle appeals and prevent repeat abuse.
• Reports and moderation logs: for a reasonable period, for safety and to resolve disputes.
• Provider logs and backups: deleted automatically when their retention periods end.

9Your rights and choices

• View and edit your handle, bio, avatar and language in Settings.
• Delete your cards and comments, or your whole account in Settings. Deleting your account also deletes your profile, card images, avatar, likes, comments, notifications and related data.
• Export and other requests. To get a copy of your data or exercise other rights you have under local law (such as the EU GDPR or China’s Personal Information Protection Law), email privacy@cardart.cc. We’ll reply within 30 days.

We may need to verify your identity before acting on a request.

10Children

CardArt isn’t meant for children under 13. If you believe we’ve collected a child’s personal information, contact privacy@cardart.cc and we’ll delete it promptly.

11Security

All connections use HTTPS, sign-in tokens from Google and Apple are stored encrypted, and only a few moderators can access admin tools — every admin action is logged. No system is perfectly secure, though. If you find a security issue, please email hello@cardart.cc.

12Changes to this policy

We may update this policy and will change the “Last updated” date when we do. We’ll announce significant changes on the site in advance.

13Contact

For anything privacy-related, email privacy@cardart.cc.