Privacy Policy

1What we collect

• Account details. When you sign in with Google or Apple, we receive your name, email address and avatar. Apple may share your name only once, or give us a relay email address. We never see your password.
• Email sign-in. When you sign in with an email code, we collect your email address and use it only to sign you in and send you notifications.
• Profile. The handle, bio, avatar and language preference you set.
• What you upload. Card images plus titles, descriptions, tags, card type, country or region, issuer and similar details. We also compute an image fingerprint to catch duplicates.
• Activity. Likes, comments, reports and the notifications we send you (for example, review results).
• Sessions. To keep you signed in and protect your account, each session record stores the IP address and browser information (user agent) it was created from.
• Technical data. We briefly use your IP address to prevent abuse and count downloads (see IP addresses). Our hosting provider also keeps short-lived operational logs — such as request times, pages visited and errors — to help us fix problems.
• If you advertise. The details you enter for an ad (names, contact email, category, licence details, link and creative), its review results and payment records. See Ads.

We don’t collect payment card details and can’t see the Wallet data on your device. CardArt and AirCard are separate: when you use AirCard on your own device, nothing is sent to us.

2How we handle images

Uploaded images are re-encoded, which removes EXIF and other metadata such as camera model, capture time and location. We don’t keep your original file.

Avatars are re-encoded and stripped of metadata in the same way.

3How we use information

• Running CardArt — signing you in, handling uploads, and showing likes, comments and notifications.
• Moderation — automated and human review of uploads and comments, for example to spot sexual content or what looks like real card numbers.
• Safety — rate limiting, bot detection, handling reports and investigating abuse.
• Improving CardArt — aggregate counts such as downloads and likes.
• Contacting you about your account, reports or legal matters when needed. We don’t send marketing email.

We don’t sell your personal information or use it to target ads. The only thing that affects which ads you see is the country you visit from (see Ads).

4What’s public

The following is visible to everyone on CardArt: your name, handle, avatar and bio; your published, approved cards and their details; your comments; and each card’s like, download and comment counts.

Your email address is never shown, and only you can see which cards you’ve liked.

5IP addresses

We use IP addresses for two things:

• Rate limiting. Downloads, uploads, comments and similar requests are counted per IP address or account over short windows to stop abuse. These counters expire quickly and aren’t stored long term. Sign-in and sign-up counters (for example, how many accounts were created from one network) store only one-way hashes of IP and email addresses and are kept for at most 8 days.
• Download counts. Each visitor counts once per card per day. If you’re signed out, we tell visitors apart with an irreversible hash of your IP address, the date and a secret key — the raw IP isn’t stored — and delete these records after 60 days.

Separately, as noted above, sign-in sessions record an IP address for account security; it’s deleted when you sign out or the session expires.

6Cookies

We use only the cookies CardArt needs to work:

• Session — keeps you signed in; expires after 30 days of inactivity and is cleared when you sign out.
• lang — remembers your language for 1 year.
• theme — remembers your light or dark appearance for 1 year.
• tz — remembers your time zone so dates show in your local time, for 1 year.

We don’t use advertising cookies, third-party analytics or cross-site trackers. When Cloudflare Turnstile (our bot check) runs on pages such as Upload, it may process browser and device signals to tell people from bots.

7Ads

CardArt shows a few labelled ads that advertisers book with us directly. We serve them ourselves: no ad network or third-party ad scripts, no ad cookies, no cross-site tracking and no personal profiling. Everyone viewing a page in the same country sees the same ads.

• Country. On each visit, Cloudflare tells us which country your connection comes from. We use it only to apply display rules — for example, crypto card ads aren’t shown in mainland China or the UK — and never store it with anything that identifies you.
• Counts. When an ad is at least half visible for a second, when you open an ad card or when you click an ad, your browser sends us an anonymous event: which ad and placement, the type of event, and your country, device type (phone, tablet or computer) and browser language. No cookie, account or other identifier is attached, and we don’t store your IP address with it. We add events up into daily totals per ad, and those totals are all the advertiser sees.
• Clicks. Ad links go straight to the advertiser’s site. We may add tags such as utm_source=cardart so the advertiser knows the visit came from CardArt, but nothing about who you are. Their own privacy policy applies there.
• If you advertise. We keep the details you enter (names, contact email, category, licence details, link and creative), review results and payment records, to run the ad, handle refunds and disputes and meet record-keeping duties. Payment is processed by Infini: we send it only the amount, currency, our order number and a short description, and it reports back the payment status and transaction details (such as network and transaction hash). What you give Infini on its checkout page, such as your wallet address or any identity check it asks for, is covered by Infini’s own privacy policy.

8Service providers and where data lives

CardArt runs on Cloudflare, which provides hosting, data and image storage, image processing, automated review, bot protection and email delivery.

Sign-in is provided by Google and Apple, and the data they hold is covered by their own privacy policies. Cloudflare operates globally, so your data may be processed and stored outside your country or region.

Advertisers pay through Infini⁠(opens in a new tab), a crypto payment processor. See Ads for what it receives.

9How long we keep data

• Your account and content: until you delete them.
• Sign-in sessions: expire after 30 days of inactivity, then are cleaned up automatically.
• Download-count records: 60 days.
• Rejected or removed cards and their review records: kept until deleted, to handle appeals and prevent repeat abuse.
• Reports and moderation logs: for a reasonable period, for safety and to resolve disputes.
• Ads, their review results and billing records (including the advertiser’s legal name and contact email): as long as accounting and tax law requires, even after the advertiser deletes their account.
• Ad statistics: daily totals per ad are kept with the ad; the anonymous events behind them are deleted after 3 months.
• Provider logs and backups: deleted automatically when their retention periods end.

10Your rights and choices

• View and edit your handle, bio, avatar and language in Settings.
• Delete your cards and comments, or your whole account in Settings. Deleting your account also deletes your profile, card images, avatar, likes, comments, notifications and related data. If you advertised, ads and billing records are kept for the period described above.
• Export and other requests. To get a copy of your data or exercise other rights you have under local law (such as the EU GDPR or China’s Personal Information Protection Law), email privacy@cardart.cc. We’ll reply within 30 days.

We may need to verify your identity before acting on a request.

11Children

CardArt isn’t meant for children under 13. If you believe we’ve collected a child’s personal information, contact privacy@cardart.cc and we’ll delete it promptly.

12Security

All connections use HTTPS, sign-in tokens from Google and Apple are stored encrypted, and only a few moderators can access admin tools — every admin action is logged. No system is perfectly secure, though. If you find a security issue, please email hello@cardart.cc.

13Changes to this policy

We may update this policy and will change the “Last updated” date when we do. We’ll announce significant changes on the site in advance.

14Contact

For anything privacy-related, email privacy@cardart.cc.