Privacy Policy
This Privacy Policy explains what personal data KARD ("KARD", "we", "us") collects when you use the KARD website and apps, why we collect it, who receives it, how long we keep it, and the choices you have. KARD is for adults only (18 and older) and we do not knowingly collect data from children.
The short version. We collect what we need to run your account, scan cards, process orders and keep the community safe. We do not sell your personal data, we do not show ads, and we do not track you across other companies' apps or websites. You can download your data and delete your account in Settings.
1. What we collect
Data you give us
- Account: display name, username, email address, password (stored only as a salted hash), date of birth (stored encrypted and used to check that you are 18 or older), favorite categories, avatar and bio if you add them.
- Phone number: if you verify one, we keep it encrypted, plus a one-way hash so one phone number can be used for one welcome grant. We use it for fraud prevention and verification only.
- Content: posts, comments, showcases, collections, want lists, listings, messages, and the photos in them.
- Scans: photos you take or upload to identify a card. Scan photos are private and are not processed as biometric data.
- Orders and trades: shipping address, purchase and sales history, ratings, disputes and the messages in them.
- Payments: card details go straight to Stripe and never reach our servers. Sellers give identity and bank details to Stripe to be paid. We receive the status of payments and payouts and the last digits of a card.
- Support: what you write to us, and your email address if you are not signed in.
Data collected automatically
- Device and usage data: a device push token if you allow notifications, your app version and platform, language, IP address, request logs, and in-app actions (for example, a scan finished or a post was created).
- Wallet and KARD data: your Solana wallet address, your allowance, and a ledger of your KARD activity. Blockchain transactions are public (see section 6).
- Acceptance records: the version of these documents you accepted, when, and from which IP address.
We do not collect your precise or approximate location, contacts, health data, browsing history or advertising identifier.
2. How we use it
- To create and secure your account, sign you in, and check your age.
- To provide KARD: identify cards, show collections and the feed, run the marketplace and trades, send notifications and emails about your activity, and let members message each other.
- To process payments, payouts, shipping, refunds and disputes, and to keep financial records.
- To keep KARD safe: screen posts, comments, photos and messages for harmful content, detect spam, scams and fraud, enforce our rules, screen wallets against sanctions lists, and comply with the law.
- To translate content when you ask us to, to give support, and to understand and improve how KARD is used.
Where the law requires a legal basis, we rely on performing our contract with you, our legitimate interests in running and protecting KARD, compliance with legal obligations, and your consent where we ask for it (for example, push notifications).
3. Who receives your data
We do not sell your personal data and we do not share it for cross-context behavioral advertising. We share it only as described here.
- Other members: your username, display name, avatar, bio, posts, showcases, listings, ratings and the Founding Collector badge are public or visible to the people you choose. A seller sees the shipping address of a buyer, and a buyer sees what is needed to ship and resolve an order.
- Service providers who process data for us under contract. They include: payments (Stripe), shipping (Shippo), hosting, storage and network security (our hosting provider and Cloudflare, including its Turnstile bot check), content screening and translation (Microsoft Azure AI services), phone verification (Twilio), transactional email (Postmark), push notifications (Google Firebase Cloud Messaging and Apple Push Notification service), blockchain access and monitoring (Helius), wallet infrastructure (Privy or a similar provider), and sanctions screening (Chainalysis). Our product analytics run on our own servers.
- Legal and safety: authorities, courts or other parties when the law requires it or to protect people's safety and rights, and to enforce our terms.
- Business changes: a successor if KARD is merged, sold or reorganized, under terms that protect your data.
4. How long we keep it
| Data | Kept for |
|---|---|
| Scan photos not added to a collection item or listing | 30 days |
| Application logs | 30 days |
| Order and trade messages | Life of the order or trade, plus 2 years |
| Cached translations | 180 days |
| Database backups | 30 days |
| Orders, ledger entries, audit logs and financial records | 7 years; after you delete your account they no longer name you |
| Account and profile data | Until you delete your account; personal data is then erased within 30 days |
5. Your choices and rights
- Download your data: Settings, then Export my data. We email a link to a ZIP file that works for 7 days. You can ask once a day.
- Delete your account: Settings, then Delete account, or follow Delete your account if you cannot sign in.
- Correct your data: edit your profile in the app, or contact us.
- Notifications: choose which notifications you receive, and quiet hours, in Settings. You can also turn off push in your device settings.
- Block and report: block any member and report any content.
Depending on where you live (for example California, other US states with privacy laws, the United Kingdom or the European Economic Area), you may also have the right to access, correct, delete and port your data, to object to or restrict some uses, to withdraw consent, to appeal our decision, and to complain to your regulator. To use a right, use the tools above or contact us. We may need to verify that you are the account holder, and we answer within the time the law requires (45 days for California requests). We do not treat you differently for using your rights.
6. Blockchain data
KARD settles on the Solana blockchain. Wallet addresses and the transfers made from them are public and permanent, and we cannot change or erase them. Do not link a wallet whose address you do not want connected to your KARD activity.
7. Cookies and similar technologies
KARD uses only what it needs to work: a sign-in session cookie, a security (anti-forgery) cookie, and storage on your device for your sign-in tokens, language and theme. We do not use advertising or cross-site tracking cookies, and we do not use a third-party advertising SDK, so there is no tracking consent banner to manage.
8. Security
We protect data with encryption in transit, encryption of sensitive fields at rest, access controls, rate limits, two-factor sign-in for staff, audit logs, and encrypted backups. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.
9. International transfers
KARD is operated from the United States and your data may be processed there and in other countries where our service providers operate. Where the law requires it, we use safeguards such as standard contractual clauses for transfers out of the United Kingdom or the European Economic Area.
10. Changes to this policy
We will update this page when our practices change and change the date and version at the top. For a material change we will also tell you in the app or by email.
11. Contact us
Privacy questions or requests? Contact support.