Privacy Policy

Account Information

• Email address (for authentication and communication)
• The names of the cardholder profiles you create
• Notification and reminder settings, including your time zone

Card Portfolio Information

• The cards you add from our catalog, and the details you choose to enter for them: a nickname, the last digits of the card number, a credit limit, and dates such as when a card was opened or closed and when its annual fee is charged
• The benefit and credit usage you log, including amounts, dates, and notes
• Offers, awards, and annual fee records you choose to track, including the spending you log toward an offer

We do not connect to your bank account, retrieve financial transactions, or store full payment card numbers.

Subscription Information

• If you subscribe to Pro, your plan, its status, whether it renews, its renewal or end date, and where you bought it (the web or the App Store)
• Identifiers that link your account to your subscription at our payment providers, such as a Stripe customer and subscription identifier

Payments are processed by Stripe on the web and by Apple on the App Store. They collect the payment details you enter, such as your card, under their own privacy policies. We never receive your full card number.

Usage Data

• How you interact with our service
• Device information (browser type, operating system)
• Performance data, error reports, and diagnostic logs
• Push notification tokens and delivery information
• Support messages you send us, and the diagnostics you choose to attach to them
• Session recordings on the web and in the iOS app, which may include visual representations of screens and your interactions with them. Recordings are configured to mask text you type, and most other text on screen.

Our hosting and infrastructure providers receive your IP address in order to deliver the service. Our product analytics is configured to discard it.

Public Pages

Visits to our public pages, such as the home page and the card pages, are measured and may be recorded before you sign in. If you have not signed in on that browser, these visits are kept under an anonymous identifier, and if you sign in, that identifier is joined to your account, so the visit becomes part of your account’s history. If you have signed in on that browser before and have not signed out, these visits are kept under your account.

When a visit begins on a public page, we also keep how you arrived: the referring website’s domain and the campaign values in the link you followed (utm_source, utm_medium, and utm_campaign).

• Provide and maintain our credit card tracking service
• Send notifications about benefit expirations and resets
• Improve our service and develop new features
• Understand how people find and use kardfolio
• Ensure account security and prevent unauthorized access
• Provide customer support and respond to your requests
• Send sign-in codes by email and the notifications you turn on
• Sell, renew, and manage Pro subscriptions, and decide which features your account can use

We do not sell, rent, or trade your personal information to third parties. We may share your information only in these limited circumstances:

• Service Providers: Trusted partners who help operate our service: Supabase for authentication and the database; Vercel for hosting and anonymous page-visit and web performance measurements; PostHog for product analytics, session recordings, error and diagnostic data, and in-app support conversations; Apple for Sign in with Apple and for push notifications on iOS; browser push services for web reminders; email delivery providers for sign-in codes; Stripe for web payments and subscription management, which receives your email address and your kardfolio account identifier; RevenueCat for subscription status across the web and the App Store, which receives your kardfolio account identifier and your purchase records; and Apple for App Store purchases. We share only the information reasonably necessary for them to perform these services.
• Legal Requirements: When required by law or to protect our rights and users’ safety
• Business Transfers: In connection with a merger, acquisition, or sale of assets

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit using HTTPS
• Data is stored securely in Supabase’s managed PostgreSQL database
• Access to personal information is limited on a need-to-know basis
• Regular security assessments and updates
• Secure authentication through Supabase
• We never store complete credit card numbers

kardfolio uses cookies and browser local storage to provide essential functionality and improve your experience:

Essential Cookies

• Authentication: A secure cookie maintains your login session. It is required for the service to function.

Local Storage

• Preferences and pending changes: Settings such as your appearance choice, and changes that are still being saved, are stored locally so they are not lost.
• Analytics: PostHog uses browser local storage to distinguish visitors and sessions. This is where the anonymous identifier for public-page visits and the record of how you arrived are kept.

We do not sell personal information or use analytics for cross-context behavioral advertising. You can clear cookies and local storage through your browser settings.

Do Not Track and Global Privacy Control

Because there is no uniform standard for browser “Do Not Track” signals, kardfolio does not currently respond to them. kardfolio also does not currently respond to Global Privacy Control signals.

You have the following rights regarding your personal information:

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your account and its data by contacting us
• Portability: Contact us to request a copy of personal information associated with your account
• Notification Control: Manage your push notification preferences and device permissions

To exercise these rights, contact us at support@kardfolio.app. You can correct the information you entered, and manage notifications, in the app.

We retain your information while your account is active and as reasonably necessary to provide, secure, and maintain the service. When account deletion completes successfully, your active kardfolio data and authentication record are deleted.

When you delete your account, we cancel a Pro subscription billed through Stripe and delete your customer record at RevenueCat. Stripe and Apple keep payment and transaction records as their own policies and the law require, for example for tax and accounting.

We also request deletion from applicable service providers. Limited information may remain in encrypted backups, security or audit records, operational logs, provider systems, or where retention is required by law. We may retain a minimal deletion record to prevent a deleted account from being recreated. kardfolio does not use that deletion record to personalize the service.

Our service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the service and update the effective date shown on this page.

If you have questions about this Privacy Policy or our data practices, please contact us at support@kardfolio.app.