Privacy Policy

1. Who this covers

This policy explains how CardNest handles personal information when you use our website and app. It applies to visitors and to people with accounts.

CardNest is operated by CardNest LLC, which is responsible for the personal information described here. You can reach us at team@cardnest.co.

2. What we collect

Information you give us when you sign up. Your email address, your name, and a password. Passwords are stored only as a salted hash; we never see the password itself. If you sign in through another provider, we record which provider you used.

Your profile. A username, and optionally a display name, avatar image and short bio.

What you create. Your binders and pages, which cards you have placed in them and where, which cards you have marked as collected, any notes or condition and price details you add, and any images you upload such as custom card scans or binder covers.

Feedback. If you send us feedback through the app, we keep what you wrote alongside your account so we can reply and follow up.

Payment information. If you subscribe, your card details go directly to Stripe, our payment processor, and the sale is made by Link as merchant of record. We do not receive or store your card details. We keep your subscription status, plan, and the identifiers Stripe gives us so we know what your account is entitled to.

Technical information. Our hosting provider processes standard request data such as IP address, browser type and timestamps, which is needed to serve the site and to protect it from abuse.

Usage analytics, only with your consent. If you accept analytics cookies, we record page views and basic product events so we can see which features get used. This is tied to your account identifier when you are signed in. If you decline, this does not run.

3. What we use it for

• Running your account, and keeping you signed in.
• Storing and displaying your binders, and sharing the ones you make public.
• Sending transactional email such as verification and password resets.
• Taking payment and managing subscriptions.
• Keeping the Service secure, and investigating abuse.
• Understanding which features are used, so we know what to improve.

We do not sell your personal information, and we do not use it for advertising.

4. Cookies

Essential cookies keep you signed in and remember your cookie choices. The Service does not work without them, so they are not optional.

Analytics cookies are set by PostHog and are only used if you accept them in the consent banner. You can change your mind at any time through the cookie settings, and declining removes them.

5. Who else processes your data

We keep the list of third parties short. Each of these processes data on our behalf, under contract, for the purpose described:

• Cloudflare: hosting, the database that stores your account and binders, and the object storage that holds card and cover images.
• Stripe: payment processing, subscription billing and sales tax. The sale is made through its Link service, which is the merchant of record, meaning Link sells the subscription to you on our behalf and is the name you will see on your statement.
• Resend: delivery of transactional email such as verification and password reset messages.
• PostHog: product analytics, only where you have consented.

These providers process data in the United States and other countries, so your information may be transferred outside the country you live in. We may also disclose information where the law requires it, or to protect the rights and safety of our users.

6. What other people can see

Binders are private by default. If you make one public or share its link, that binder and its contents become visible to anyone with the link, along with your username, display name, avatar and bio. Public binders may also be shown in community areas of the Service.

Your email address is never shown to other users.

7. How long we keep it

We keep your account information and binders for as long as your account exists.

When you delete your account, your binders, pages, uploads and profile are deleted. We retain a minimal record of the deletion itself, which includes the email address and username that were on the account, the plan it was on, and how many binders it had. We keep this to stop a closed account being immediately recreated to evade a suspension, and for basic accounting. It contains none of your binder contents.

Backups are kept for a short period and then overwritten on their normal cycle.

8. Your rights

Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, object to or restrict how we use it, and receive it in a portable format.

Most of this you can do yourself: profile details are editable in settings, and account deletion is available there too. For anything else, or if you want a copy of your data, contact us at team@cardnest.co and we will respond within a reasonable time. If you are in the UK or EU and are unhappy with our response, you may complain to your local data protection authority.

9. Children

CardNest is not intended for children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us at team@cardnest.co and we will delete it.

10. Security

Data is transmitted over HTTPS and stored with our hosting provider. Passwords are hashed. Access to production data is limited to those who need it to run the Service. No system is completely secure, so please use a strong, unique password.

11. Changes to this policy

If we change how we handle your information, we will update this page and the date at the top. Where a change is significant, we will make a reasonable effort to tell you directly.

12. Contact

Questions about privacy, or requests about your data, can be sent to team@cardnest.co.