Privacy Policy

What we collect

• Account data. When you sign up, we store your email address and a hashed password. The password itself is never stored or transmitted in plain text.
• Saved projects. The text, settings, and design configuration you save in the editor are stored under your account so you can re-open them later.
• Billing status. If you subscribe to Cards Pro, we store subscription identifiers, plan status, renewal/cancellation dates, and customer portal links needed to keep your account access in sync. We do not store full card numbers or payment method details.
• Session cookie. After login we set an httpOnly cookie (cards_session) that authenticates you on subsequent requests. It is removed when you sign out.
• Local browser storage.A theme preference and a working draft of the current editor session are kept in your browser’s localStorage and never sent to our server.
• Images and assets. Free editor uploads stay in your browser session. Cards Pro can store reusable image assets under your account. Publishing integrations may also create temporary rendered PNG files so another service can fetch them.

Third-party services

We use external services that may process limited data on our behalf:

• Google Analytics — to understand basic, aggregate usage (page views, approximate location, device type) and product interaction events such as signup, checkout clicks, project actions, export actions, and publishing actions. We do not send project text, card images, passwords, payment details, or Buffer API keys to Google Analytics. Google may set cookies in your browser. See Google’s privacy policy. You can block analytics with a browser extension or “Do Not Track” / privacy-friendly browser settings.
• Tally — powers the feedback form. When you open and submit it, your responses (and any email you provide voluntarily) are sent to Tally and forwarded to us. See Tally’s privacy policy.
• Lemon Squeezy — powers checkout, subscription management, invoices/receipts, taxes, and payment processing for Cards Pro. When you start checkout or manage billing, Lemon Squeezy may process your email address, billing details, payment details, country/region, tax information, and transaction data. We receive limited subscription metadata from Lemon Squeezy so we can grant or remove Pro access. See Lemon Squeezy’s privacy policy.
• Buffer — powers optional social publishing. If you connect Buffer, we may store an encrypted OAuth token or encrypted personal API key. A personal Buffer API key grants account-wide Buffer API access, so only add it if you are comfortable granting Cards publishing access to your Buffer account. When you publish, Cards sends your post text, rendered card images, selected channels, and schedule time to Buffer so Buffer can create the post. Rendered PNGs may be uploaded to temporary export storage first so Buffer can fetch them by URL. See Buffer’s privacy policy.
• DigitalOcean Spaces — stores Cards Pro image assets and temporary rendered PNGs used for publishing integrations. Temporary publishing images are intended to stay available for up to 30 days. See DigitalOcean’s privacy policy.

What we do not do

• We do not sell or rent your data.
• We do not show ads and do not use advertising trackers beyond the analytics described above.
• We do not train AI models on your project content.

Your choices

• You can edit a project’s name and contents, duplicate it, or delete it from the Projects page.
• You can delete saved image assets from the editor’s asset library.
• You can disconnect Buffer or replace your saved Buffer API key from the Profile page.
• To delete your account and all associated projects, email dani@tinygods.dev from the address you registered with.
• You can clear the current browser draft from the editor. You can also clear local drafts and theme preference by clearing the site’s data in your browser.

Contact

Questions or requests about this policy? Write to dani@tinygods.dev.