Privacy Policy

What this covers

This policy describes what cardflare collects from the cardflare.ggwebsite and the cardflare app, and what we do with it: player accounts, guest sessions, invite requests from stores and vendors, and the messages players send each other about cards.

Information you give us

When you create a player account we store:

• Your email address, display name and handle.
• What you add to your profile: a picture, the games you play, your wants and decks, and optionally a five-digit ZIP. A device location, when you grant one, rides a single request and is never stored.
• Messages you send other players about a card, so both sides of the conversation can read it.
• In the app, if you allow notifications, the push token your phone gives us, so an offer on your Flare can reach you. Turning notifications off removes it.
• If you subscribe to cardflare Pro in the app, Apple bills it and holds your payment details. We receive the transaction reference and whether the subscription is active, never your card.

Payments and subscriptions. cardflare Ultra for stores, andcardflare Pro when bought on the website, are billed through Stripe. You enter your card on a page Stripe hosts, and Stripe collects and processes your payment method, billing details, contact details and transaction history under its own privacy policy. cardflare never receives or stores a full card number. What we do keep, so the subscription works, is: your Stripe customer and subscription identifiers, the plan you chose, the subscription’s status (trialing, active, past due or cancelled), the date it is paid through, and whether it is set to end at that date. We send Stripe your account email and an internal account reference so it can match the subscription to you. Receipts and invoices live with Stripe, not with us.

When a store or vendor requests an invite we store:

• A first name, an email address and the business type.
• Anything optionally added: primary card game, city, state or region, store name, and the comment.

We do not ask for a mailing address or phone number, and we never see your card number.

How we use it

• To run the product: accounts, rooms, Flares, the Feed and messages.
• To answer invite requests from stores and vendors.
• To email you about your account and, if you opted in, product news.

We do not sell your information, and we do not share it with advertisers.

Email

We email what your account needs: sign-in links, password resets, and notifications you can expect, like an offer landing on your Flare. An invite request gets a reply about setting you up.

The optional box on the invite form is separate: tick it and we may also send news, event announcements and trading tips. Leave it unticked and we will not.

Every marketing email we send includes a way to unsubscribe.

Playing as a guest

You can join cardflare as a player without an account. We ask for a display name and nothing else: no email address, no password, no phone number.

We store that display name, the times the session was created and last used, and a random value that identifies your device. That value is held only as a one-way hash, so the copy in our database cannot be used to sign in as you.

The session expires after 30 days of not being used. “Leave and forget this device” on the player page deletes it immediately.

Cookies

cardflare sets one cookie for players, which keeps you signed in to your guest session. It is strictly necessary for that feature and is not used for advertising or cross-site tracking. Stores signing in also get a session cookie from our authentication provider.

Analytics

We use privacy-conscious, aggregate analytics to understand how many people visit the site and which sections they read. These measurements are not linked to your account, and the site works normally if you block analytics.

Where your information is stored

Accounts, invite requests and messages are stored in a Supabase (PostgreSQL) database. The site is hosted on Vercel. Card payments are handled by Stripe. All three providers process data on our behalf under their own security and privacy terms.

How long we keep it

We keep your account while it is active and invite requests while we are answering them. Ask us to delete yours at any time.

Deleting your data

You can delete your account yourself: in the app, open your profile, then settings, then Delete your account; on the website, the same card sits at the bottom of your profile settings. It removes your profile, Flares, lists, showcase, messages and unlocks at once, and it cannot be undone. A subscription is cancelled separately: Pro bought in the app in your Apple subscription settings, and Pro or Ultra bought on the website from the Manage billing button on your plan page. Stripe keeps its own records of past payments as the law requires it to.

You can also email hello@cardflare.gg from the address you signed up with and ask us to delete your account or your invite request, or for a copy of what we hold about you.

Children

cardflare is not intended for children under 13. If you believe a child has signed up, contact us and we will remove the account.

Changes

If we change this policy we will update the date at the top of this page. Material changes will also go out by email.

Contact

Questions about privacy can go to hello@cardflare.gg.