Privacy Policy

Last updated September 30, 2026

Cardy lets you keep your social handles and contact details as cards and share them. It's made by Edison Lee (“we”), and built to collect as little as possible. There are no ads, no analytics and no tracking, and we never sell your data. Questions: support@entercardy.com.

What stays on your iPhone

• Your cards, name and profile photo, until you turn on your Cardy link (below).
• People you've saved from codes, links, Nearby swaps or Contacts. Only people who have a Cardy link are synced, and only if you sign in.
• Your themes, sharing presets and settings.
• Contacts: Cardy only sees the contacts you pick in the system contact picker. It never reads your address book, and saving someone to Contacts uses the system's own screen.
• Camera: used only to scan Cardy codes. Nothing it sees leaves your phone.
• Nearby: swaps go directly between the two phones, encrypted, over the local network. Nothing passes through our server.

Your Cardy link (optional)

If you turn on your Cardy link, we store:

• Your name, the cards you add (handles, links, phone number, email) and your theme. This is your public card page: anyone with the link or QR code can see it, so only add what you're happy to share. Card pages ask search engines not to index them.
• Your profile photo, if you set one, stored as a small JPEG with its metadata (like location) removed. It isn't on your card page. It's shown in the Cardy app to people who have your card, your friends, and people who find you by username or get your friend request, and anyone with its web address can load it. Removing your photo in Cardy deletes it from our server.
• A secret key that lets your phone edit your card. We store only a one-way hash of it.
• If you share only some of your cards, a separate link that shows just those (plus your name and photo). Nobody with that link can see the rest.
• Only when you tap “Send My Card Back”: that you saved someone's card, so they can see yours and add you back. Either of you can remove it anytime.
• If you tried a test version of Cardy that had invite rewards, a record of whose card brought you to Cardy. It is deleted with your link.

Optional account (Sign in with Apple)

You don't need an account. If you sign in with Apple, we store:

• The identifier Apple gives Cardy for your Apple Account, and the email Apple shares (you can hide it with Hide My Email). We don't send you email; it's only shown to you in Settings.
• The username you pick. Signed-in people can find you by it and see your username, name and photo.
• Which Cardy link is yours, and the saved people who have Cardy links (so they come back on a new iPhone).
• Friend requests, your friends, which of your cards each friend can see, and which of your sharing presets they follow (the presets themselves stay on your phone). Friends only ever see the cards you choose, and your friends list is visible only to you.
• People you've blocked. Sessions are stored only as one-way hashes.

Reports and blocks

• When you report someone, we store the reason, anything you write, your account if you're signed in, and a copy of the name, username, cards and photo you reported, so we can review it. We never tell anyone who reported them.
• Reports are kept while we handle them and for up to a year after. If we ban an account for breaking the Terms of Use, we keep a one-way hash of its Apple identifier so it can't sign up again.
• Blocks are stored so we can keep blocked people away from you.

Security and abuse prevention

To stop abuse we keep secret-keyed one-way hashes of network (IP) addresses: briefly for rate limits (they are deleted after a few days), and one per Cardy link for the network it was created from. We never store the addresses themselves in our database. Our hosting provider keeps standard request logs, which include IP addresses, for a short time. Everything travels over HTTPS.

Purchases

Cardy Premium is sold through the App Store. Apple handles payment; we never see your payment details, and your purchase is checked with Apple on your device. We don't store it.

How we use your data

Only to run Cardy: to show your card to the people you share it with, sync your account, connect friends, keep people safe (reports, blocks, moderation) and prevent abuse. We don't use it for advertising, tracking or profiling, we don't use it to train AI, and we don't sell or rent it.

Who we share it with

• Vercel (hosting) and Neon (database), both in the United States. They process data only to run Cardy for us, under data protection terms that protect it at least as well as this policy.
• Apple, for Sign in with Apple, the App Store, TestFlight and App Clips.
• Authorities, only when the law requires it.

Deleting your data

• Your Cardy link: Me → Settings → Your Cardy Link → Turn Off Link. This deletes your card, its photo, share links and connections from our server right away. Your link's key is kept in your iCloud Keychain, so you can still turn it off from a new iPhone.
• Your account: Me → Settings → Account → Delete Account. This deletes your account, username, friends, requests, blocks, synced People, and your Cardy link, and removes Cardy from Sign in with Apple (or tells you how to).
• Your photo: remove it in Me → Settings; it's deleted from our server when your link updates.
• Deleting the app removes what's on your phone, but it doesn't turn off your Cardy link or delete your account. Do that in Settings first.
• Afterwards, copies can remain for a short time in database backups (up to 30 days) and link previews (up to an hour). People you shared with keep what they already saved, just like a paper business card.
• You can also email support@entercardy.com to see, correct or delete your data, or to withdraw your consent. We answer within 30 days.

Children

Cardy is for people 13 and older and isn't directed at children. If we learn that a child under 13 gave us personal data, we delete it. If you think that happened, email us.

Changes

We'll update this page when anything changes and change the date above. Important changes are also shown in the app.

Contact

Edison Lee · support@entercardy.com · Support