Privacy Policy

Information we collect

• Account and profile: your email address, name, username, profile details, avatar, sign-in codes, and account settings.
• Content you provide: collections, card entries, decks, posts, photos, comments, likes, follows, reports, and other community activity. Collection imports may contain card and collection details.
• Usage and technical data: card scan and deck generation counts, notification preferences, device push tokens if you enable push notifications, and information needed to operate and secure the service. When you follow a link from a community post, we may record the destination, time, account (if signed in), IP address, and browser user agent.
• Website analytics: we use Google Analytics to measure page views, clicks, form submissions, and scroll depth. When you are signed in, events include your internal account ID, login status, and account role. We do not send names, emails, form contents, search text, or profile usernames to Google Analytics.
• Card scans: photos you submit for text recognition. Cardary processes these images to identify cards and does not save the scan photos as part of your collection.

How we use information

We use information to create and secure accounts, send sign-in codes, maintain collections and decks, provide community features and notifications, recognize scanned cards, generate or revise decks when requested, display card information and price estimates, enforce usage limits, investigate reports, and operate and improve Cardary.

What others can see

Your public profile and the content you choose to publish can be viewed by other people, including visitors who are not signed in. This may include your username, display name, bio, avatar, public collections and decks, posts and photos, comments, likes, and follower activity. A collection or deck marked private is not intended for public display. Profile and collection visibility controls are available in Privacy settings. Copies or screenshots made by others may remain after you remove public content.

Service providers and third parties

We use hosting and database providers, Amazon S3 for uploaded profile and post images, and Resend to deliver sign-in emails. If you use card scanning, an image may be sent to Google Cloud Vision for text recognition, depending on the configured scan provider. If you request AI deck features, relevant deck details and instructions are sent to OpenAI to generate the result. Card and pricing information comes from outside sources such as Scryfall, MTGJSON, and Pokémon card data providers. External links and images may be served by third parties under their own privacy practices. We may also disclose information when required by law or to protect the service and its users.

Cookies and local storage

Cardary uses authentication cookies to keep web users signed in and Google Analytics cookies to understand website usage. The browser may also store a local print queue. Your browser settings can clear cookies and local storage, though some features may stop working until you sign in again.

Retention and your choices

We keep account information and content while your account is active and as needed to run the service. You can edit your profile, change visibility settings, and remove content. You can request account deletion using the contact address below. Account deletion removes the account and associated database records and attempts to remove uploaded images. Some information may remain for a limited time in backups or where retention is required for legal, security, or operational reasons. To request access, correction, or deletion, contact us below; rights may vary by where you live.

Children

Cardary is not intended for children under 13. If you believe a child under 13 has provided personal information, contact us so we can review and remove it as appropriate.

Child safety and CSAE

Cardary prohibits child sexual abuse and exploitation (CSAE). This includes child sexual abuse material (CSAM), grooming a child for sexual purposes, sexual solicitation of a child, sextortion, and child sex trafficking. You may not use Cardary to create, upload, share, request, link to, or promote such content or behavior.

To report suspected CSAE or CSAM, use the Flag post action on a community post, send a report through our support form, or email gregory.avola+cardary@gmail.com. Include the relevant post link or username and a description of the concern. Do not send or forward suspected CSAM with your report. If a child is in immediate danger, contact local emergency services or law enforcement.

We review child safety reports and take appropriate action when we become aware of prohibited content or behavior. This may include removing content, restricting accounts, and reporting confirmed CSAM to the National Center for Missing & Exploited Children or the relevant regional authority as required by applicable law. We may process and disclose information needed to investigate reports, protect children, and comply with legal obligations. The email address above is Cardary's contact for child safety concerns.

Changes and contact

We may update this policy as Cardary changes. We will update the effective date above and provide additional notice when appropriate. For privacy questions or requests, email gregory.avola+cardary@gmail.com.