Privacy Policy

The short version

Who we are

Cards & Such is made and published by Mark Isayan, an individual developer (“we”, “us”). We are responsible for the personal data described in this policy. You can reach us at devcraftsio@gmail.com.

What we collect and why

Your account

• Guest accounts. When you start playing, we create a guest account with a random user ID. It holds no name, email or contact details.
• Saved accounts. When you save your collection or sign in with Apple (or with Google on Android, once available), we receive and store the identifier that service assigns to your account and the email address it shares. With Apple you can choose “Hide My Email”, in which case we only see a private relay address. The app requests your email only; it does not request or store your name.
• Why: to create and secure your account, keep you signed in, and let you restore your collection on a new phone.

Game data

• The cards you own and how many copies, which shinies and prisms you have, the packs you opened and the cards in them, the cards you kept, your dust, your unopened pack credits, your streak, the rewards and badges you earned, and when these things happened.
• Why: to run the game. Packs, odds, rewards and your inventory are decided and stored on our servers so they can’t be tampered with.

Purchases

• Paid packs are bought through Apple’s App Store or Google Play. They handle payment; we never see your card number, billing address or payment details.
• For each purchase we store: the platform (iOS or Android), the store’s transaction ID, the product, how many packs it granted, whether it was a real or test purchase, when it was granted and, if it applies, when it was refunded.
• RevenueCat verifies each purchase with Apple or Google and passes us its record, including the country the store reports. We check that country because paid packs are not offered in some countries; we don’t store it.
• Why: to grant each purchase exactly once, restore purchases interrupted by a crash or lost connection, and handle refunds.

Analytics

• We use PostHog to understand how the app is used, for example which screens are visited, when packs are opened and games are played, along with basic device information such as the device model, operating system and app version.
• These events are linked to your internal user ID only. We never send your name, email address or purchase receipts to PostHog.
• Why: to see what works, what confuses players and where to improve the game.

Crash reports

• If the app crashes or hits an unexpected error, Sentry receives a report with technical details: what went wrong, the device model, operating system and app version, linked to your internal user ID.
• Sentry is configured not to collect personal information such as names, emails or IP-based identity data.
• Why: to find and fix bugs.

Technical data

When the app talks to our servers, our hosting providers process technical information such as your IP address, request times and the type of device and software making the request. This is needed to deliver the service and to protect it from abuse, for example by limiting repeated sign-in attempts.

On your phone

The app stores a few things on your device only: the session that keeps you signed in, a copy of your collection so the album works offline, your settings (such as haptics and pack-ready alerts) and a list of purchases already redeemed. Deleting the app removes them.

Notifications

If you allow notifications, the app schedules a local reminder on your phone for when your free pack is ready. The reminder is scheduled on your device; we don’t run a push notification server and don’t collect a push token. You can turn alerts off in the app’s Settings or in your phone’s settings at any time.

What we don’t collect

• We don’t collect your name, contacts, photos, precise location or microphone audio.
• We don’t use advertising identifiers (Apple’s IDFA or Google’s advertising ID) and don’t show an App Tracking Transparency prompt, because we don’t track you across other companies’ apps or websites.
• There are no ads in Cards & Such.
• We don’t sell your personal data, share it for targeted advertising, or give it to data brokers.

Legal bases

Where laws such as the EU and UK GDPR apply, we rely on these legal bases:

• Performing our contract with you: your account, game data and purchase records, which we need to provide the game you asked for.
• Legitimate interests: security and abuse prevention, analytics linked to an internal ID, and crash reports, which help us keep the game safe and working without identifying you by name.
• Consent: notifications, which you can switch off at any time.
• Legal obligations: where we must keep or disclose information by law.

Service providers

We use these companies to run Cards & Such. They process data on our behalf, or as independent providers where you use their services directly (for example, paying through Apple). Each has its own privacy policy.

These providers may process data in the United States and other countries. Where data leaves your country, they use legal safeguards such as the European Commission’s standard contractual clauses. We may also disclose information if the law requires it, or to protect the rights and safety of players and the service.

How long we keep data

• Account and game data are kept while your account exists and are deleted when the account is deleted.
• Purchase records are kept while your account exists. When it is deleted, we keep only an anonymous record of each store purchase (the store’s transaction number, the product, the packs it granted and its dates, with nothing that links it to you or your account), so the same purchase can never be granted twice.
• Guest accounts can be reached only from the phone they were created on until you save them. If you delete the app or sign out before saving, the guest account can no longer be reached from any device; its data stays on our servers until it is deleted. We may delete guest accounts that have been inactive for a long time.
• Analytics and crash reports are kept only as long as needed to improve the game, within the retention limits of PostHog and Sentry.
• Server logs are kept for short periods by our hosting providers for security and troubleshooting.
• Apple, Google and RevenueCat keep their own records of purchases under their own policies, which may include records they must keep for tax and accounting.

Deleting your account

You can delete your account and all of its data at any time, right in the app. It works the same for guest and saved accounts:

1. Open Cards & Such and go to Settings → Delete account, at the bottom of Settings.
2. Read what will be deleted, then type DELETE to confirm. If you sign in with Apple, Apple asks you to confirm it’s you, and we revoke the app’s Sign in with Apple access.
3. Your account is deleted right away, and the app signs out and returns to its welcome screen.

Deleting your account:

• deletes your sign-in account, including the identifier and email address from Apple or Google;
• deletes your game data with it: your collection, packs (including unopened paid packs), dust, credits, streaks and rewards;
• deletes your customer record at RevenueCat, our purchase processor;
• keeps only an anonymous record of each store purchase (the store’s transaction number, the product, the packs it granted and its dates, with nothing that links it to you), so the same purchase can never be granted twice;
• clears what the app stored on this phone for your account: the copy of your collection, the list of redeemed purchases and any scheduled pack-ready alert.

Analytics and crash reports carry only your internal user ID, which no longer points to anyone once the account is gone; they expire within PostHog’s and Sentry’s retention limits, and you can email us to have them deleted sooner.

Deletion is permanent. Your cards, dust and any unopened packs can’t be recovered, and deleting your account doesn’t refund past purchases. You can also remove Cards & Such at any time under your Apple ID’s “Sign in with Apple” settings.

If you no longer have the app

Email devcraftsio@gmail.com with the subject “Delete my account” and tell us how you signed in (Apple or Google) and, if you can, the email address shown under “Signed in” in the app’s Settings. We may ask you to confirm the request from that address so nobody else can delete your account. Within 30 days of confirming it, we delete your account and data as above, and ask RevenueCat, PostHog and Sentry to delete the data they hold under your internal user ID.

Guest accounts carry no email address, so we may not be able to match an email request to one: delete a guest account in the app instead. Support has the same steps: Delete your account.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that’s wrong;
• delete your data;
• object to or restrict some processing, such as analytics;
• withdraw consent you gave, such as for notifications;
• receive your data in a portable format.

If you live in California or another US state with a privacy law, you also have the right to know what we collect and to delete or correct it. We don’t sell or share personal information for cross-context behavioural advertising, and we won’t treat you differently for using your rights.

To use any of these rights, email devcraftsio@gmail.com. We’ll reply within 30 days and may need to confirm that the account is yours first. You can also complain to your local data protection authority.

Children

Cards & Such is not directed to children under 13, or under the minimum age for consenting to data processing in their country, and it is not part of the App Store’s Kids category. We don’t knowingly collect personal data from children under those ages. If you believe a child has given us personal data, contact us and we’ll delete it.

Security

• All traffic between the app and our servers is encrypted (HTTPS).
• Each player can read only their own game data. Packs, cards, credits and rewards can be changed only by our server, never directly by the app.
• Purchases are verified with Apple or Google, through RevenueCat, on our server before anything is granted.
• Server keys are kept on the server and never shipped in the app or this website.

No system is perfectly secure, but we work to protect your data and will act quickly if something goes wrong.

This website

This website is informational. It has no accounts, no forms, no cookies and no analytics. Our host, Vercel, keeps standard server logs (such as IP addresses and request times) to deliver the site and keep it secure.

Changes to this policy

If we change this policy, we’ll update it here and change the effective date at the top. If a change materially affects how we use your data, we’ll also tell you in the app before it takes effect.

Contact

Questions about privacy or this policy: devcraftsio@gmail.com. Mark Isayan, publisher of Cards & Such.