CardPin Privacy Policy
Last updated: 26 October 2026 | Version: 2026-10
This policy explains what personal data CardPin (the "Service") collects, why, how long we keep it, and what you can do about it.
Three things worth knowing first
- The cards you post are fully public. The photo, the text and the place it was taken are visible to anyone using the Service.
- We do not track your movements. The server stores only the location at the moment you create a card, tied to that card; the location used to browse nearby cards serves that single query and is not kept. When the nearby-card reminder notices you are close to a place with cards, it sends your current location to the server for one query; the server does not store it or write it to a log. To stop faked GPS, the server keeps only the most recent location of each sign-in in memory, never in a database or log.
- You can delete your account and everything in it at any time. See the account deletion page.
What we collect
The table below lists every category of personal data the Service collects or derives. It corresponds item by item to the specifications of each feature, and is updated whenever a category is added or removed.
| Category | What it includes | Why | How long we keep it |
|---|---|---|---|
| Account data | Email address, password hash (people who use third-party sign-in may have no password), username, email verification status, the time and version of terms you accepted, age confirmation, third-party identity links (the user identifier provided by Apple or Google) | To create and verify your identity, sign you in, and send account-related email | Until you delete your account |
| Sign-in sessions | For each sign-in: creation time, last-used time, a device summary (platform and app version), expiry time | To keep you signed in and let you review and sign out other devices | Up to 90 days; signing out or deleting your account ends and removes the session |
| Email hash after account deletion | A one-way hash of the email address (it cannot be turned back into the address) and an expiry time | To block re-registration with the same address for a short period, so suspensions cannot be evaded | 30 days after deletion; if you were suspended when you deleted the account, until the suspension ends (30 days for a permanent suspension) |
| Card photo and text | The photo taken with the in-app camera (including any filter you applied) and an optional short note | To make up the card that is shown publicly on the map | Until the card is withdrawn or deleted, or the account is deleted; removed permanently from all storage within 24 hours |
| Where and when the photo was taken | Latitude, longitude, accuracy and time at the moment of capture; the country code derived from those coordinates | To pin the card on the map, decide interaction range, and show country flags on your profile | With the card; deleted when the card is deleted |
| Interactions | View records (who, which card, first time), hearts, saves (and the names of collections you create), hidden-card preferences | To count views and hearts (once per person), keep your saved list, and stop showing cards you hid | Until you undo the interaction, the card is removed, or the account is deleted; collection names are kept until you delete the collection or the account. Who gave a heart is never shown to other people, and your saves and collections are visible only to you |
| Reports | Who reported, which card, the reason category, an optional note, and the time | Content safety review | 90 days after review is complete. If you delete your account, reports are de-identified: the reason and card remain, the reporter's identity is removed |
| Moderation and suspension records | Moderator, subject, action taken, reason, notes, summary; suspension level, duration and reason; the reason a card was hidden | Governance audit and the basis for appeals | Action records are kept for 1 year from the action; suspension details are deleted 1 year after the suspension ends, or with the account if it is deleted. These cannot be deleted on request because they are audit evidence; after account deletion the subject is replaced with an identifier |
| In-app notices | The message telling you about an action taken, and its time | So anyone affected knows what happened and how to appeal | 90 days; removed when the account is deleted |
| Co-posting | Co-posting sessions and invitations (who was tagged, status, response time, who cancelled), card participants and their roles, party rosters and extension records, withdrawal requests (requester, optional reason, each person's response) | To run the confirmation flow, credit everyone on a shared card, and handle deletion that needs everyone's agreement | Participation stays with the card; cancelled sessions are cleared within 10 minutes of expiry; withdrawal requests are deleted within 30 days of concluding |
| Nearby-reminder trigger check | The coordinates at the moment of a location event (used for one query only), plus the notification log and reminder preferences held on your device | To work out whether you are near a place with cards, so we can send a "cards nearby" reminder | The coordinates are not kept. The server does not store them or write them to logs, and the device does not write them to a file. The device keeps a notification log for 7 days to avoid repeat reminders; turning reminders off, signing out or removing the app clears it |
| Text you type to search for people | The start of a username (3 to 20 characters) that you type in the Friends page search box or when tagging companions and that is sent to the server to look people up; matching only among friends already loaded on your phone sends nothing | To find the person you want to add as a friend or tag | Not kept. It is used for that search only; the server does not store it or write it to logs, and your phone does not save it |
| Language preference | The interface language you chose (Traditional Chinese / English / follow system) and the language sent with each request | To show the interface and send email in the right language | Stored with the account and deleted with it; the language sent with a request is not stored separately or used for analytics |
| Share links | The link identifier you generated for a card, the card it points to, who generated it (you) and when. The identifier cannot be guessed and contains no card content, coordinates or user data | To map the link to its card and to rate-limit link creation. A link only tells the recipient where the card is; the content is still revealed only on site, and the card's creator is not told who shared it | With the card; the link stops working once the card is withdrawn, deleted or taken down. If you delete your account, the "generated by" field is removed but the link still points to the card (which belongs to its creator); if you are the creator, the card is deleted with your account and the link stops working |
| Plan items | The owner (you), the card you added to your plan, when you added it and when you completed it; the order you put items in and the symbol you chose for each (a number or an emoji); the sub-plans you create (name, emoji, when created) and which sub-plan each item is in. Only a reference to the card is stored: no copy of the card's content and no record of your location | To show the list of cards you want to reveal and their markers on the map, organised by your order, symbols and sub-plans. Your plan and sub-plans are visible only to you; the card's creator is not told who added it | Until you remove the item from the list or delete your account; a sub-plan is kept until you delete it or delete your account (deleting your account deletes it too). The plan cached on your phone is cleared when you log out or switch accounts |
| Profile details | The name, bio, up to three links and up to five tags you enter. We store only the addresses you type in and do not track clicks | To show your public profile. Every signed-in user can see it; it can be reported and cleared by moderators | Until you clear it in the editor or delete your account |
| Profile photo | One photo you take or choose from your library, cropped square and resized to 512 × 512 pixels. All metadata such as where it was taken is removed before upload, and the server rejects files that still contain metadata. The original photo is not kept | To show on your profile and next to your name when someone opens your card on site. The app tells you before uploading that your profile photo is visible to everyone | Until you replace or remove it or delete your account; old files are deleted within 24 hours |
| Username changes | The username you changed away from and when | You can change your username once every 30 days. Your old username is held for 30 days so only you can switch back and nobody can impersonate you | 30 days, then deleted automatically |
| Profile reports | The reporter, the reported account, the reason and optional note, and the moderation result | So moderators can handle inappropriate profile content. Reporters are never revealed to the person reported | Same as card reports. If you delete your account, reports you sent no longer identify you, and reports about you are deleted |
| Integrity check result | Whether the device and app for this sign-in passed the platform integrity check, the reason category if not, and when it was checked | Only the genuine app on an unmodified device can post, open cards, co-post and report; moderators may refer to it | For that sign-in only; deleted when you sign out or the sign-in expires |
| Failed checks and unusual location counts | The account, the blocked action and the time; never any coordinates | So moderators can see signs of abuse (counts only, nothing is applied automatically) | Failed checks 7 days and unusual locations 24 hours, then deleted automatically; deleted with your account |
| Most recent location (memory only) | The coordinates, accuracy and time of the latest location-bearing request in the same sign-in | To tell whether a sign-in "teleported" in an impossible time, for example by faking GPS to open cards | One entry per sign-in, replaced by the next; kept only in server memory, never written to a database or log; gone when you sign out, the sign-in expires or the server restarts |
| Known devices | The platform, and an irreversible hash of a random identifier the app creates on install (not a hardware identifier; it changes if you reinstall) | To email you when your account signs in on a new device | With your account; removed after a year without signing in on that device, or when you sign out of all devices or delete your account |
| Crash reports | App version, platform, device model (such as “Pixel 7”, not a device identifier), operating system version, the screen that was open, the error details and when it happened; locations, email addresses and sign-in credentials are removed before sending | To find and fix bugs in the app | Deleted automatically after 90 days; they contain no account, location or photos and cannot be linked to you, so deleting your account does not affect them |
| Friends and friend requests | Who sent a friend request to whom, when, and its status; who is friends with whom and since when; cards shared with friends, who shared them, with whom and when | To show your friend count and friend list, let friends see where each other's cards are (not their content) without being nearby, and provide new-card notices and sharing with friends | Requests are kept until accepted or withdrawn; a friendship until either of you removes it or deletes your account; a share until the card is deleted or the recipient removes it from their plan. You can withdraw a request, remove a friend or delete your account at any time |
| Friend notice settings | Whether you get new-card notices for each friend, and the overall switch for friend new-card notices | To decide whether the app tells you a friend posted a new card (no system push notifications) | As long as the friendship; deleted when you remove the friend or delete your account; you can turn it off at any time in your friend list or settings |
| Co-posting groups | Groups created for you automatically after a co-post is published: the group name you set, the group members (other accounts), when it was created and when it was last used | To add the whole group in one tap the next time you tag companions; only you can see your groups, and members are never notified | Until you delete the group or your account; a member who deletes their account is removed from the group automatically. You can rename a group, remove members or delete it at any time |
| Block list | The users you block and when you blocked them | So that you no longer see their content, and so that neither of you can tag, join parties with, send friend requests to or share with the other | Kept until you unblock or either account is deleted. Only you can see it; the other person is not notified and moderators cannot see it. You can unblock at any time in Settings → Account → Blocked users |
| History of your consents | The version and time of every time you agreed to the Terms of Service, Privacy Policy and Community Guidelines (not only the latest) | To show which version you agreed to, and to decide whether you need to agree again in the app after an update | For as long as your account exists; deleted with your account |
| False-positive reports | Kept only when you tap “I think this is a mistake”: your account, the field that was blocked, the text you entered, the app language, the time, and the filter words it matched | So an administrator can check whether the word filter made a mistake and fix the word list; we do not reply individually, and the report does not let that text through | Deleted 90 days after it is handled; deleted with your account |
| Report outcome notices | The outcome of a card or profile you reported when the case is closed (the content was removed, no breach of the Community Guidelines was found, or the card had already been removed) and the time; never any action taken against the other person's account | To let you know your report was handled within 24 hours | 90 days; removed when you delete your account |
| Moderator on-call roster | The accounts of moderators and their on-call shifts (only the moderation team, never ordinary users) | To email the on-call moderator when a report has been waiting close to 24 hours | Until an administrator removes it; shifts are deleted automatically 30 days after they end |
Text filtering
To keep objectionable text from being published, card notes, display names, usernames, bios, tags, links and withdrawal reasons are checked on our server against a word list when you submit them (the list is not in the app and is not published). See the Community Guidelines for the rules.
- Blocked text is not stored. The server keeps only statistics (which field, blocked or sent for review, the category and language of the word, the time) — never the text itself and never which account it came from. These statistics are kept for 1 year.
- Text that may be inappropriate but is published as usual creates a moderation case together with the matching snippet, handled and kept the same way as a report.
- We keep the text itself only when you tap “I think this is a mistake” (see “False-positive reports” in the table above).
What we do not collect
- Your movement trail or location history
- Name, phone number, date of birth, gender, national ID or any other field not requested at registration
- Your contacts, messages or data from other apps. Your photo library is opened only when you choose a profile photo from it, and only the photo you pick is uploaded
- Advertising identifiers. The Service carries no advertising and uses no third-party advertising or tracking (for the map provider's anonymous usage statistics, see the next section)
- The full list of locales on your device, or your keyboard languages
- How many times a share link was opened, or who shared a link with whom; the link's landing page writes no records
- What you type to search for people: it is used for that search only and then discarded, never stored or written to logs (see “Text you type to search for people” in the table above)
Who else handles your data
The following third parties process some data so that the Service can work. They may use it only as needed to provide that service.
| Who | For what | What they see |
|---|---|---|
| Map provider (Mapbox) | Serving map tiles; anonymous usage statistics that improve maps, routing and traffic data | The map area you are viewing. By default the map component also sends de-identified location and usage data to the provider (not linked to your account, not used for advertising); you can turn this off from the ⓘ button in the corner of the map. Handled under the provider's own policy |
| Object storage provider | Storing and serving card photos and profile photos | Card photos and profile photos |
| Email delivery provider | Sending verification, password reset and account email | Your email address and the contents of those messages |
| Network delivery and protection provider (Cloudflare) | Relaying every connection, protecting against attacks and caching the website's static content | Your IP address, the URLs you request and connection metadata, kept by the provider for a limited period under its own policy and then deleted; we cannot retrieve per-request records from it |
| Apple, Google | Device and app integrity checks | When you post, open a card, co-post, report or sign in, the app asks the platform for an integrity proof (device information is handled under the platform's own policy); we only receive whether it passed and a reason category |
| Apple, Google | Third-party sign-in | Only if you choose to sign in with them: they give us a user identifier and, depending on your settings, an email address |
Apart from the above, we do not sell, rent or otherwise share your personal data. If we are legally required to disclose it, we will notify you beforehand to the extent the law allows.
International transfers
The cloud services we use may store or process data outside Taiwan. We check that providers have reasonable data protection measures in place before choosing them.
Security
- All traffic between the app and our servers is encrypted in transit.
- Passwords are stored as one-way hashes; we cannot read your original password.
- Authentication and authorisation are enforced on the server.
- Access to production data is limited to the minimum needed to operate the Service.
Your rights
- Access and correction: you can view and change your account details in the app's settings.
- Deletion: you can delete an individual card at any time, or delete your whole account. See the account deletion page.
- Withdrawing consent: you can revoke camera, location or notification permissions in your system settings at any time; the related features will then stop working.
- Questions: email support@cardpin.net.
Children
The Service is not for anyone under 13. If we learn that we have collected personal data from someone under 13, we will delete the account and its content as soon as we can. If you are a parent or guardian and believe your child is using the Service without your consent, please contact us.
Changes to this policy
This policy shares one version number with the Terms of Service and the Community Guidelines. Significant changes (new categories or uses of personal data) get a new version number and you will be asked to agree again in the app; fixes to typos or contact details only change the "last updated" date on this page.