Privacy Policy

1. Who this covers

This policy explains what CardMe collects when you use CardMe, why, who we share it with, and what control you have. Questions go to support@cardmeapp.com.

2. What you give us

• Account: your email address and password (stored only as a salted hash), or the identifier from Sign in with Apple or Google if you use one of those.
• Profile: optionally, whether you prefer cash back or points. We do not ask for your name, your date of birth, or your gender.
• Your cards: which credit cards you tell us you hold. We do not ask for and do not store full card numbers, CVVs, expiry dates, or PINs.
• Requests and reports: if you ask us to add a card, the bank and card name you send; if you report that a rate looks wrong, the card, merchant, category, rates, and any note you write.

3. What we collect as you use the app

• Requests to our servers, including the merchant, category, and card involved in a recommendation, so we can produce and improve results.
• A record each time you open the app, with the time and — if you have granted location permission — your approximate location. See section 4.
• Basic technical data that comes with any network request, such as app version and general device type.
• Diagnostic and crash information, where you have allowed Apple to share it.
• The version of these documents you accepted, and when.

4. Location

If you grant location permission, CardMe uses your device's location in three ways.

• Finding nearby merchants: the search runs on your device, using Apple Maps. Your coordinates are not sent to our servers for it.
• Cards you use and categories you correct: when you tell us you used or skipped a suggested card at a nearby merchant, or correct a merchant's category, we store that merchant's name, category, and exact map coordinates with your account. Because the merchant was near you, these records show where you were at the time. We use them to make recommendations work and to improve them.
• App opens: each time you open CardMe we record your location, rounded to about one kilometre before it leaves your device, along with the time. This happens whether or not you ask for a recommendation, and it means we hold a history of the places you have opened the app. We use it to understand where and when CardMe is used, so we can improve it.

Location is only used while the app is open — we do not collect it in the background, and CardMe does not request “Always” location access.

You can revoke location permission at any time in iOS Settings. App opens are still recorded, without a location attached.

5. How we use your information

• To run the Service: recommend cards and show your wallet.
• To create and secure your account, and to detect abuse and fraud.
• To fix bugs, measure whether features work, and improve the Service — in aggregated or de-identified form wherever that is enough.
• To contact you about your account or a material change to the Service.
• To meet legal and regulatory obligations.

We do not use your information to build advertising profiles, and we do not run third-party advertising in the app.

6. Who we share with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We share it only with:

• Apple, and Google if you use its sign-in, to authenticate you; and Apple Maps, to search for merchants near you;
• infrastructure providers who host our servers and database, under contract and only to provide that hosting;
• authorities or other parties where we are legally required to, or where it is necessary to protect our rights, our users, or the public;
• a successor entity, if the business is merged or acquired — in which case this policy continues to apply until you are told otherwise.

7. How long we keep it

We keep your account information while your account exists. App-open records, including their locations, are kept for a limited period and then deleted. We may keep records longer where the law requires it, and in routine encrypted backups for a limited period after deletion.

Your consent record — which version of these documents you accepted and when — is kept for as long as your account exists and for a period afterwards, because it is the record of the agreement between us.

8. Your choices and rights

• Access and correct: your profile is editable in the app.
• Revoke location: in iOS Settings.
• Delete your account: in the app, at any time. This deletes your profile, your cards, and the records tied to your account from our systems, subject to backups and legal retention.

Depending on where you live, you may have additional rights — including to know what we hold, to have it deleted or corrected, to a copy of it, to opt out of sale or sharing (we do neither), and not to be discriminated against for exercising them. Write to support@cardmeapp.com and we will respond within the time the law allows. We may need to verify your identity first.

9. Security

Traffic between the app and our servers is encrypted in transit. Passwords are stored only as salted hashes. Access to production data is restricted to those who need it.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you as required by law.

10. Children

CardMe is not for anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us information, contact support@cardmeapp.com and we will delete it.

11. Where data is processed

We operate in the United States, and your information is processed there and in other countries where our service providers operate. Those countries may have different data protection laws than your own.

12. Changes to this policy

We may update this policy. Material changes raise the version number and you will be asked to review and accept the updated documents in the app.

13. Contact