Privacy · CardDecoded

What we process

CardDecoded processes your account identifier, card photos, card details, recognition results, evidence links, display-currency preference, plan usage, and billing status. For new accounts we may retain the coarse country inferred by Vercel during signup for up to 13 months. We do not retain the originating IP, precise location, or location history for this purpose. Payment details are handled by Stripe, Apple, or Google and never pass through CardDecoded.

Why we process it

We use this data to authenticate you, privately store your collection, identify cards, research evidence, show approximate values in your preferred currency, understand coarse signup regions, enforce plan limits, prevent abuse, provide support, and keep the service reliable.

Card photos and AI

Front and back photos are stored in private storage and are sent to configured AI providers only to perform the recognition, valuation, or private presentation-image task you request. Presentation derivatives never replace the original evidence photo. CardDecoded does not create public image URLs and does not sell your collection data.

Retention and deletion

Short-lived upload handoffs and signup-country OAuth tokens expire automatically. A saved signup country expires after 13 months and can be removed sooner from Account and data; removal also prevents it being captured again. Saved card photos and history remain until you delete the card or your account, subject to limited security, billing, and legal records we must retain. Deletion jobs may continue briefly while private storage objects are removed.

Processors and international transfer

CardDecoded currently relies on Vercel for hosting, Supabase for authentication/database/storage, OpenAI for card recognition, Photoroom for private background removal, Stripe for web billing, RevenueCat for store-subscription status, Apple and Google for store purchases, Google for sign-in, and Cloudflare for DNS. These providers may process data in other countries under their contractual safeguards.

Your choices

Signed-in users can change display currency, remove a saved signup country, export structured account data, or request permanent account deletion from Account and data. You may also edit card records directly or contact us for help with access, correction, portability, objection, or deletion.

Contact

Email support@carddecoded.com for privacy or data requests.