YOUR INFORMATION

Privacy policy

Effective October 12, 2026

Cardallet is a loyalty and membership card wallet operated by Tareq Anwar. Contact trqnwr@gmail.com with privacy questions or requests. This policy covers the Cardallet mobile app and cardallet.app.

Information you provide

When you create an account, our authentication provider, Clerk, processes your account identifier, name, email, username, authentication details, and session information. Google or Apple sign-in shares the identity information you authorize, such as an account identifier, name, and email address. We request basic identity information for sign-in; we do not request access to Gmail, Drive, Calendar, or your contacts.

Cards you save may include a brand, card number and barcode format, nickname, folder, notes, balance or expiry you enter, and saved store coordinates. Signed-in cards sync to our backend. Household membership, invitations, access permissions, and card updates are also stored to provide sharing and sync. PINs use your device's secure storage and are not uploaded. Card photos stay on the device and are not uploaded by Cardallet.

Location and nearby places

Location is optional. With permission, Cardallet uses your device location while the app is open to show nearby places, distances, and a neighborhood label. It does not track location in the background. Nearby searches send coordinates and search terms to the configured place service, currently Photon using OpenStreetMap data. Device geocoding and Maps links may also send location or a destination to your device's mapping provider. Card numbers and account details are not sent with place searches. A store location you explicitly attach to a card can be saved with that card and synced.

Camera, photos, and device security

The camera is used when you choose to scan a barcode. The photo picker is used when you choose a card image. Cardallet does not upload camera frames or card images. Device authentication can protect PIN reveal; Cardallet does not receive or store biometric templates. Your device and its backup settings may retain locally stored app data.

How information is used and shared

We use information to authenticate you, save and sync cards, enforce sharing permissions, support your requests, and keep the service reliable. Clerk provides account authentication, Vercel hosts the backend and public pages, and Neon provides database storage. These providers process information to operate their services, including technical request data such as IP addresses and security logs. Information may be processed outside your country.

Sharing a card gives the selected recipient access under the permission you choose. Shared card responses omit your private notes, PINs, and device photo paths. If you export a file or share a card copy through another app, the recipient or service receives the information in that export; copies already received cannot be recalled by Cardallet. Cardallet does not sell personal information or include advertising trackers.

Retention and your choices

You can edit or delete individual cards, revoke live sharing, and turn location off in the app or device settings. Deleted synced cards use deletion markers to prevent stale devices restoring them. Signing out does not delete your account or the wallet cached on your device. Signed-in users can permanently delete their account from You → Delete account. This removes the Clerk identity, synced cards, owned household, and live sharing access, plus the current wallet cache and its photos on that device. Previously exported copies and caches on other devices may remain. A hashed deletion marker temporarily prevents old sessions restoring an account; completed markers are removed after 24 hours when the service next receives an authenticated request. If identity-provider deletion fails, the account is blocked until deletion is retried. You can also request deletion, access, or correction by emailing trqnwr@gmail.com from your account email; we will verify ownership. Service providers may retain backups or technical records under their own retention policies, and information may be retained where required by law or needed to resolve a security issue.

Security and children

Cardallet uses encrypted network connections, account-scoped access, and device secure storage for PINs and session credentials. No system can guarantee complete security. Cardallet is not intended for children under 13. Contact us if you believe a child has provided account information.

Changes and contact

We will update this page and its effective date when our practices change. For privacy or data requests, contact trqnwr@gmail.com.