Privacy Policy
CardMaps ("CardMaps," "we," "us") operates the CardMaps mobile application and website (the "Service"), which helps people in the collectible card community discover card shops, shows, and vendors. This Privacy Policy explains what information we collect, how we use it, and the choices you have.
Information we collect
- Account information. When you create an account, we collect your email or username, a securely hashed password, and an optional display name. If you sign in with Apple or Google, we receive a verified identifier and, where you permit it, your email and name. You can connect both to one account.
- Profile and business information. If you apply for or run a vendor or shop profile, we collect the details you provide — business name, location or home city, bio, specialties, contact details, and links.
- Billing information. Vendor subscriptions are processed by Stripe. When you start a trial or subscribe, you enter your payment details on Stripe’s secure checkout page; CardMaps never receives or stores your card number. We receive and keep your subscription status, plan, trial and renewal dates, and a Stripe customer reference so we can turn your vendor profile on or off.
- Location. With your permission, we use your device's approximate or precise location to show shops, shows, and vendors near you. You can browse without granting location access; the app will fall back to a default view.
- Interests. The categories you select during onboarding, to tailor discovery.
- Content you create. Posts, reviews, messages, status updates, submissions, favorites, and follows.
- Photos. When you choose to attach a photo to a post, set a vendor or shop profile image, or upload a show flyer, we store the image you select. We access your photo library only at the moment you pick a photo, never in the background.
- Usage and device data. Basic technical data needed to operate, troubleshoot, and secure the Service. The app keeps a short diagnostic log for each session — the screens you visit, failed requests and app errors, your device type and name, operating system version, and app version — linked to your account if you are signed in, and sends it to our own servers so we can find and fix problems. We also keep session identifiers and server-side error logs. We do not use third-party analytics, advertising, or crash-reporting SDKs, and we do not collect advertising identifiers. The app also sends a random device identifier that we generate (not an advertising identifier); we use it to keep the Service safe, for example to stop a banned account from returning on the same device.
- Calendar feed. If you add your shows to a calendar, we create a private link that lists the shows you’re going to or vending at. Anyone with the link can see that list, so keep it private; you can ask us to reset it.
- Problem reports. If you report a problem on our website, we collect the email, message, and optional device details you enter, and a one-way hash of your IP address to prevent spam.
How we use your information
- To provide core features — discovery, favorites, messaging, reviews, submissions, and pro profiles.
- To show relevant nearby results using your location and interests.
- To manage accounts and access to vendor and shop profile features.
- To keep the Service safe — moderation, fraud and abuse prevention, and enforcing our Terms.
- To run vendor subscriptions — trials, renewals, payment reminders, and turning vendor profiles on or off — and to send related emails.
- To communicate with you about your account, applications, and (with your consent) notifications.
How information is shared
We do not sell your personal information. We share information only as needed to run the Service:
- Publicly, by your choice. Vendor and shop profiles, reviews, and status updates you publish are visible to other users.
- Service providers. We use Cloudflare (hosting, database, storage, and email delivery), Stripe (vendor subscription payments, receipts, and sales tax; Stripe acts as the seller of record for vendor subscriptions), Apple (Sign in with Apple, on iOS), Google (Sign in with Google), and a map provider to deliver the Service — Google Maps on Android and Apple Maps on iOS.
- App stores. When a vendor subscription starts from the Android app’s in-app link, Google requires us to report the transaction (its amount and date, not your card details) to Google Play.
- Legal. Where required by law or to protect the rights, safety, and property of CardMaps and its users.
Data retention
We keep your information for as long as your account is active or as needed to provide the Service. When content or an account is removed, we soft-delete it and may retain limited records as required for security, legal, or operational reasons before permanent deletion.
Your choices and rights
- Access, correct, or delete your account information by contacting us.
- Turn location access on or off in your device settings.
- Delete your account at any time from the Profile tab in the app, or by emailing [email protected] from your account address.
- Control push notifications in your device settings.
Children
CardMaps is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will remove it.
Security
We use industry-standard measures to protect your information, including password hashing and encrypted connections. No method of transmission or storage is completely secure, but we work to protect your data.
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by notice in the app.
Contact us
Questions about this policy? Email [email protected].
This document is provided for the CardMaps Service. It is not legal advice; have qualified counsel review it before public launch.