Privacy Policy

Information we collect

When you create an account, we receive your email address, username, account identifiers, and authentication records. Features you use may add binder data, forum posts and votes, membership status, game high scores, and messages sent through the contact form.

Search Lab processes your search text to return results. For daily allowance enforcement, we store the date, count, and a one-way hash of each normalized query—not the query text itself. To improve Search Lab, we also store the search phrase, selected mode, result count, and timestamp in a separate analytics record that does not include your account ID or email. Standard hosting and security logs may include IP address, browser details, requested pages, and timestamps.

Payments and service providers

Stripe processes subscriptions and payment details. Cardelyx receives billing identifiers, subscription state, and limited transaction metadata, but not your full card number. We use Supabase for accounts and application data, Vercel for hosting, and email providers for account and service messages. Each provider processes data under its own terms and privacy commitments.

Website analytics and cookies

We use Vercel Web Analytics to understand aggregate visits and page popularity without placing analytics cookies. We also use Google Analytics 4 (Google LLC) to understand visits, pages viewed, and general visitor activity. When enabled, Google Analytics may use first-party cookies (including cookies beginning with _ga) and receive browser, device, usage, and approximate location information; Google may process that information on servers outside your country.

For visitors we identify as being in the United States, Google Analytics runs by default, unless they have chosen to decline it. For visitors outside the United States, we ask for permission before loading Google Analytics. Declining Google Analytics does not prevent you from using Cardelyx, and Vercel's cookie-free analytics remain active. We determine which choice to show using approximate IP-based country information from our hosting provider; if the location cannot be determined, we request consent before enabling Google Analytics.

You can change or withdraw your Google Analytics preference at any time using the Analytics settings link in the footer. Preferences are stored in your browser and may need to be set again if you clear browser storage or switch devices. Browser privacy controls or extensions may also block analytics.

How we use information

We use information to operate and secure Cardelyx, provide requested features, enforce usage limits, manage memberships, respond to support, prevent abuse, diagnose reliability problems, and improve the service. We do not sell personal information.

Storage, retention, and security

Guest binders, some preferences, and guest game scores stay in your browser. When you sign in, binder changes are cached on your device and synchronized to your Cardelyx account through Supabase so they can be available on other signed-in devices; offline edits remain on the device until synchronization succeeds. Account data is retained while your account is active and as reasonably needed for security, legal, billing, and operational purposes. No system is perfectly secure, but we limit access and use authentication, row-level database protections, and encrypted service connections.

Your choices

You can change your username, cancel a paid membership through the billing portal, clear browser storage, or ask us to access or delete account information. Some records may be retained where required for fraud prevention, billing, or law. Send requests through the contact page.

Children and international use

Cardelyx is not directed to children under 13, and we do not knowingly collect their personal information. If we learn that an account belongs to a child under 13, we will take reasonable steps to delete the personal information and close or restrict the account. A parent or guardian can contact us through the contact page. Data may be processed in the United States and other places where our providers operate.

Changes

We may update this policy as the service changes. Material revisions will be reflected by the effective date on this page. Questions can be sent through the contact page.