Privacy Policy

Last updated 2026-10-01

Who we are

CardSkin (cardskin.app) is run by an independent developer, who is responsible for your personal information. Contact: support@cardskin.app

The editor

Photos and designs you use in the editor stay in your browser. Nothing leaves your device unless you choose Share to gallery.

What we collect

Account: your ID, email address, display name, and password. The password is stored only as a one-way hash that no one, including us, can turn back into your password.

Google or Apple sign-in: the name, email address, and profile photo they share with us. With Apple you can choose to hide your email.

What you post: card images, titles and tags, likes, and reports you send.

Technical: your IP address and browser type, kept with your login session and used to limit repeated login attempts.

How we use it

To create and run your account, confirm your email, help you find your ID or reset your password, show your cards in the gallery with your display name, review uploads and reports, keep the site secure, and answer your requests. We do not sell your information and do not use it for advertising or profiling.

Legal basis

We process your information to provide the service you signed up for (contract), to keep CardSkin safe and free of abuse (legitimate interests), and where the law requires it.

Who processes it

Cloudflare, Inc. (United States; global network, with our database and image storage in the Asia-Pacific region): hosting, database, and image storage.

Resend (United States company; sending servers in Tokyo, Japan): sending confirmation and password reset emails. It receives your email address and ID.

Google LLC (United States): only if you sign in with Google.

Apple Inc. (United States): our support inbox (iCloud Mail), and sign-in if you use Sign in with Apple.

These providers process data on our behalf under their own data protection terms. Your information may therefore be processed outside your country.

How long we keep it

We keep your account and cards until you delete them. When you delete a card, its images are deleted. When you delete your account on My page, your account, cards, images, likes, and login sessions are deleted right away.

Deleted data can remain in database backups for up to 30 days before it is removed automatically. Reports you sent are kept without your account attached, so we can handle disputes. Password reset and email confirmation links expire within 1 hour.

How we protect it

All traffic uses HTTPS. Passwords are hashed with PBKDF2. Only the operator can access the admin tools, and login and sign-up attempts are rate-limited.

Your rights

You can see and change your display name, delete cards, and delete your account on My page. You can also ask us to show, correct, or delete your information, to stop processing it, or for a copy of it, by emailing support@cardskin.app. We will reply within 30 days. You can also complain to the data protection authority where you live.

Cookies and browser storage

We use one essential cookie to keep you logged in. Your language, light or dark choice, and a card waiting to be shared are saved only in your browser. We do not use advertising or analytics cookies.

Children

CardSkin is not for children under 14, and they may not create an account.

Changes

If we change this policy, we will post the new version here with a new date. Significant changes will be announced on the site.