01 / INFORMATION
Information we collect
Depending on how you use CardsHere, we may collect and hold:
- Account and contact information, such as your name, email address, mobile number and account identifiers.
- Authentication and security information, including sign-in provider details, verified contact methods, session information, multi-factor authentication status and registered passkeys. CardsHere does not receive your Google or Facebook password, or the private key stored on your passkey device.
- Wallet and loyalty-card information, including retailer or brand, card name, membership or card number, barcode value and format, labels, categories, notes, colours and logos.
- Photos and imported files you choose to provide, such as card screenshots and front or back card photos.
- Sharing information, including invitations, shared-wallet membership, co-ownership, permissions and activity needed to operate those features.
- Communications and support information, including messages you send us and delivery records for essential emails and verification texts.
- Technical information, such as IP address, browser or device type, app version, request times, security events and diagnostic logs created when the service is used.
Please use CardsHere for loyalty, membership and similar cards—not payment-card security codes, account passwords, government identifiers, health records or other information you do not need at checkout.
02 / PURPOSE
How we use information
We use personal information to:
- create and secure your account, keep you signed in and verify your identity;
- store, display, scan, import, edit and organise your cards;
- operate shared wallets, co-ownership, invitations and the permissions you select;
- send requested verification codes, sign-in messages, invitation notices, security notices and service updates;
- provide support, troubleshoot failures and improve reliability and accessibility;
- detect misuse, protect accounts and investigate security incidents; and
- comply with applicable law and enforce our rights.
We do not currently use wallet contents to target advertising, and we do not sell personal information. If that practice ever changes, this policy and any required choices or notices will be updated before the change takes effect.
CardsHere uses your verified mobile number only for account security, two-factor verification and preventing duplicate CardsHere accounts. We do not use your email address or mobile number for marketing, sell or share them for advertising, or send promotional spam.
04 / PHOTOS
Card photos and scanning
When you select screenshots or card photos for import, CardsHere analyses them for a barcode and recognisable brand information. Initial barcode and text recognition is designed to run in your browser or app on your device. A selected image is only stored with your account when you choose to save it as part of a card.
Saved card photos are uploaded to protected Supabase storage. The app requests time-limited signed links when it needs to display them. People with access to the relevant shared or co-owned wallet may also be able to view those photos.
Automated scanning is used to suggest card details and reduce typing. It does not make decisions that significantly affect your legal rights or interests. You can review and correct recognised details before saving them.
05 / CARE
Storage, security and retention
CardsHere uses access controls, encrypted network connections, account authentication, database row-level protections and protected photo links. Optional multi-factor authentication and passkeys provide additional account security. No online service can guarantee absolute security, so protect your sign-in methods and tell us promptly if you suspect unauthorised access.
We keep information for as long as needed to operate your account, provide shared-wallet features, meet legal and security obligations, resolve disputes and maintain necessary records. Retention periods vary by data type. Backups and security logs may remain for a limited period after active information is deleted.
Deleting a card removes it from the active wallet, subject to backups and any copy another authorised wallet participant has legitimately retained. Account deletion requests may require us to verify your identity and deal appropriately with co-owned or shared content before deletion is completed.
You can start a deletion request through our dedicated data deletion page. Requests sent by Meta/Facebook are accepted through a signed, server-to-server callback and receive a confirmation code for tracking.
CardsHere uses essential browser storage and cookies to maintain secure sessions, remember necessary app state and protect restricted areas. We do not currently use third-party advertising cookies.
06 / CONTROL
Your choices and rights
You can:
- view and edit your cards, labels, notes, photos and sharing permissions in the app;
- decline optional photos, social sign-in, shared-wallet features or additional authentication methods;
- leave a Shared Wallet where the available role and ownership rules allow;
- ask for access to personal information we hold about you or ask us to correct it; and
- request account and personal-information deletion, subject to identity verification and lawful retention requirements.
Send access, correction or deletion requests to support@cardshere.com. Describe what you need and the account involved. We may ask for enough information to confirm that the request relates to you.
If you are under 16, use CardsHere with the involvement of a parent or guardian. A parent or guardian who believes a young person has provided personal information without appropriate involvement can contact us.
07 / CONTACT
Contact, complaints and changes
CardsHere is operated in Australia. For privacy questions, complaints or requests, email support@cardshere.com. We will acknowledge and investigate privacy complaints, may ask for further details, and will explain the outcome or available next steps.
If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner (OAIC).
We may update this policy when CardsHere, our providers or legal requirements change. The latest version will remain at this URL with its effective date. We will provide additional notice where a change materially affects how existing personal information is handled.
LOCATION
Optional location for timezone setup
CardsHere can ask for approximate foreground location to suggest an initial timezone. The coordinate-to-timezone lookup runs on your device. CardsHere does not save coordinates, send them to a timezone lookup service, or track your location in the background. Your operating system or browser controls the permission request and location service.
If permission is declined, location is unavailable, or detection times out, the initial choice is Australia/Brisbane. You can select another timezone. Existing saved and manual choices are preserved; only the selected timezone identifier is stored with your settings.
ANDROID
Your Android wallet and app updates
The current Android app stores saved cards in private app storage for offline use. With a verified EpicEncore Account, wallet cards and supported photos and metadata back up and sync to your account. Offline changes remain queued until confirmed online; concurrent changes can require review. Accepted co-owners can access the cards in their shared wallet and its server-confirmed monthly discounts. Unsigned-in device records and separate local ledgers are not automatically shared. Uninstalling the app or clearing its data can remove local records and unsent changes.
Sign-in credentials are handled by the native secure session layer. Optional camera and location access are controlled by your device. Monthly reminders require your choice and, where applicable, operating-system permission.
Codemagic provides signed Android app downloads. Update discovery does not require an account. Download requests can disclose normal network and device information to the hosting and distribution providers. The app checks the approved package, version, signing identity, size and file hash before offering installation through Android.
Terms of use
The terms now have their own page.
Read the terms →