Privacy Policy

Who we are

Cardo is developed and operated by Tomáš Vohradník, an individual based in the Czech Republic. Contact: info@tomasvohradnik.cz.

In short

Cardo uses an account (e-mail and password). Your cards are stored on your device and backed up to your account on the developer's server in the Czech Republic, so they move to your next phone. No ads, no analytics, no selling or sharing of data.

Account and server

• E-mail — to sign in and to send a password-reset link. No other e-mails.
• Password — stored only as a one-way hash (bcrypt), never in readable form.
• Cards (name, number, colour, usage and places where you used them) — for backup and sync.
• The server runs on a VPS by WEDOS Internet, a.s. in the Czech Republic (processor), over HTTPS, with ordinary technical logs (IP address, request time) for operation and abuse protection.
• Legal basis: performance of a contract (providing the service you ask for). Data is kept until you delete the account; database backups are removed after 60 days.
• You have the right to access, rectify, erase and port your data (card export in the app) and to complain to the Czech data protection authority (uoou.gov.cz).

Data the app processes

• Loyalty cards — on your device and in your account (see above).
• Camera — used only to read a barcode/QR code in real time. No images are stored or transmitted.
• Photos — only when you pick a photo of a card so the app can read its code. The photo is not stored or transmitted.
• Location (while using the app; in the background only if you turn on "quiet shop notices") — to recognise the shop you are in and open its card. Matching happens on the device against a list of store locations bundled with the app and places where you used a card before (stored on the device and, with the card, in your account). Only if nothing matches on the device, approximate coordinates are sent anonymously (without any identifier) to the public OpenStreetMap Overpass API to look up nearby shops. You can turn this off at any time in the app or system settings.
• Quiet shop notices (only if you turn them on) — the phone itself (the iOS region monitoring service) watches the area around the shops you have cards for, and Cardo offers the card in a quiet notification when you are in one. Your location does not leave the phone.
• Notifications — when someone sends you a card, the server notifies you through the Apple Push Notification service. For this, your device's notification identifier is stored with your account; it is removed when you sign out.
• Sign in with Apple (if you use it) — Apple gives us your Apple account identifier and e-mail (or Apple's private relay address). When you delete your account, we revoke this link with Apple.
• Confirmation code — to confirm your e-mail we send a six-digit code; only its hash is stored and it expires after 30 minutes.

Error reports

When the app hits an error or crashes, it sends our server the error description, where in the code it happened, the app version and the system version. Reports contain none of your cards, location, device name or account details and are not linked to your account; the server also removes anything that could point to a person (e-mails, long numbers, identifiers). We process them on the basis of legitimate interest (fixing errors so the app works) and delete them after 6 months.

Backups

The app keeps a daily backup of your cards in its own storage on the device, which is included in your regular device backup (iCloud / Google) if enabled — managed by Apple or Google under your settings. Manual exports are files you control: they stay wherever you save or send them.

Third parties

We do not sell or share data, except with the hosting provider (WEDOS) as a processor, Apple (delivering notifications and Sign in with Apple, if you use it) and the anonymous nearby-shop query to OpenStreetMap described above (OSMF privacy policy).

Deleting data

Delete a card in the app (card detail → ⋯ → Delete). Delete the whole account with all cards in the app: Settings → Delete account. Without the app, you can ask for deletion by e-mail — see Account deletion.

Children

The app is not directed to children under 13 and does not knowingly collect their data.

Changes

If this policy changes, the updated version will be published on this page with a new effective date.