Privacy Policy

Card content. The photos you upload and the text you add — names, teams, dates, stats, and the message on the back. This is the product, so we store it to render, print, and ship your card, and to show it again if you return to a saved design.

Order and shipping details. When you buy, Stripe collects your email, billing address, and a US shipping address on our behalf, and we store the resulting order record (order number, amount, currency, what was ordered, and where to send it).

Payment details. Handled entirely by Stripe. Card numbers never reach Cardbop's servers.

Account details. If you create an account, we store your email address and authentication data through Supabase. Passwords are handled by Supabase and are not visible to us.

Usage data. Standard analytics — pages viewed, approximate location derived from IP, device and browser type, and a small number of events such as clicking a call-to-action, starting a card, beginning checkout, and completing a purchase. See Analytics and cookies.

Messages you send us. If you contact us, we keep your message and email address so we can reply.

To design, print, and deliver your order; to show you your saved cards; to process payment and handle refunds or reprints; to send order and shipping email about a purchase you made; to answer your questions; to detect abuse and prevent fraud; and to understand which parts of the site are useful so we can improve them.

We do not use your photos or card content to train machine-learning models, and we don't use them in marketing without asking you first.

We don't sell your personal information. We share it only with service providers who help us run Cardbop:

• Stripe — payment processing, billing and shipping collection, tax calculation.
• Supabase — database, file storage for photos and card art, and account authentication.
• Vercel — website hosting and delivery.
• Google Analytics — website usage measurement (not loaded for EEA, UK, and Switzerland visitors).
• Cloudflare Turnstile — abuse and bot protection on forms.
• Our print and fulfillment partner — receives the card artwork and the shipping address needed to produce and mail your order.
• Email delivery — we use an automation service to send order-related email.

We may also disclose information if the law requires it, or to protect our rights, safety, or property.

We use Google Analytics 4 to measure how the site is used — which pages people find, which ones lead to someone making a card, and how many orders result. Google Analytics sets cookies and processes information such as your IP address, device, and the pages you view. Google may use this data in accordance with its own policies.

We do not load Google Analytics for visitors in the European Economic Area, the United Kingdom, or Switzerland. Because we don't collect analytics data from those regions at all, we don't ask for consent or show a cookie banner there.

We also use a small number of strictly necessary cookies that make the site work: keeping you signed in, remembering your cart and card drafts, and recording whether analytics should load. These aren't used to track you across other websites.

You can block cookies in your browser, and you can opt out of Google Analytics with Google's browser opt-out add-on. Blocking cookies may stop drafts and sign-in from working.

Photos you upload are stored so your card can be rendered, printed, and re-opened later. The “isolate the subject” background-removal tool runs entirely on your own device — that photo is not uploaded anywhere for processing.

You should only upload photos you own or have permission to use, particularly photos of other people's children. If you believe someone has uploaded a photo of you without permission, contact us and we'll remove it.

When you share a card or a pack, we create a link containing a long random token. Anyone who has that link can view the card — it isn't protected by a password. These pages are excluded from search engines, but treat the link itself as the key and only send it to people you want to see the card. Contact us if you need a link disabled.

We keep order records for as long as we need them for accounting, tax, and support — typically several years. Card designs and photos are kept while your account or draft is active so you can reorder or reprint. Analytics data is retained on Google's standard schedule. If you ask us to delete your account, we'll remove your designs and photos and keep only the order records we're required to retain.

You can ask us to access, correct, or delete your personal information, or to send you a copy. Depending on where you live — for example under the CCPA/CPRA in California — you may have additional rights, including the right not to be discriminated against for exercising them. We don't sell or share personal information for cross-context behavioral advertising.

To make a request, email us at contact@cardbop.com or use the contact page. We may need to verify your identity first.

Cardbop is intended for adults. Many cards are of children — a parent or guardian making a card of their kid — but accounts and purchases are for adults, and we don't knowingly collect personal information directly from children under 13. If you believe a child has given us information, contact us and we'll delete it.

We use reputable providers, encrypted connections, and access controls to protect your information. No method of storage or transmission is completely secure, so we can't guarantee absolute security.

If we make meaningful changes, we'll update the date at the top of this page. Continuing to use Cardbop after a change means you accept the updated policy.

Questions about privacy? Email contact@cardbop.com or use the contact page.