What we collect, and what we don't.

mcard is a digital business card platform. We store the contact details you put on your card, the photos you upload, the leads people send you through the form, and basic billing information if you subscribe. We use Google Analytics to understand how people use the site, including public card pages, and it sets cookies. We don't use advertising cookies, we don't sell your data or your visitors' data, and we don't buy data about your visitors from brokers.

When you sign up:

• Your email address (used to log you in and send you account-related notices).
• Your name and avatar, if you set them in Settings → Profile.

When you use the app:

• The card data you enter (name, title, company, bio, phone numbers, email addresses, links, address, photos).
• Sections you add to your public page (about, links, gallery images, video URLs, testimonials, lead form configuration, and so on).
• Any contacts you save to your library, by keeping someone else's public card or through an exchange.
• Notes, folders, tags, and follow-up reminders you attach to those saved contacts.

When someone visits your public card page, mcard itself records:

• A view event with the visitor's country (from the country header our network provider, Cloudflare, adds) and, if the link they used carries a ?track= tag, that tag.
• If they click a link, share the card, or play a video, an event row with the kind of action and the target (e.g. action:call, link:0, cta).
• If they submit your lead form, the contact details they typed.

Visitors are also counted by Google Analytics and Cloudflare Web Analytics — see Analytics below.

If you subscribe:

• Stripe collects and stores your payment information directly. We never see card numbers; we receive a Stripe customer ID and your subscription status.

• We don't use advertising cookies or ad-network tracking pixels.
• We don't sell, rent, or share your data or your visitors' data with data brokers.
• We don't buy “identity resolution” or “intent” data to enrich your visitors. The leads you see are the leads people actively submitted.
• We don't store IP addresses, user-agent strings, or device fingerprints with your card's analytics or your leads. Like any website, the servers and the Cloudflare network that deliver mcard handle IP addresses to serve pages and block abuse, and our anti-spam rate limits count requests per IP address in short-lived counters that are deleted automatically, usually within a day.

• To run the service. Render your card, deliver leads, send the email notification when someone fills your form, send the weekly digest if you have one, and read a paper card if you upload a photo of one.
• To bill you, if you subscribe.
• To answer support questions when you write to us.
• To understand and improve the site, through the analytics described above.

AI features. Card scanning and the optional writing help (polishing a bio or headline, drafting a card from a résumé you paste, and drafting a follow-up email to a lead) send what you ask about to Anthropic's Claude API: the photo for a scan, the text you wrote, or — for a follow-up draft — the lead's name, company, and message plus your name. Each happens only when you use the feature. Under Anthropic's commercial terms, data sent through its API isn't used to train its models; Anthropic may keep it for a limited time for safety and abuse monitoring. If Anthropic isn't available, a card photo may instead be read by Google Cloud Vision. We don't use your card data or your leads to train any model ourselves.

• Our own servers, in the United States, run the app itself.
• Cloudflare sits in front of them: every request passes through its network for security, caching, and delivery, and it provides the cookieless analytics above.
• Supabase hosts our database, file storage (your photos), and sign-in.
• Stripe handles subscription payments.
• Resend sends our emails (lead alerts, receipts, sign-in links).
• Anthropic (Claude) reads card photos and powers the AI writing help; Google Cloud Vision is only a fallback for card photos.
• Google provides Google Analytics, and creates a Google Wallet pass (with your card's name, title, company, phone, email, and link) when you choose to add one.

All data flows happen over HTTPS. Each of those vendors has their own privacy policy and security posture; we recommend reviewing them if you have specific compliance requirements.

• Sign-in: Supabase auth session cookies keep you logged in. These are essential.
• Analytics: Google Analytics cookies (_ga, _ga_…), as described above.
• No advertising cookies.

We also use your browser's localStorage for small interface preferences: on public card pages, to stop the floating “Save card” prompt reappearing for 30 days after you've used or dismissed it; in the app, to remember that you've dismissed tips and the install prompt. None of it leaves your browser.

When you publish a card, anyone who has the URL can view it. The URL contains an 8-character random suffix to resist enumeration, but it's not a secret in the cryptographic sense. If you don't want your card to be reachable, unpublish it from the editor. The kiosk view at /k/<id> is also public to anyone with the link. Visitors to your card are counted by the analytics described above.

A card on the free plan is served with a noindex directive and left out of our sitemap, so search engines are asked not to list it. A published card on a paid plan may be indexed by search engines, the same way they would index any other public web page. If you want a paid card kept out of search results, contact us and we'll add a noindex directive.

Leads submitted to your card stay between you and the visitor. We never share them with anyone else, apart from the processors listed above that store and deliver them (and Anthropic, only if you ask for an AI follow-up draft). If you connect an outbound webhook in Settings, we'll POST the lead to the URL you chose — that's a transfer you've initiated, not one we've made on your behalf.

You can, at any time:

• Export everything we have on you — visit Settings → Profile and click “Export all data”. You'll get a JSON file with your profile, all your cards, sections, library, leads, and folders.
• Delete your account — also in Settings. This removes your profile, cards, sections, leads, library, and folders. Stripe customer records are kept for the legally required retention period (typically 7 years for tax purposes) even after account deletion.
• Correct anything — by editing your card, profile, or library entries directly.
• Withdraw consent — by deleting your account and stopping use of the service.
• Opt out of Google Analytics — see Analytics.

If you're in California, the EEA, or the UK, you have additional statutory rights (GDPR Articles 15–22, CCPA/CPRA §1798.100 et seq.). The export and delete tools cover the substance of those rights. Email us if you need a written response: [email protected].

• While your account is active, we keep your data so the service works.
• If you delete your account, your records are removed within 30 days from active systems and within 90 days from backups.
• View and event rows belong to the card they were recorded on and are deleted with that card or your account.
• Exchange codes that expire unused are deleted daily. A completed exchange lives on as a saved card in each person's library.
• Anti-spam rate-limit counters are deleted automatically, usually within a day.
• Google keeps Google Analytics data according to the retention setting on our Analytics account and its own policies.

mcard isn't designed for children. You must be at least 16 years old (or 13 with parental consent in jurisdictions that allow it) to create an account. If we learn we've collected data from a child under those thresholds, we'll delete it.

Data is encrypted in transit (TLS), and our database and file storage provider encrypts it at rest. Access to production systems is limited to the people who need it. We don't guarantee that no breach can ever happen — no online service can — but we'll notify you promptly if a breach affects your data.

If we make material changes, we'll bump the “Last updated” date and, for changes that affect how we use data, email logged-in users at least 14 days before they take effect.

Questions, requests, or complaints: [email protected].