Privacy Policy

Last updated: September 18, 2026

This Privacy Policy explains what information Cardly (“Cardly,” “we,” “us”) collects when you use cardly.fun(the “Service”), how we use it, and the choices you have. By using Cardly, you agree to the practices described here.

Information We Collect

We collect the minimum we need to run the Service:

Account information. Your email address, used to sign you in with a one-time code and to send you your receipt and (if you opt in) a daily reminder email.
Photos you upload. When you generate a message, the photo is sent to our AI provider for processing and used only to write your message. We do not store your photos on our servers, and we do not keep a history of the messages you generate.
Payment information. Subscriptions are processed by Stripe. Cardly never receives or stores your full card number — Stripe handles that in a PCI-compliant environment. We keep a record of your subscription status (active, cancelled) and Stripe customer ID so we can manage your billing.
Basic usage data.A single session cookie that keeps you signed in. See “Cookies” below.

How We Use Information

To create and maintain your account and subscription
To generate the personalized message and card you request
To send sign-in codes, receipts, and (if enabled) daily reminder emails
To provide customer support
To keep the Service secure and prevent abuse

We do not sell your personal information, and we do not use it for advertising.

Third-Party Service Providers

We rely on a small number of trusted providers to run Cardly. Each only receives the data it needs to do its job:

Supabase — account authentication and database hosting
Stripe — subscription billing and payment processing
Google (Gemini API) — processes your uploaded photo to generate the message text
Brevo — delivers transactional and, if you opt in, daily reminder emails
Vercel — hosts the website and application

Cookies

Cardly uses a single strictly-necessary cookie to keep you signed in between visits. We do not use tracking, analytics, or advertising cookies, so there is nothing to opt in or out of — the sign-in cookie is required for the Service to work and is cleared when you sign out.

Data Retention

We keep your account information for as long as your account is active. Uploaded photos are processed in real time and are not retained after your message is generated. If you'd like your account and associated data deleted, email us at privacy@cardly.fun and we will delete it within 30 days.

Your Choices

Turn off daily reminder emails anytime from your profile page
Manage or cancel your subscription anytime via the billing portal in your profile
Request access to, correction of, or deletion of your data by contacting us

Children's Privacy

Cardly is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will remove it.

Data Security

We use industry-standard safeguards — encrypted connections, access-controlled databases, and reputable third-party providers — to protect your information. No method of transmission or storage is 100% secure, but we work to protect your data appropriately.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll update the date at the top of this page. Continued use of Cardly after a change means you accept the updated policy.

Contact Us

Questions about this policy or your data? Email privacy@cardly.fun.