Privacy Policy

Effective date: 12 November 2026

This policy explains what information the CardGo iOS app (“CardGo”, “the app”, “we”, “us”) uses, why, where it is stored, and the choices and rights you have. We have tried to keep it short and plain.

At a glance

You can use the map, search, saved shops, visit stamps and achievements without an account. That data stays on your device.
Your location is used on your device to show nearby shops, give directions and (only if you turn it on) send nearby alerts. We do not track your location on our servers, and we never sell or share it.
An account is optional. If you create one, we store what is needed to run it: your email, name (if provided), followed shops, messages, and shop claims or suggestions.
No ads, no third-party analytics, no tracking, no data sales.
You can delete your account at any time in the app: Account → Settings → Delete account.

1. Who we are

CardGo is operated by [OPERATOR NAME], [ADDRESS]. The operator is the “controller” (under GDPR / UK GDPR) and the “business handling personal information” (under Japan’s Act on the Protection of Personal Information, APPI) for the personal data described here.

Contact: [email protected]

2. Using CardGo without an account

You do not need an account to use the map, search for shops, get directions, save shops, collect visit stamps, or earn achievements and XP. This information is stored only on your device (in the app’s local database) and is not sent to our servers. It stays on your device until you delete the app.

To show the map, the app downloads shop information (names, addresses, opening hours and similar public business details). Downloading shop data does not require or send any personal information about you.

3. If you create an account

An account is optional. It is needed to follow shops, receive shop promotions, send messages, claim a shop as its owner, and send shop suggestions. You can sign in with Sign in with Apple, Google, or an email one-time code.

When you have an account, we store the following on our backend (hosted by Supabase, see section 10):

Data	Why
User ID (a random identifier)	To identify your account.
Email address	To sign you in (including sending one-time codes) and to contact you about your account. If you use Sign in with Apple with “Hide My Email”, we receive an Apple relay address instead.
Display name	Shown in conversations. Taken from Apple or Google if you choose to share it; you can change it.
Profile role (customer or shop owner)	To give shop owners access to owner features.
Notification preferences	To respect your choices about which notifications you receive.
Followed shops	To show you promotions and announcements from shops you follow.
Messages	To deliver your conversations with shops (see section 7).
Shop claims	To verify that you own or manage a shop (see section 8).
Shop suggestions and problem reports	To keep shop information accurate (see section 9).
Reports about messages or users	To keep the community safe.
Device push token (with app version and language)	Only if you allow push notifications, to deliver them to your device.
Date and time you accepted the Terms	To record your agreement to the Terms of Use.

Saved shops, visit stamps and achievements remain on your device even when you are signed in.

4. Location

CardGo asks for permission to use your device’s precise location. You can allow it, allow it only while using the app, or deny it. The app still works without location — you can browse the map and search manually.

Location is used on your device to:

show shops near you and your position on the map;
provide turn-by-turn directions (using Apple Maps / MapKit);
only if you turn on “Nearby alerts”: monitor in the background when you are near a shop (geofencing), so the app can notify you and automatically stamp your visit. This requires “Always” location permission, which you choose in iOS.

Your location is not sent to CardGo’s servers for any of these features, and it is never sold or shared. The one exception is described in section 9: when you send a shop suggestion or problem report, the app may attach your location at that moment.

Apple services that power maps, directions and weather process location as described in section 10.

To turn location off: iOS Settings → CardGo → Location. To stop background alerts only, turn off Account → Settings → Nearby alerts in the app.

5. Notifications

Notifications are only sent if you allow them in iOS.

Local notifications are created on your device — for example, when you are near a shop or a visit has been stamped (with Nearby alerts on). They do not involve our servers.
Push notifications are sent through Apple Push Notification service for promotions and announcements from shops you follow, and for new messages. To deliver them we store a device push token linked to your account.

To turn notifications off: iOS Settings → CardGo → Notifications. Unfollowing a shop also stops its promotions.

6. Photos

If you choose a profile photo, you pick it with the iOS system photo picker, which gives the app access only to the photo you select. Without an account the photo is stored on your device only.

If you are signed in with a collector account, the photo is also saved to your profile on our servers so that shops you message can see it next to your name. The image file is publicly reachable by anyone who has its address. You can replace or remove it at any time in Account → tap your photo; removing it deletes the file from our servers. Our moderators can take a photo down if it breaks the community rules.

Shop teams can add photos to their posts and to their shop page. These photos are public: everyone who opens the shop or follows it sees them. A shop can remove its photos at any time, and our moderators can take them down if they break the community rules.

If you add photos to a review (see section 7), they are public for as long as the review is: anyone who opens the shop’s reviews sees them. The app re-encodes every photo before uploading, which removes the location and camera details stored inside the original file.

7. Messaging, reviews, reports and blocking

Signed-in users can message shops whose owners have joined CardGo. Messages are stored on our backend and are visible to the participants of the conversation. Authorised operator staff may access messages only when needed to investigate a report, enforce our Community Guidelines, or meet a legal obligation.

An automated filter checks messages for certain objectionable words and may block them before they are sent. You can report a message or user and block a user from within the app. When you report something, we receive the report, the reported content and the identities of the accounts involved so we can review it.

Reviews. Signed-in collectors can rate a shop (1–5 stars) and write a review, with up to four photos. A review is public: it is shown on the shop’s page with your display name and profile photo, and the shop’s team can post a public reply. You can edit or delete your review at any time; deleting it also deletes its photos. Reviews go through the same word filter, and can be reported and removed, like messages.

8. Shop owners and shop claims

If you claim a shop, we ask for your name and role, an email address you can read (any provider; we send it a one-time code), and a business document such as a registration certificate, licence or invoice. Documents are stored in a private storage area that only you and our review team can access, are used only for verification, and are deleted with your account. Photos are re-encoded before upload, which removes location metadata.

A shop owner can invite other people to help run the shop by entering their email address. We store that address with the invitation and send it one email about the invite. If the invited person accepts, their name and role are shown to the rest of that shop’s team; their email address is shown to the shop’s owners only. Owners can cancel an invitation or remove a team member at any time, and a member can leave a shop themselves.

Shop teams can take photos with the camera or choose them from the photo library for their posts and shop page. The app only uses the camera while you are taking such a photo or scanning a business document.

Once verified, the shop information, promotions and announcements you publish are public in the app. Please don’t include personal information about yourself or others in public shop content unless you intend it to be public.

Event organizers and events

If you apply to list events as an organizer, we ask for the organizer or event name, the website or social page where you announce events, a contact email and a short description. We use this only to review the application and to contact you about it. Events published by shops and approved organizers (title, description, dates, venue and games) are public in the app and on the map.

Featured placement. A shop’s owner or manager can buy a period of featured placement through Apple’s In-App Purchase. Apple processes the payment; we never receive your card or billing details. Apple gives us a signed receipt for the purchase (product, date, transaction number), which our server checks and stores together with the shop it is for and the account that bought it, so the placement can be shown and support questions answered. The shop’s team can see the shop’s purchases; nobody else can.

9. Shop suggestions and problem reports

You can suggest a new shop or report a problem with an existing one (for example, wrong hours or a closed shop). We receive what you type (such as the shop name, address, games and notes), linked to your account. Suggestions may be held on your device until they can be sent.

If location access is on, the app may attach your device’s location at the moment you send the suggestion or report, to help us find and verify the shop. This is used only to review that submission.

10. Service providers and third-party services

Supabase hosts our database and authentication. It acts as our data processor and stores account data on our behalf.
Apple Maps / MapKit provides the map, search of addresses (geocoding), directions and Look Around imagery. Requests for these features are sent to Apple.
Apple Weather (WeatherKit) provides weather shown on the map. To get weather, the app sends Apple approximate coordinates, rounded to about 2 km. You can turn weather off in Account → Settings → Live sky & weather.
Sign in with Apple and Google Sign-In are used only if you choose them. They share your account identifier, and your name and email if you allow it.
Apple Push Notification service delivers push notifications if you allow them.
Apple diagnostics: if you have chosen in iOS to share analytics with app developers, Apple may provide us with crash reports and diagnostic data. This is controlled by you in iOS Settings → Privacy & Security → Analytics & Improvements.

Apple’s and Google’s handling of data is governed by their own policies: Apple Privacy Policy and Google Privacy Policy.

11. What we do not do

We do not include advertising SDKs or third-party analytics.
We do not track you across other companies’ apps or websites, and the app does not ask for App Tracking Transparency permission.
We do not sell your personal information or “share” it for cross-context behavioural advertising.
We do not upload your saved shops or visit stamps. A profile photo is uploaded only if you are signed in (see section 6).

12. How we use information and legal bases

We use personal information only to provide and protect CardGo. Where GDPR or UK GDPR applies, our legal bases are:

Performance of a contract — running your account, delivering messages, following shops, and handling shop claims.
Consent — location access, Nearby alerts and notifications. You can withdraw consent at any time in iOS Settings or in the app.
Legitimate interests — keeping shop data accurate, preventing abuse, reviewing reports and keeping the service secure.
Legal obligation — where we must keep or disclose information by law.

We share personal information only:

with the people you communicate with (for example, a shop sees the messages and display name you send it);
with service providers listed in section 10, to run the service;
when required by law, or to protect the safety, rights or property of users, the public or CardGo;
as part of a merger, acquisition or transfer of the service, in which case this policy will continue to apply to your data.

14. How long we keep data

Account data is kept while your account exists, and deleted when you delete your account (see section 15).
Reports about messages or users are kept for up to 1 year for safety purposes.
Backups roll off within 30 days, so deleted data disappears from backups within that time.
On-device data stays on your device until you delete the app.

15. Deleting your account

You can delete your account in the app at Account → Settings → Delete account. When you do:

your account, profile, profile photo, followed shops and push tokens are deleted from our servers;
reviews you wrote, with their photos, are deleted;
messages you sent are anonymised: they remain visible to the other participant, shown as from a “deleted user”, without your identity;
shop claims and suggestions you submitted are unlinked from you;
if you used Sign in with Apple, we revoke the app’s Apple sign-in token;
data stored on your device (saved shops, stamps, achievements, the copy of your profile photo) stays on your device until you delete the app.

If you cannot access the app, email [email protected] from the address linked to your account.

16. Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy (portability) of your personal information, and to object to or restrict certain processing. To make a request, email [email protected]. We may need to verify your identity, for example by asking you to write from the email address linked to your account. We will not treat you differently for exercising your rights.

EEA, UK and Switzerland (GDPR / UK GDPR)

You have the rights listed above, the right to withdraw consent at any time, and the right to lodge a complaint with your local data protection authority. We respond within one month.

California (CCPA / CPRA)

In the past 12 months we have collected the categories of personal information described in this policy: identifiers (user ID, email, push token), communications content (messages, reports, suggestions), and, for features you use, precise location (processed on your device, and attached to suggestions as described in section 9). We use them only for the purposes described above. You have the right to know, access, delete and correct your information. We do not sell or share personal information and do not use sensitive personal information for purposes that would give rise to a right to limit. You may use an authorised agent to submit a request.

Japan (APPI)

You may request disclosure, correction, addition or deletion, suspension of use, or suspension of third-party provision of your retained personal data, and disclosure of records of third-party provision, by contacting us. Personal data is handled under appropriate security control measures, including access restrictions and encrypted transmission. Information about overseas transfers is in section 17.

17. International transfers

Our servers and service providers may be located outside your country, including in [SERVER REGION]. When personal data is transferred across borders, we rely on appropriate safeguards required by applicable law (such as Standard Contractual Clauses for transfers from the EEA/UK, and the measures required under APPI for transfers from Japan). Data protection laws in the destination country may differ from those in your country. Contact us for more information about the safeguards we use.

18. Security

Data is sent over encrypted connections, and access to account data on our backend is restricted so that users can only read their own data and the conversations they take part in. No system is perfectly secure, but we work to protect your information and will notify you and authorities of a data breach where required by law.

19. Children

CardGo is not intended for children under 13, or under the minimum age required in your country to use online services without parental consent. We do not knowingly collect personal information from them. If you believe a child has created an account, contact us and we will delete it.

20. Changes to this policy

We may update this policy as the app changes. We will update the effective date above and, for significant changes, notify you in the app.

21. Contact us

CardGo (operator: [OPERATOR NAME])
[ADDRESS]
Email: [email protected]