CARDED Privacy Policy
Last updated: 2026-11-06
CARDED ("we") is a card you earn by going out with real people in real places. This policy says what we collect, why, who sees it, how long we keep it, and what you can do about it. CARDED is for adults only: you must be 18 or older to use it.
The short version
- We know your phone number, your handle, the photo you pick for your card, and the people and nights you add in person.
- By default we only know the venue of a night, never your exact location. Exact location is off unless you turn it on for one night, and then it is deleted after 24 hours.
- DMs disappear after 24 hours.
- We never sell your location or your social data, and we don't show ads.
- You can download everything we hold about you, or delete your account, from Settings.
1. What we collect
| What | Where it comes from | Why |
|---|---|---|
| Phone number | You, at sign-in | To sign you in with a one-time text code, and to keep one account per person. Text codes are sent by our SMS provider (Twilio, via Supabase Auth). |
| Handle and display name | You | So people you pull can find your card. |
| Age confirmation | You confirm you're 18+ at sign-up | CARDED is for adults. We store that you confirmed it, not your birth date. |
| Your card photo | A photo you choose or take | To put you on your card. See section 2. |
| Interests | You pick a few at sign-up | Shown on your card. |
| Pulls | You and another person confirm in person (both scan) | Your connections ("pulls") and crews. There are no remote adds. |
| Nights and lobbies | Nights you host, join or tap into at the door | Your history, your rank and aura. A night records its venue or area, not your position. |
| Exact location (optional, off by default) | Only if you turn it on for one night | Shown only to you; deleted automatically after 24 hours. The venue stays in your history. (Not yet offered in the app; this is how it will work when it is.) |
| Messages (DMs) | You and the people you message | Delivered to the other person; deleted automatically 24 hours after sending. If someone reports a message, a copy of that one message is kept for our safety team's review. |
| Reports and blocks | You | Safety. Reports are reviewed by our team. |
| Payment handles (optional) | Hosts who add a Venmo or Cash App handle | Shown only to people in that host's nights with a cover charge. We never handle the payment. |
| Instagram handle (optional) | You | Shown to people you've pulled. |
| School email (optional) | You, to verify a school crest | We send a code to prove the address is yours, and keep the verified address on your account. |
| Purchases | Apple, Google | Which cosmetic items you own. Payments are handled entirely by Apple, Google; we never see or store card numbers. |
| App events | The app | A few events (screen views, pulls, night seals, rank-ups, crashes, shares), linked to your account, to understand what works and to fix crashes. No third-party analytics or advertising SDKs. |
| Device information for crash fixing | The app | The graphics chip, frame rate and error messages, kept on your phone in Diagnostics until you choose to share them with us. |
We do not collect: your contacts, your precise location in the background, your birth date, government ID images or ID numbers, or any advertising identifier.
2. Your photo
- Your photo is stored privately and is visible only to people allowed to see your card (people you've pulled, and people in the same nights).
- To cut you out of the background, your phone first tries to do it on the device (Apple Vision, Google ML Kit, or MediaPipe in a browser). If it can't, the photo is sent to our cutout service, processed in memory, and not kept there.
- We never use your photo to identify you or anyone else. There is no face recognition, and photos are not used to train models.
3. At the door
Hosts and their door staff check people in with a rotating QR code. CARDED never stores images of IDs or ID numbers. If a host checks ID, they do it by looking at it, outside the app.
4. Who sees what
- Other users: your handle, card, rank and aura are seen by people you've pulled and people in the same nights. Strangers can't browse you.
- Hosts: see who joined their night.
- Our service providers process data only to run CARDED: Supabase (database, storage and sign-in), Twilio (sign-in texts), Apple and Google (purchases), our photo cutout service (photo cutout, nothing kept).
- Legal: we may disclose information if the law requires it, or to protect someone's safety.
We never sell your personal information. We never sell or share your location or your social data (pulls, crews, nights, messages). We don't do targeted advertising.
5. How long we keep it
- Exact location: 24 hours.
- DMs: 24 hours after sending (except a reported message, kept until the report is resolved, then 90 days).
- Pull codes: 90 seconds.
- Everything else: until you delete your account, or until we no longer need it to run CARDED.
- When you delete your account, your data is deleted right away from the live database. Backups age out within 30 days.
6. Your choices and rights
- Download your data: Settings → Privacy → Download my data. You get one file with everything we hold about you.
- Delete your account: Settings → Account → Delete account. This deletes your card, photo, cutout, pulls, DMs, memberships and items, and signs you out. Nights you hosted stay for the people who were there, with no host on them. Reports you filed stay with our safety team, without your name.
- Location: off by default, on for one night at a time only, off any time.
- Depending on where you live (for example California, the EU or the UK), you may have more rights, such as correcting your data or objecting to processing. Email us and we'll help.
7. Adults only
CARDED is for people 18 and older. If we learn that someone under 18 has an account, we delete it.
8. Security
Data is encrypted in transit. Access is limited by row-level rules in the database: each person can only read what they're allowed to see. No system is perfectly secure; if something goes wrong, we'll tell you as the law requires.
9. Changes
If we change this policy in a way that matters, we'll tell you in the app before it takes effect.
10. Contact
CARDED LLC, Colorado. Email: troy@carded.live
11. The website (carded.live)
- Waitlist: if you join, we keep your email, the city you typed, which link or sticker brought you (for example
?s=card), who referred you if you came from a friend's link, and a one-way hash of your IP address (to stop spam sign-ups). We use it only to tell you when CARDED launches and when your city unlocks. To be removed, email troy@carded.live. - Visits: we count visits per link or sticker per day: just a number, nothing about you.
- Make your card: the selfie you add stays in your browser. It is never uploaded.
- No cookies, no ads, no third-party trackers. Fonts load from Google Fonts.