Privacy
Everything we store fits on this page.
Purpose-built tables behind this site keep each kind of record separate. This page says what goes into them, what stays only on your phone, and why each record exists.
This is a plain-language summary of how the site actually works. It is not legal advice and it is not a compliance certificate — see the section on rights and requests below.
Browsing stores nothing
Searching the index creates no D1 record of you. Your search text is sent to our server, which asks the Collector Crypt API and returns the results — it is not written to our database. If a search fails, the query text is written to our server error log so we can see what broke; that log entry carries no email, device id, or name.
Sign-in is handled by Privy, which may create an embedded Ethereum wallet for that account. Browsing and the practice drop work without sign-in; a live-card claim requires it. Signed-out avatar choices stay in this browser. Signed-in avatar choices and verified-account finds sync through D1. Other D1 records come from a drop claim, the postal address you give after winning one, a spot suggestion, a quote request, a community vote, or a proposed ballot location; notifications and rate-limit counters support those actions.
Your Privy account and avatar
| Stored | Why |
|---|---|
| Pseudonymous account digest | A SHA-256 digest derived from the Privy account id attaches your saved avatar and authenticated claims to the same account. D1 does not store the raw Privy id, email, or wallet in those fields. |
| Display name, handle, character, gear, move, and aura | To show the 3D adventurer you chose on the website and in the PWA after you sign in on another device. |
| Profile creation and update times | To operate and troubleshoot cross-device profile saving. |
Privy keeps the login session. Cards Go never writes your auth token, password, wallet key, or seed phrase to D1. You can remove the synced avatar from the reset control on the You page; a signed-out device draft remains separate from every account.
1. When you claim a drop
| Stored | Why |
|---|---|
| Claim id and drop id | The first eight characters of the claim id are your receipt. The drop id records which drop the claim belongs to. |
| Email address | For a live claim, this is the email Privy verified and it is used for the pickup receipt. The signed-out practice run uses the address typed into its form. Lowercased before it is saved. |
| Pseudonymous account digest | Present on an authenticated claim so the find can follow the verified account to another device and so one account cannot claim the same drop twice. A signed-out practice claim may leave it empty. |
| Device id | A random identifier your own browser generates and keeps in local storage under the key cardsgo-device. It is not a fingerprint, it is tied to no account, and clearing your site data makes a new one. |
| Latitude, longitude and accuracy | One coordinate — the median of the readings taken during the check — used to confirm you were inside the drop radius, and as the starting point for the travel-speed check on your next claim. |
| A six-digit pickup code | So the host at the location can validate the pass once, and only once. |
| A digest of a private claim-management key | The winning browser keeps the actual key with its receipt in local storage. The server stores only its SHA-256 digest. The key can manage the shipping address but is never shown to the drop host; the six-digit pickup code cannot read an address. |
| Status, created time, expiry time | To expire an unclaimed pass after fifteen minutes and to apply the two-hour cooldown between claims. |
The individual GPS readings are not stored. Neither is the device-motion measurement — it is checked in memory to see whether the phone moved like a phone, then discarded with the request. Location is used for the presence check and the reachability check, and for nothing else. It is never used to advertise to you, build a movement history, or work out where you live.
A claim collects no postal address. Nothing on the claim form asks for one and nothing in the claim record holds one — that question is asked afterwards, of the person who won, and it is the next section.
2. When you give us a postal address
If you win a card we need somewhere to send it, and that is the only reason this table exists. You are asked once the claim has been accepted — never during it and never before — because only the person who actually won should be asked for a home address at all. A practice run is never asked: nothing ships, so there is nothing to hold.
| Stored | Why |
|---|---|
| Recipient name, one or two address lines, town or city, and country | The four things every address on earth has. They are stored exactly as typed; nothing is capitalised, reformatted, or checked against a postal database on your behalf. |
| Region or province, and postal code | Required for the United States and Canada, where both are needed to route reliably; optional where a country may have neither. The United Arab Emirates and Hong Kong issue no postal code at all, and Ireland’s reaches only some addresses in practice. |
| The claim it belongs to | So the right parcel goes to the right door. It is attached to one claim, not copied into the avatar profile or exposed by an account find response. |
| Which proof was accepted, and when | The winning browser supplied its private claim-management key. If a parcel ever goes to the wrong door, this is how we can say who changed the address and how they showed it was theirs to change. |
| Previous versions, kept rather than overwritten | People mistype their own street, and by the time you notice, a label may already have been printed from the old one. So a correction writes a new row and marks the old one replaced instead of erasing it. |
| A status alert that says an address is ready | The alert contains the claim and its state, but never the street address. It tells the operator to sign in to the protected operator view and read the current address there immediately before fulfilment. That prevents old addresses lingering in mailboxes after a correction or deletion. |
Exactly two parties can read it back or change it: the winning browser and us. The browser must present the eight-character receipt together with its private claim-management key. Typing an email address or signing in with one is not accepted as proof: the claim form did not verify that email, and a typo must not expose a winner’s home address to an unrelated mailbox owner. The six-digit pickup code is deliberately not accepted either: you show it to the drop host, and showing a pass must not show someone your home address or let them redirect a parcel.
Who else sees it. An address is shared to get the parcel to you: with Collector Crypt and the vault holding the card, who post it, and with the courier that carries it. Before that it is read by whoever at Cards Go prepares the parcel, on the protected operator page listing recent claims. A status alert may travel by email, but it never contains the postal address. Beyond fulfilment, nowhere: it is not published, it is not sold, and it is used for nothing but posting a card. Today that sharing has never happened — no card has been bought, redeemed or shipped by Cards Go, so no address has yet been given to anybody.
3. When you suggest a spot
| Stored | Why |
|---|---|
| Venue or pickup point, and city | To find and vet the place. Both are required. |
| Notes | Optional. Whatever you write about access, staff or timing. |
| Contact | Optional and free-form — an email or a social handle, whatever you choose to type. If you leave it blank the suggestion is anonymous to us. |
| Coordinates, status, created time | Coordinates only if the suggestion form supplies them for the place you named. Status tracks whether we have reviewed it. |
4. If you request a quote
This form is not on the site today. The table and the endpoint behind it still exist, so here is what they hold if it comes back.
| Stored | Why |
|---|---|
| Email address | To send the estimate and, later, a private checkout invitation. |
| Destination region | One of five broad regions — United States, Canada, Europe, Australia and New Zealand, or rest of world. A quote is priced from the region alone; it never asks for a street address. |
| The listing you asked about | Its name, category, type, marketplace asset address, the chain it sits on, its listing id and its certification number. This is public information about a card, not about you. |
| The quote figures | Listing price, shipping estimate, the proposed service fee and reward budget, the two estimate totals, and the currency — kept with the request key your browser sent, so repeating a request returns the same answer instead of a new one. |
| Status, quote expiry, created time | Quotes expire ten minutes after they are issued. |
5. When you vote or propose a location
| Stored | Why |
|---|---|
| Round, poll, choice, and timestamps | To count the ballot and let you change your choice while the round is open. |
| One-way account digest | To enforce one choice per verified account in each poll. It is derived from the signed-in account id; the raw id, email, and wallet address are not stored with the vote. |
| Public place name and exact coordinates | Only when you deliberately propose a map pin and confirm that it is a public place. The name, exact pin, and aggregate vote count are visible to everyone using the ballot. |
A location proposal is limited to one per verified account in a round. Other voters see the proposal, not who placed it. Community voting is advisory: it does not move treasury funds, buy a card, or publish a live drop.
What we never collect
- No Cards Go password. Privy handles optional sign-in credentials.
- No payment-card details, wallet private key, or seed phrase. The app can display a public embedded-wallet address and a read-only public treasury balance, but voting cannot sign or send a transaction.
- No street address, unless you have won a card and given us one to post it to. Nothing else on the site asks for an address: not browsing, not signing in, not claiming, not voting. What that one record holds is section 2 above.
- No identity documents, no photographs, no contacts, no browsing history.
These tables are in Cloudflare D1, the SQLite database attached to this site, and the site itself runs on Cloudflare. Cloudflare processes the request in order to serve it, in the same way any host sees the traffic it delivers.
What your browser talks to
Card images are loaded straight from the marketplace image servers rather than copied onto ours, and the map page loads its tiles from tiles.openfreemap.org. Those servers see your IP address and the file you requested, exactly as they would if you visited them directly. Marketplace searches do not work that way — they go through our server, so the marketplace sees our request, not yours.
What is public
The claim ledger publishes the first eight characters of a claim id, the drop it belongs to, the item, the category, the status and the timestamps. It never publishes an email address, a device id, a coordinate, a pickup code or a postal address, and it never will.
The community ballot publishes aggregate vote counts. A location you propose publishes the place name and exact coordinates after you confirm that disclosure. It never publishes the account digest or ties a named voter, email address, or wallet address to a choice.
There are no ad networks, tracking pixels, session recorders or analytics scripts on this site today, and no advertising or analytics cookies are set. We do not sell your data, rent it, or share it for marketing. If any of that changes, this page changes first and the date at the top moves.
How long we keep it
Honestly: there is no automatic deletion schedule yet. Avatar profile, claim, address, suggestion, quote, notification, vote, and location-proposal rows stay in the database until you reset the avatar, remove an address, ask us to remove the rest, or until we clear the pilot data. When a retention period is set, it will be written here.
Email hello@cardsgo.app to request a copy or deletion. We will require the private claim-management key, a current verified Privy session, or another verification process appropriate to the data before disclosing or deleting anything; the public eight-character receipt alone is never enough. The synced avatar can be reset from the You page. A postal address can also be deleted immediately from its address panel, without touching the claim it belongs to — every version of it, including the ones a correction replaced. Once a parcel has been handed to a courier we cannot take the address back out of their system, only out of ours. Operator status alerts never contain the street address.
Your rights, described honestly
We are not claiming GDPR or CCPA compliance, and it would be easy but wrong to paste that claim here. What we can tell you is the practice: the data set is small and listed above, you can ask for a copy of it or have it deleted by email, we do not sell it, and we do not send it anywhere except the third parties named on this page. If you are somewhere that gives you stronger statutory rights, write to us and we will do our best to meet them.
The site is not aimed at children. If a claim comes from someone under 18 and we are told, we will delete it.
Changes, and how to reach us
Any change to what we store will show up on this page with a new date at the top. For anything at all — a question, a deletion request, or a correction to something here that is wrong — write to hello@cardsgo.app. The rules for using the site are on the terms page.