Privacy Policy

Who we are

Cardexa is an independently operated service based in Ontario, Canada. Our Privacy Officer is responsible for privacy matters, and their identity is available on request. You can contact them at cardexatcg@gmail.com.

Information we collect

• Account details. Your email address and username. If you sign in with a password, we need that too. Passwords are not stored in readable form.
• Profile details you choose to add. Your display name and profile picture.
• Optional sign-in with another account. If you use or link an account from the sign-in service shown on our login page, we receive your email address, name, and profile photo from that service. We do not receive that account’s password. You do not need a separate Cardexa password unless you add one in Settings.
• Your collections and wishlist. Collection names and themes, saved cards and print versions, quantities, and when you save or update them.
• Your preferences. Display, theme, and notification settings.
• Website and device information. Information such as your IP address, browser type, and the pages or files requested. Our service providers receive this information to deliver pages, investigate errors, and prevent abuse.
• Support messages. Your email address and anything you include when you contact us.

We do not ask for your birth date, phone number, or payment information. We do not build advertising profiles or keep a history of your searches or browsing tied to your account. Page-speed reports include the address of the page being measured and of the page you came from, as explained under Cookies and browser storage.

How we use your information

We use your information to:

• create your account, verify your identity, and keep you signed in;
• save your collections, wishlist, and account preferences across devices;
• send account confirmations, password resets, and other security messages;
• respond to your questions and support requests;
• protect accounts and prevent misuse, including automated sign-in attempts;
• understand how quickly pages load and how often they are visited, and address performance problems;
• meet our legal obligations.

We do not sell or rent personal information, send marketing emails, or share your information with advertisers.

Cookies and browser storage

Cookies and browser storage are small pieces of information saved on your device. Cardexa uses them for these purposes:

• Keeping you signed in. Sign-in cookies remember your session so you can access your account. Signing out clears these cookies in that browser.
• Remembering your theme. Your choice when signed out stays in your browser until you change it or clear your site data. It is separate from the themes saved with your collections.
• Remembering your selected collection. Browser storage keeps a copy of your account and collection identifiers, collection name, and theme. The current selection is specific to each tab, and a saved default helps when you open a new tab. These account-related copies are cleared when you sign out in that browser.

Page-speed measurement. We receive reports about load times, the address of each page viewed and of the page you came from (without any codes or other details added to the end of the address), device and browser types, and country. These reports do not use cookies or identify you to us. We use them as totals, such as typical load times and the number of visits to each page, and not to build a history of your browsing across pages.

Security checks. The bot check on sign-in, sign-up, and password-reset forms examines browser and device information to distinguish people from automated traffic. Its provider also uses these signals to improve its bot detection, as explained in the privacy notice for the bot-check service. That notice identifies the provider and explains how to contact it about its use of these signals.

We do not use advertising cookies or use browser storage to track you across other websites. You can clear or block cookies and site data in your browser settings. Blocking sign-in cookies prevents account features from working; clearing saved preferences resets your theme and collection selection. If we introduce optional analytics or advertising technologies, we will explain them and request consent before enabling them where required by law.

Service providers and sharing

We use the following types of service providers to run Cardexa. This list explains what each type does and what information it handles:

• Account and storage services help you sign in and store account details, protected passwords, profile images, collections, wishlists, and preferences.
• Website hosting services deliver pages and process requests to use your account. They handle information sent through the website, including account requests, IP addresses, and browser information, and run scheduled tasks such as account deletion.
• Security and abuse-prevention services check browser signals and limit repeated requests. They process technical information and short-lived request counts associated with an IP address or account identifier. The bot-check provider’s own use of browser signals is described above.
• Connected-account sign-in services verify your identity and share your email address, name, and profile photo when you choose that sign-in option. Your separate account with that service remains subject to its own privacy policy.
• Email services deliver account confirmations, password resets, and security messages. They handle email addresses, message contents, and delivery information. Our support mailbox also processes the messages you send us.
• Website performance services process the page-speed reports described above to help us find slow pages, improve loading times, and count visits.
• Card-image services supply some images directly to your browser and receive information needed to deliver them, such as your IP address and browser type. We do not send them your account details or saved collections.

We limit the information shared to what is needed for the purposes described here. Cardexa remains responsible for information processed on our behalf and uses contractual and security safeguards to protect it. Beyond these services, we would disclose personal information only if required by law or where necessary to protect the safety and integrity of the service.

For the current names of the providers handling your information, their locations, or more detail about what they receive, contact our Privacy Officer at cardexatcg@gmail.com. You can ask before creating an account or at any time afterwards.

Where your data is stored

Our providers store and process information primarily in the United States. When information is outside Canada, the laws of that country apply and its courts or public authorities may be able to require access. Our safeguards do not override those laws. You can contact us for details about processing locations and protections.

Your profile picture is public

Your profile picture can be viewed by anyone with its link, even without signing in. Treat it as public. We process uploaded images to remove hidden information such as camera details and location data, but anything visible in the picture remains visible. Please do not upload an image you want to keep private.

How long we keep information

We keep your account information while your account exists. You can delete your account using Delete Account in Settings. There is a 30-day recovery window: to cancel deletion, sign back in and choose Cancel Deletion in Settings before the deadline.

After the recovery window, a scheduled process removes your account, collections, wishlist, preferences, and uploaded files from the live service. Backup copies and service logs may remain until the providers’ normal deletion schedules run; this is separate from the recovery window. Request counters used to prevent abuse expire automatically. Contact us for details about the retention periods that apply to your information.

Support correspondence is kept for as long as needed to address your request and any related complaint or legal obligation. You can contact us to request its deletion.

How we protect your information

We use encrypted connections, protected password storage, access controls, and checks against automated abuse. Access controls restrict which accounts can view or change saved collections, wishlists, and preferences. No online service can promise perfect security. If a breach affects your personal information, we will notify you and the appropriate authorities where required by law.

Access, correction, and your choices

You can change your email address, username, display name, profile picture, password, connected sign-in account, and notification preferences in Settings. You can remove optional profile details, disconnect another sign-in account after adding a password, turn off notifications, or delete collections and wishlist entries.

You may ask to withdraw consent for uses that rely on your consent, subject to legal or contractual limits. Some information is needed to provide your account; if you ask us to stop using it, we may no longer be able to provide those features. We will explain the effect of your request.

To request a copy of your information or a correction you cannot make yourself, email cardexatcg@gmail.com. We do not yet offer an automated data export. We may need to verify your identity. We respond within the time required by applicable law, generally 30 days for requests covered by Canadian federal privacy law. If a permitted extension or exception applies, we will explain it as required by law.

Age requirement

Cardexa accounts are for people aged 16 or older, and the service is not directed to children. You confirm your age when creating an account; we do not independently verify it. If you believe someone under 16 has created an account, contact us at cardexatcg@gmail.com so we can investigate and delete the account if confirmed.

Changes to this policy

We may update this policy as Cardexa changes. The “Last updated” date identifies the current version. If we make a material change, such as collecting new types of information or using it for a new purpose, we will explain it prominently on the site and by email where appropriate, before it takes effect. We will obtain fresh consent where required by law.

Questions and complaints

Contact our Privacy Officer at cardexatcg@gmail.com with questions, concerns, or complaints about your information. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada. Any additional rights under privacy laws that apply to you are not limited by this policy.