Privacy & data

Who's responsible for your data

Questions about this page, or about the data described on it, go to admin@cardle.dev. For India's DPDPA, the same address reaches Cardle's Grievance Officer.

Why Cardle uses this data

The main purposes and controls are:

• Providing the service you asked for — your account, your cards, connecting GitHub Issues, Connect AI tokens, and feedback you send. This is necessary to perform our contract with you: there's no separate consent step for it, because it's what using Cardle means.
• Legitimate interest — your activity history (below), used to rank your own feed and to understand how Cardle is used, overall and, unless you turn it off, by letting administrators look at your own activity (see Sharing your activity). It stays inside Cardle's own database and is never sold or used for advertising. (Optional Reddit advertising measurement, below, is separate: it has its own advertising choice and doesn't use your activity history.) Also anonymous visit counts on Cardle's public pages (see Visit counts on public pages).
• Optional advertising measurement — Reddit ad visits and new registrations, described below. For visitors with a valid Reddit ad click, the choice is selected by default worldwide and asked once, on the public home page or at registration; you can turn it off before continuing. This default selection is not a record of affirmative consent. Use Advertising choices to change your preference.
• Consent — the separate Build on Cardle waitlist. Withdraw this consent by emailing the address above.

Your rights

Under UK and EU data protection law, you can ask to see, correct, export, or delete what Cardle holds about you, or object to how it's processed. Email admin@cardle.dev and we'll respond within a month. If you're not satisfied with the answer, you can complain to the UK Information Commissioner's Office or your own country's data protection authority.

Under India's Digital Personal Data Protection Act (DPDPA), you can ask for a summary of the personal data Cardle holds about you and how it's used, have it corrected, completed or erased, withdraw any consent you gave, and nominate someone to exercise these rights for you if you die or can't. Raise a grievance with the Grievance Officer at admin@cardle.dev; if you're not satisfied with the answer, you can complain to the Data Protection Board of India.

The Terms require you to be 18 or older. Cardle isn't directed at, and to our knowledge isn't used by, children under 13 (16 in some EU countries, or under 18 under India's DPDPA, which also requires verifiable parental consent for a child's data). Sign-up is open to anyone with a Google account until Cardle has 200 accounts; after that, new accounts join a waitlist and an administrator enables each one. Everyone confirms that they're 18 or older the first time they sign in. Google sign-in doesn't tell us your age, so we rely on that confirmation, and if we learn an account belongs to someone under 18 we remove its access and delete its data.

How long data is kept

• Your cards: kept while your account is active. Deleting one leaves a deleted marker on the row for 90 days (so it can be recovered if you ask), then it's hard-deleted.
• Your activity history: kept for 24 months, then deleted.
• Registration diagnostics: the internal reference and any browser-reported advertising attempt are kept for 90 days. Manually entered daily traffic and advertising report snapshots, including who recorded them, are kept for 12 months.
• A sign-in request from an account that isn't enabled, if dismissed by an administrator: kept for 12 months.
• Feedback you send: kept while your account is active, since it's support history; deleted if your account is erased.

A daily job deletes data once it's past these periods. They may change as Cardle grows; this section will be updated if they do.

Your cards

The reminders, learnings, work items, family updates, bookmarks, Misc cards and files you add are stored in a Postgres database (Neon) and file storage (Vercel Blob, private). Each Google account has its own separate space; nobody else's account can read yours.

Deleting a card removes it from Cardle everywhere you see it. The database keeps a deleted marker on the row rather than erasing it immediately.

Starter cards, and cards added by "Deal me 5", are removed after 14 days unless you like, pin or edit them or attach a file. Cardle remembers which cards it has dealt you, so it never deals the same one twice. The topics you pick are stored with your account.

Signing in

Signing in with Google gives Cardle your email address, name and profile picture, and records when you first and last signed in, and when you confirmed you're 18 or older. Until Cardle has 200 accounts, signing in for the first time creates your account. After that, only accounts an administrator has enabled can sign in.

If you try to sign in with a Google account that isn't enabled (for example, once Cardle is full and you join the waitlist), Cardle keeps its email address, name and profile picture, when you first and last tried, and how many times, so an administrator can let you in or dismiss the request. A dismissed request is kept, so trying again doesn't put you back in the queue.

Cardle sets a cookie to keep you signed in, plus a short-lived one while you approve an AI assistant's access. Display preferences and similar small bits of state (such as whether media previews are shown) are kept in your browser's storage and never leave it. The one exception is the Reddit ad click identifier described under Advertising measurement, which is sent to Reddit only when your advertising preference is on.

GitHub Issues

If you connect GitHub Issues, Cardle stores:

• Your access token, encrypted (AES-256-GCM) before it is written to the database. It is never shown back to anyone, including you. Cardle only accepts fine-grained tokens, which you can limit to one repository and read-only access.
• The repository's name.
• A copy of its issues: titles, descriptions, labels, open/assigned/closed state and links, so they can appear in your feed. The copy is refreshed when you sync, and in the background when you open Cardle if the last sync is more than 15 minutes old.

When you disconnect, the token is deleted and the issues leave your feed. The copied issues are kept, hidden, so reconnecting doesn't start from scratch.

AI assistants

An assistant such as Claude or ChatGPT can reach your Cardle data only after you connect it, and only your own account's data. Tokens you create under Connect AI in the app can be revoked there at any time.

When you ask a connected assistant to read or change your cards, the card content involved passes through that assistant's own provider (for example Anthropic, OpenAI, or Google) as part of answering you — the same way it would for anything else you ask that assistant to do. That provider's own privacy terms, not Cardle's, govern what happens to your data on their side; see Service providers & data recipients for the full list of who's involved.

AI-powered recommendations and model training

Cardle does not currently operate its own AI model, send card content to a model provider on its own, or use private card content to train a model shared across accounts. The connected-assistant flow above happens only when you choose and direct an assistant.

The feed's AI sort orders your own cards on Cardle's server by a fixed rule over their due dates, statuses, dates added and likes. It does not read your card text, send anything to a model provider, or learn from your activity. Choose Date added to turn it off.

If Cardle adds its own AI-powered recommendations, it may process the minimum card content and activity needed to provide recommendations to that same account. Cardle will explain the provider, information involved, retention and controls before enabling that processing.

Cardle will not combine private content across accounts to train or improve a shared, generalized or non-personalized model unless the account holder separately and affirmatively opts in to that specific use. Declining will not block Cardle's ordinary features. A material new training use will not be applied retroactively to previously collected content merely by changing this page.

Cardle's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Cardle does not use Google API data to develop, improve or train generalized or non-personalized AI or machine-learning models.

Your activity history

Cardle keeps a history of what you do in it, to make the daily feed better and to see how Cardle is used. It records:

• Cards you create, edit or delete: the card's type, which fields changed, and values picked from a list (such as status or category), but not the text you typed.
• What you do in the feed (like, pin, snooze, delete), which cards were shown and opened and for how long, and the website of any link you follow from a card.
• Searches, including the words you searched for, and the filters, views and display settings you choose.
• Signing in and out, sending feedback (its kind, not what you wrote), and each tool an AI assistant uses on your behalf, including which cards it was given when it listed or searched your feed (but not the words it searched for).
• The starter feed you pick when you join, and each time you use "Deal me 5": the topics you chose and how many cards it added.

It never records the text of your cards, what you send in a request, or any password, token or code. Each entry has your account email and the time. It's deleted after 24 months (see How long data is kept).

Feedback

When you send feedback, Cardle stores what you wrote, the kind you picked (bug, idea or other), the time, and your account email so it can be followed up. Cardle's administrators read it on the admin page, where they can mark its progress and add private notes to it. It is not shown in your feed or to other accounts.

Waitlists

If you join the Build on Cardle waitlist (the home page's "Build on Cardle" option), Cardle stores your name, email address, the time, and your answers to the form's questions: your role, what interests you about building on Cardle, what you'd like to build (if you say), how comfortable you are building with AI, whether you're interested in training for your team, and how you heard about Cardle. It is used to shape what Cardle offers builders, to email you about building on Cardle and, if you said you're interested in training, about that.

This list used to be a waitlist for a self-hosted edition, which isn't planned for now. If you joined it then, we'll tell you about the change before emailing you about anything else, and you can have your entry deleted by emailing the address above.

An earlier waitlist for a Developer Learning Path has been retired, and the sign-ups collected for it are deleted.

What administrators can see

Cardle's administrators, the people who run it, have an admin page. For each account it shows:

• the email address, name and profile picture;
• whether the account has access, who enabled it, and when it joined, last signed in and was last active;
• activity counts from your history for the last 30 days: days active, cards created and AI assistant calls;
• which services are connected (such as GitHub) and how many assistant apps and Connect AI tokens there are, but never the tokens themselves;
• any feedback you sent, any request you made for access, and your answers if you joined the Build on Cardle waitlist;
• unless you've turned activity sharing off, your activity history for the last 30 days, one entry at a time: which cards were shown and opened and for how long, the website of links you followed, your searches and filters, likes, pins, snoozes and deletes, and which tools an AI assistant used. A card is identified by its type and an id: never the title or text of cards you wrote. For cards Cardle added for you (such as "Deal me 5" articles and videos), the title and link of that public article or video are shown.

Administrators can download these lists (accounts, feedback, and the Build on Cardle waitlist) as spreadsheet files, with the same details the page shows, to work with them outside Cardle. They're kept privately and never shared or sold.

It also shows totals across everyone: how many people were active each day, how long sessions last, which kinds of cards get opened or deleted, and which assistant tools are used. It also shows totals of visits to the public pages from the visit counts below (visitors and page views per day, the most visited pages, linking sites, countries and campaign tags, and how often those buttons were clicked), which never identify anyone.

Every time an administrator opens someone's activity, that is recorded, with who looked and when, and kept with the activity history. Administrators can download one person's activity as a spreadsheet file too; that is recorded the same way.

The admin page doesn't show the contents of your cards or your synced GitHub issues. The administrators also run the database itself, so they could technically read anything stored in it; they don't use that to look at your cards.

Sharing your activity

Sharing is on unless you turn it off. While it's on, Cardle's administrators can look at your own activity history, as described above, to understand how people use Cardle and make the feed better. Turning it off stops that straight away, including for activity recorded before; your history is still kept and still used to rank your own feed, and still counts towards totals across everyone. You can turn it back on at any time.

Sign in to Cardle to change this setting here.

When access is removed

If an administrator removes your access, it takes effect within about 30 seconds: you are signed out, your API tokens are revoked and assistant connections stop working, your GitHub token is deleted and your synced issues are hidden.

The public demo

Visitors who aren't signed in see a shared demo feed. Nothing you add while signed in with Google appears there, and no service can be connected to it.

Registration diagnostics and campaign reports

When a Google sign-in creates a new account, Cardle records a random registration reference alongside your account and Joined time. The same reference is written to that request's hosting log so administrators can verify that registration completed. This is operational account information, separate from private activity sharing; turning activity sharing off does not hide account creation information. Database diagnostic records are deleted after 90 days and on account erasure; hosting log availability follows Vercel's log retention. Older accounts and unavailable diagnostics have no request match.

If your advertising preference is on after the onboarding choice, that page may report to Cardle whether its Reddit pixel attempt was acknowledged by the isolated frame or remained unconfirmed. This browser report is not proof that Reddit received or attributed the signup. No attempt is reported before completing the advertising choice or after withdrawal, or when GPC or Do Not Track is enabled. Cardle does not send the registration reference or your account identity to Reddit, and does not store a campaign tag or Reddit click identifier against your account.

Administrators can enter daily aggregate visitor, page-view, attributed-signup and spend totals from Vercel Analytics or Reddit reports, with the report's time zone and attribution window. These are manually recorded snapshots, not automatic receipt checks, and they are not joined to individual visitors or accounts. No private card, search or assistant activity is used for advertising. Administrators can view and download registration diagnostics; daily external snapshots record who entered them and when.

Visit counts on public pages

Cardle's public pages (the home page, guides, policies and sign-up forms) use Vercel Web Analytics, run by Cardle's host, to count visits. It sets no cookies and doesn't identify you: Vercel tells visits apart with a hash of the request that it discards after 24 hours. For each visit it records the page, the site that linked to it, rough location (country, region and city), browser, operating system and device type. Cardle drops every query parameter except campaign tags (utm_) before anything is sent, and never sends what you type into a form. It also counts clicks on a few buttons, such as Open your Cardle or playing the demo video, and finished sign-up forms, sending only the button's fixed name.

The signed-in app, your cards and anything an AI assistant does through Cardle are not part of these counts.

Other services involved

• Google: sign-in. Your browser loads Google's sign-in script only when you choose to sign in. If you choose Add to Google Calendar on a reminder, your browser opens Google Calendar with that reminder's title, due date and repeat filled in; Cardle itself sends Google nothing, and the event is saved only if you save it there. The fonts on Cardle's pages are served by Cardle itself.
• GitHub: contacted by Cardle's server, never by your browser, and only if you connect it.
• Sites your cards link to: when media previews are on (they are by default; the Previews control in the feed turns them off), your browser loads a card's YouTube thumbnail, or an image or video its link points to, directly from that site, which sees your IP address. Files you upload come from Cardle's own storage. The public demo doesn't load anything from other sites.
• Vercel hosts the app and file storage; Neon hosts the database.
• Reddit: optional advertising measurement when your advertising preference is on. See Advertising measurement.
• Whichever AI assistant provider you connect (see "AI assistants" above), only if you connect one.

Cardle uses the optional Reddit advertising pixel described below alongside the anonymous public-page visit counts above. Your private activity history (above) stays in Cardle's own database and is not sent to Reddit. Service providers & data recipients explains what each third party sees and why.

Advertising measurement

If you arrive through a Reddit ad and your advertising preference is on, Cardle loads the Reddit Pixel to measure visits to the public home and sign-in pages and a completed new-account registration. We require a valid Reddit ad click identifier before loading the pixel; ordinary public traffic without one is not sent to Reddit. This helps attribute sign-ups to Reddit ads and improve those campaigns. Returning sign-ins, unsuccessful sign-ins and waitlist requests do not count as registrations.

Reddit receives the event type and time, an advertising click identifier when available, and browser and network information such as your IP address, browser version and screen size. This is not anonymous measurement. Reddit may associate these signals with its own identifiers and handle them under its Privacy Policy and Business Tool Terms, including its retention and international processing practices.

The pixel runs in an isolated frame. We do not send your name, email address (including hashed email), Google sign-in credentials, card or file contents, searches, feed activity, assistant conversations or connector activity. It does not run in the private app or the AI assistant authorization flow. Cardle does not enable first-party Reddit cookies or build retargeting audiences through this integration; Reddit requests may still involve its own cookies subject to your browser settings.

New registrations with a valid Reddit ad click see an advertising choice after confirming they are 18 or older and signing in, before this page sends any Reddit events. Other registrations skip this screen without creating or changing an advertising preference. A valid, unexpired click identifier already stored with your permission in this tab also qualifies. Tracking is selected by default worldwide. Uncheck Enable Reddit advertising tracking before choosing Continue to opt out. A saved rejection stays off; closing the screen with Escape also opts out. Tracking remains off if the choice cannot be saved. Optional advertising tracking is only for adults. Reddit ad visitors without a saved choice see the same control, also selected by default, on the public home page; continuing with tracking on there confirms they are 18 or older, and closing it saves nothing and sends nothing. The choice is asked once: a choice saved on the home page is not asked again at registration. Your choice is saved in this browser for 180 days. While tracking is on, a Reddit click identifier is kept in this tab's session storage until the tab closes, for at most 28 days. Withdrawal removes it and stops future tracking; it does not erase events already received by Reddit. For access or deletion requests, contact admin@cardle.dev or use Reddit's privacy controls.

Use Advertising choices here, on the home page or on the sign-in page to turn tracking off or change your preference. A Global Privacy Control or Do Not Track browser signal keeps advertising tracking off.