Privacy Policy

1. Data Controller

The data controller is Raphaël Carvalho, an individual and the publisher of Kardive. Kardive is designed around data minimization in compliance with GDPR and CNIL rules. Without an account, your collection stays on your device. Contact: contact@kardive.app.

2. Data Collected and GDPR Legal Bases

Explicit Consent (Article 6.1.a): Optional camera scan training samples, and one measurement choice that covers audience measurement, performance measurement and Crashlytics crash reports. The website and the mobile app collect these only after you accept, and you can withdraw your choice at any time (cookie banner on the website, Me tab in the app).

Contract (Article 6.1.b): Account authentication, synced Kardive Cloud collection data, RevenueCat subscription verification, and SHA-256 hash verification of activation codes.

Legitimate Interest (Article 6.1.f): Firebase App Check / reCAPTCHA Enterprise abuse protection.

3. Sub-Processors

Google Cloud EMEA Limited (Dublin, Ireland): the website runs on Firebase App Hosting in region europe-west4 (Netherlands); Cloud Firestore, Cloud Functions and Cloud Storage for Firebase hold the account and Kardive Cloud data in region europe-west1 (Belgium).

RevenueCat, Inc. (USA, under EU Standard Contractual Clauses): App Store and Google Play subscription validation.

4. Data Retention Durations

Unverified email accounts: deleted after 7 days.

Cloud data after Kardive Cloud ends: kept in read-only mode for 90 days, then purged.

Sync deletion tombstones: purged after 31 days via Firestore TTL.

Database backups: 14 days retention (with 7-day PITR).

Opt-in camera scan samples: deleted after 365 days.

Cookie consent choice: stored for 13 months (395 days).

5. Your Rights and CNIL

You may access, rectify, export (CSV), or delete your account at any time (steps on kardive.app/account-deletion), or contact contact@kardive.app. You may also file a complaint with the CNIL (https://www.cnil.fr).

6. Shared boxes

With Kardive Cloud, you may turn on “Show my boxes to anyone who scans my tags”. Anyone who then scans one of your box tags with Kardive, or opens its link, sees the cards in that box: their name, set, language, finish, condition, grade and count, and whether you offer them for sale or trade. Your purchase prices, notes, tags, dates, location names, name and email stay private. An NFC tag can be copied: whoever keeps a copy or the link of a tag sees the box from anywhere, for as long as the option stays on. You hide one box from its menu, and you close every box by turning the option off in the Cloud screen; the boxes also close when Kardive Cloud ends or when you delete your account.

7. Website scanner

The scanner of kardive.app/scan reads your webcam only after you allow the camera in your browser, and only while that page shows. The camera images stay in your browser: the card is identified on your computer, and no image leaves it. Kardive receives only the copies you put away, as with any card you add.