Privacy Policy
What we hold, why, for how long, and what you can make us do about it.
This policy is written to be read. It says what personal data Cardigani processes, on what basis, how long it is kept and what rights you have.
Every claim here describes something the software actually does today. Where a thing is not built, this policy says so rather than describing an intention.
The short version
Your decks are yours. They are shown to nobody else. There are no shared libraries, no discovery feed, no public boards.
Nothing here trains an AI. Cardigani sends your cards to no model, ours or anyone's. There is no AI in this product.
Nothing is sold or brokered. No advertising, no data brokers, no analytics resale.
No third-party trackers. No advertising pixel, no third-party font, no analytics company. There is one small counting script, and it is ours, served from this site — see below.
You can take everything out, and you can delete it all. Both are buttons in the product, not requests you have to email us about.
Who is responsible
The data controller is Ivan Naydenov (Private individual (not registered as a trader)), established in Bulgaria. Registration number: None — not registered as a trader.
For anything to do with your data, write to support@cardigani.app. We answer within one month, as Art 12(3) requires.
No Data Protection Officer is appointed. One is required under Art 37 only for public authorities, or where the core activity is large-scale systematic monitoring or large-scale special-category processing. A one-person index-card tool is none of those.
What is collected, and why
Cardigani asks for as little as it can. There is no profile, no display name, no avatar, no address book.
| Data | Why | Legal basis |
|---|---|---|
| Your decks — every card's text, its position, size, rotation and connections, plus the deck's name and folder | This is the service. Without it there is nothing to reopen | Contract — Art 6(1)(b) |
| The board snapshot (a thumbnail image of your arrangement) | So the library shows you the board rather than a filename | Contract |
| Google account identifier and email address | So that your decks come back to you and to nobody else | Contract |
| Payment identifiers from our payment provider — a customer id, what you bought, whether it is active | To know whether your account is paid. We never see or store your card number | Contract; legal obligation (Art 6(1)(c)) for invoices and tax records |
| Server logs — IP address with its last part removed before it is written (so no whole address is ever stored), time, path, response code, the page that linked here, errors | Security, fault diagnosis, and enforcing the rate limits below | Legitimate interests (Art 6(1)(f)) — keeping the service up and unabused |
| Page counts — how many times a day the front page was opened, the demo board was tried, a price button was pressed, and each link we published (cardigani.app/r/…) was followed | So the one page that sells Cardigani can be improved. A count per day and nothing else: no address, no browser details, no cookie, no identifier — there is no way to tell two visitors apart, or to tell that you came back | Legitimate interests — and, because nothing is stored on your device, outside the ePrivacy consent rule |
| Usage counts per account — a count per day, per account, of what was done: a deck made, a save, a picture, an export, a search, a sign-in, something sent to the trash or taken back out | So we can see whether Cardigani is actually being used, and whether someone who started came back. A count and a date and nothing finer: not what you wrote, not which deck, not what time of day, no address, no browser details | Legitimate interests — Art 6(1)(f) |
| How you found us — the code of the link you arrived by, if you came through one of ours (for example a video's link), and, only if you chose to answer, your one line on where you heard of Cardigani | So we know which videos and posts actually bring people, and stop making the ones that do not. It is written to your account when you agree on the page before the card. Nothing is stored on your device — the code travels in the link itself | Legitimate interests — Art 6(1)(f). The line is optional; leave it empty and only the code (or none) is kept |
| Sharing and the call — the code of your own link (it carries your first name, as in cardigani.app/r/ana-1a2b, so whoever you send it to sees it); if a friend's link brought you or you brought a friend, who brought whom and whether that friend started; the free days that earned; and, if you ask for a call, the time you asked for and your time zone | To give both of you the free days the offer promises, and so that Ivan can write back about the call — the request reaches him as an email. Nothing is stored on your device — the code travels in the link | Contract — Art 6(1)(b): it is the offer you took up |
| Write counts per account, held in memory only | Rate limiting. Never written to disk, gone when the process restarts | Legitimate interests |
| Product news — your email address and the moment you ticked the box, with the version of this policy in force | To send you a few mails a year about what shipped, only if you asked, from our own mail server. Every one has a one-click way out, and the switch is also in your account | Consent — Art 6(1)(a). Withdrawable at any time, in one click |
What is deliberately not collected
No advertising identifiers. No cross-site trackers. No profiling. No automated decision-making with legal or similarly significant effect (Art 22). No special-category data is asked for — and you should not put any on a card, because a card is a free-text field and we cannot detect what is in it.
Cardigani does not read your cards for any purpose of its own. Nothing inspects, classifies or summarises their content. The one thing that touches it is your own search: so that a deck can be found by a word you wrote on a card, the words on your cards are kept alongside the deck in a form your search can match — for you, in your library, and for nobody else.
Cookies, and how visits are counted
One cookie, and only after you sign in: the session cookie that keeps you signed in. It is strictly necessary for a service you asked for, so under the ePrivacy Directive Art 5(3) it needs no consent banner — and Cardigani shows none.
One cookie is not the same as nothing kept in your browser, so here is what is kept. The app remembers a few things on your own device, in the browser's own storage rather than in a cookie: whether you chose the light or the dark face, how big the app's own controls are drawn, whether the edit history on a card is showing, and a flag that lasts a few minutes while you are at the checkout. And, so that the app opens and works with no connection, a working copy of your own account: the decks you have opened on that device, your shelf's list, a picture you added while offline until it has gone up, which account was last signed in there, and the app's own files. These are the same decks that are kept on our server, not anything extra about you — the copy is why nothing you type is lost when the network is. Each of these is written only because you did something that asked for it, and each stays on that device: the working copy goes nowhere but to the server your decks already live on, the rest is never sent to us or to anybody else, and the Sign Out button removes the working copy from that device. Storage a person asked for is exempt from the consent rule for the same reason the session cookie is. The light-or-dark choice is also kept with your account, so the same face greets you when you sign in on your phone.
No tracking pixel, no advertising, no third party. Visits are counted in two ways, and neither one puts anything on your device. First, from the web server's own log, in which every IP address is shortened before it is written; the front page's demo and price buttons each add one to a daily count when used. Those counts hold no address, no browser details, no cookie and no identifier of any kind, so they cannot tell two visitors apart and are not about a person.
Second, one small counting script of our own. It is served from this site — not from anybody else's — and it tells us the page you opened, the site that linked you here, your country, your browser and your screen size. It stores nothing on your device and sets no cookie. Your address and browser string are held in our server's memory for eight hours only, so that several pages read in one sitting can be counted as one visit, and then they are gone; nothing about them is ever written down. The software is called GoatCounter and we run it ourselves, on our own machine — it is not a company we send anything to, which is why it appears in no list of providers on this page. Counting a request the server already answered stores nothing on your device at all, and the screen size is read from the browser rather than kept in it.
Who else is involved
These providers process data on our instructions, under Art 28 terms. We will update this list before adding another.
| Provider | What they do | Where |
|---|---|---|
| Hetzner Online GmbH | The server your decks are stored on | Germany (EU) |
| Cloudflare, Inc. | DNS and the network in front of the site. Traffic passes through whichever of their locations is nearest you. They no longer touch our mail — that moved to SiteGround on 4 September 2026 | Global edge; EU–US transfers under Standard Contractual Clauses |
| Google Ireland Ltd / Google LLC | Sign-in only. We receive your email address and account identifier and nothing else. We request no other scope | EU/US |
| SiteGround Spain S.L. | Our mailboxes and the outgoing mail server. Every letter Cardigani sends you, and everything you write back to support@, passes through them | EU |
| Stripe Payments Europe, Ltd. | Payments, invoices and receipts. Card details go to them and never to us | Ireland (EU), with US transfers under Standard Contractual Clauses |
Where your decks live
Your decks are stored on a server in Germany, and backed up to storage controlled by the operator in Bulgaria. Both are in the EU.
Requests reach that server through Cloudflare's network, which has locations worldwide, so the *transport* of a request may pass outside the EU even though the *storage* does not. Cloudflare acts as our processor under Standard Contractual Clauses.
Sign-in and payment involve providers with US parent companies, also under Standard Contractual Clauses.
How long things are kept
| Data | Retention |
|---|---|
| Decks, thumbnails, folders | Until you delete them. Deleting your account deletes them immediately |
| The working copy on your own device | Until you press Sign Out there, or clear that browser's storage. It is on your device, not with us — the decks themselves are the row above |
| Backups | 14 days, then automatically removed. This is why deletion is not instantaneous everywhere: a deck you delete today is gone from the live service at once and out of the last backup within a fortnight |
| Account and sign-in identifiers | Until you delete your account |
| How you found us | Until you delete your account |
| Sharing and the call | Until you delete your account. A row that names a friend goes when either of you deletes theirs |
| Invoices and tax records | As Bulgarian law requires — these survive account deletion because we are not free to destroy them |
| Server logs | 14 days. Both the web server's own logs and the application's are rotated on that clock and then deleted. This number was checked against the machine rather than chosen — the logs kept 14 days, so the policy says 14 |
| Usage counts per account | 13 months, then they become a monthly total with the account dropped, so what is left is not about anyone. Deleting your account deletes yours immediately |
| In-memory rate-limit counters | 60 seconds, and never written to disk |
| Product-news consent | Until you withdraw it — one click in any news mail, or the switch in your account. Deleting your account removes it |
| Consent and withdrawal records | Five years, the general limitation period for a claim in Bulgaria. These are the dated notes that you accepted the terms, that you ticked the box before the card, or that you withdrew from the contract — the proof of what was agreed and when, which protects you as much as us. They survive account deletion, because a refund obligation runs from the date on one of them; Art 17(3)(e) allows exactly this. What survives is the note, not you: your account is gone, so the identifier on it no longer points at a person |
Your rights, and which ones are buttons
Under the GDPR you may access, rectify, erase, restrict and object to processing of your personal data, and port it elsewhere.
Portability (Art 20) is built in. *Export my data* produces a zip containing every deck as JSON — with the full text of every card — plus every board snapshot as a PNG, and a readme explaining both. A commonly used, machine-readable format you can open without us.
Erasure (Art 17) is built in. *Delete my account* removes your decks and their snapshots from the live service straight away. Backups age out on the 14-day clock above. Invoices survive, because tax law requires it, and so do the dated consent and withdrawal records described in Retention — the proof of what was agreed, which is not about who you are.
Rectification (Art 16) — your cards are editable by you at any time; that is the whole product.
For anything else, write to support@cardigani.app.
You may also complain to a supervisory authority. Ours is the Commission for Personal Data Protection (КЗЛД), 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, Bulgaria — kzld.bg, and you may equally complain to the authority where you live.
Security — what is actually true
Traffic is encrypted in transit (TLS 1.2 or better, enforced; the .app domain is on the HSTS preload list, so browsers refuse plain HTTP outright). Administrative access to the server is over a private network, not the public internet. Passwords are never handled, because sign-in is delegated to Google.
What is not claimed: this is a small service run by one person on one server. There is no 24-hour security operations centre, no formal certification, and no encryption of the database at rest beyond the disk it sits on. We would rather tell you that than write security theatre.
If a personal data breach occurs we will notify the supervisory authority within 72 hours and, where Art 34 requires it, you.
Children
Cardigani is not intended for people under 16 and we do not knowingly hold their data. If you believe a child has an account, write to support@cardigani.app and it will be removed.
Changes to this policy
Each version carries a date, and the version in force when you agreed is recorded against your account. Material changes are notified by email at least 30 days before they take effect.