Privacy

This describes what this install actually stores and sends, written against the code that runs it rather than from a template.

What an account holds

• Your username, and your password stored only as an Argon2id hash — the password itself is never written down and cannot be read back out.
• Whatever you put in your profile: display name, tagline, bio, footer, links and their titles, and your social addresses.
• The images you upload, re-encoded to WebP. Location and camera metadata in the original is discarded during that conversion.
• Your appearance settings — colours, font, radius, and so on.
• If you turn on two-factor authentication, its secret and the hashes of your recovery codes.
• Any pages on this site you bookmarked — their addresses and the date you saved each one, and nothing about the times you visited them. Only you can see the list, and removing an entry deletes it. Nothing is recorded unless you press Save yourself: pages do not report back that you looked at them.
• Your email address, and whether you have confirmed it. Signing up requires one, and we send a link to it to check the mailbox is really yours — that confirmation is what stands between this site and pages created in bulk to advertise things. You can change the address under Account, which starts that check again. It is only used to contact you about your own account: never shown on your published page, never passed to anyone else, and never used to send you anything you did not ask for.

There is no phone number, no date of birth and no payment information, because the site never asks for any.

Cookies

Two, both strictly necessary, neither used to track you:

• cardified_session — proves you are signed in. Not readable by scripts.
• cardified_csrf — stops another site from acting as you.

There are no analytics cookies and no advertising cookies, so there is nothing here to consent to or opt out of. Button counting, described below, sets no cookie either and stores nothing in your browser.

What leaves this site

Your published page sends visitors nowhere. Fonts are served from here, icons are embedded in the page, and no third-party analytics or social scripts are included. Someone opening your page contacts this site and nothing else.

Nothing is sent when a page loads. Not a page view, not a signed-in check, nothing. A published page makes a request only when somebody presses something on it, and a page nobody presses anything on contacts this server exactly as often as a page with no scripts at all: never. That is deliberate, and it is what stops any record of who read which page existing to be kept.

Two things on a page can cause a request, and both need a press:

• The Save this page button at the foot, which adds the page to your own saved list. It is on every published page.
• Button counting, if the page's owner has been given it — see below. It is off for every account unless an administrator has turned it on, and a page published without it carries no such script at all.

Button counting

An account can be granted counting for its published pages. What that records is a number: how many times each button was pressed, on each day. That is the whole of it.

It records nothing about the person pressing. No IP address, no cookie, no browser or device details, no referring page, no identifier of any kind, and no time beyond the date. Nothing is stored in your browser and nothing is read from it. There is no field anywhere in that record to put a visitor in, which is what makes it a tally rather than a history: one person pressing a button twice and two people pressing it once are stored as the same number, and neither can be told apart afterwards or joined to anything else.

So a page's owner can see that a link was followed forty times. Nobody — not them, not us — can see that you followed it, because that was never written down. This is also why there is nothing here to consent to or opt out of: a count that cannot identify anybody is not personal data.

Counts are kept for 90 days and older days are discarded automatically. They are visible to the account's owner and to administrators, are never public, and are deleted with the account.

The same is true of the dashboard and the sign-in pages: their styling and fonts are served from here, not from a content delivery network. There is one exception, and it applies to every page on this site:

• This site sits behind Cloudflare, which relays every request and therefore sees visitors' IP addresses and the pages they request. Cloudflare processes this information in order to provide security, caching, and protection against malicious traffic.

Separately: sending mail to your address means handing that address and the message to SMTP2GO, who deliver it on our behalf from their European servers. This happens between the servers, never in your browser, and only when there is something to send — in practice the confirmation link, and a fresh one if you ask for it or change your address.

Their click and open tracking is switched off. Mail from us carries no tracking pixel, and the links in it are ordinary links to this site rather than redirects that would record you following them. So SMTP2GO know we sent you a message; they do not know whether you read it.

The browser extension

There is a Cardified extension for Chrome. It is optional, it needs an account, and it does two things: lists your own pages so you can share them, and tells you when a page you bookmarked has been edited.

It has no sign-in form and never handles your password. It uses the session cookie your browser already holds for this site, so it cannot outlive a sign-out — changing your password revokes it the way it revokes every other session. It is also read-only: saving and removing bookmarks happen here on the site, and there is no request in the extension that writes anything to your account.

It reads two things, both yours and both from this site: your own pages, and your saved list. It talks to no other address — no analytics, no third-party scripts, and no code loaded from anywhere else. Every file it uses, including the typeface, is inside the package you installed.

What it keeps is stored in your browser alone: a short digest of each saved page as it last appeared, which is how it can tell an edited page from an unchanged one. That never leaves the machine, and it is what makes the check possible without recording anywhere that you are watching a particular page.

It sends nothing when you install it, nothing when a page loads, and nothing at all while you are signed out — not a page view, not a check for whether you are logged in. It asks about your own saved list once a day, and again when you open the panel. The pages you visit are not reported anywhere, because the extension never looks at them.

Logs

The web server records ordinary access logs — IP address, time, the path requested and the browser's user-agent string. Failed sign-in attempts are counted against an IP address in memory to slow down guessing; that counter is not written to disk and is lost when the site restarts.

What is public

A published page is public on purpose: your username is its address — and on a workspace account, the start of the address of every page under it — and anything you put on any of them can be read by anyone and indexed by search engines. Treat everything you publish as public. A draft is not published, and uploaded images are only visible to you until you publish them.

Your data

• Correct it — everything except your username is editable from the dashboard at any time.
• Withdraw it — unpublishing removes the generated page immediately.
• Delete it — deleting an account removes its record, images and page. There is no self-service button for this yet, so ask through the contact form and it will be done.
• Take it with you — ask and you can have a copy of your profile and images.

Backups of the site are kept so that a failure does not lose everybody's work. A deleted account can persist in those for a while before they rotate out.

Contact

Questions about any of this go through the contact form. A form rather than a published address, so the route to a person here is not also an address sitting on a public page being collected by everything that crawls it.