Privacy Policy

What we collect

• Account: email (and name/avatar if you sign in with Google), plus a password hash if you register with email.
• Contacts & scans: the fields you save, card photos you upload, and OCR/vision text we extract so you can review them.
• Usage counters: how many free cards you've used (per account).

How card images are processed

When you scan a card, the image is sent to a vision model (xAI Grok by default when configured) to read names, emails, phones, and similar fields. Processed images are stored so you can review and keep them with the contact. We do not sell your card photos or contact data.

Where data lives

Production data is stored in Turso (libSQL) and card photos in Vercel Blob. Sessions use Auth.js JWT cookies. Access is scoped to your signed-in account — other users cannot see your tray.

What we don't do

• We don't sell personal data.
• We don't run ads against your contacts.
• We don't share your tray with other Cardtray users.

Your choices

You can delete contacts (and their photos when unused), export CSV/vCard, and sign out anytime. To delete your whole account, email the operator from the address on your account — we'll remove your user row and associated contacts/scans.

Contact

Questions about privacy: use the email on your Cardtray account, or the project operator.