Privacy
Everything we store fits on this page.
There are eight purpose-built tables behind this site. This page says what goes into them, what stays only on your phone, and why each record exists.
This is a plain-language summary of how the site actually works. It is not legal advice and it is not a compliance certificate — see the section on rights and requests below.
Browsing stores nothing
Searching the index creates no D1 record of you. Your search text is sent to our server, which asks the Collector Crypt API and returns the results — it is not written to our database. If a search fails, the query text is written to our server error log so we can see what broke; that log entry carries no email, device id, or name.
Optional sign-in is handled by Privy, which may create an embedded Ethereum wallet for that account. Avatar name, appearance, and equipment stay in this browser. The records written to D1 come from a drop claim, the postal address you give after winning one, a spot suggestion, a quote request, a community vote, or a proposed ballot location; notifications and rate-limit counters support those actions.
1. When you claim a drop
| Stored | Why |
|---|---|
| Claim id and drop id | The first eight characters of the claim id are your receipt. The drop id records which drop the claim belongs to. |
| Email address | To send the pickup receipt, and to enforce one claim per person per drop. Lowercased before it is saved. |
| Device id | A random identifier your own browser generates and keeps in local storage under the key cardsgo-device. It is not a fingerprint, it is tied to no account, and clearing your site data makes a new one. |
| Latitude, longitude and accuracy | One coordinate — the median of the readings taken during the check — used to confirm you were inside the drop radius, and as the starting point for the travel-speed check on your next claim. |
| A six-digit pickup code | So the host at the location can validate the pass once, and only once. |
| A digest of a private claim-management key | The winning browser keeps the actual key with its receipt in local storage. The server stores only its SHA-256 digest. The key can manage the shipping address but is never shown to the drop host; the six-digit pickup code cannot read an address. |
| Status, created time, expiry time | To expire an unclaimed pass after fifteen minutes and to apply the two-hour cooldown between claims. |
The individual GPS readings are not stored. Neither is the device-motion measurement — it is checked in memory to see whether the phone moved like a phone, then discarded with the request. Location is used for the presence check and the reachability check, and for nothing else. It is never used to advertise to you, build a movement history, or work out where you live.
A claim collects no postal address. Nothing on the claim form asks for one and nothing in the claim record holds one — that question is asked afterwards, of the person who won, and it is the next section.
2. When you give us a postal address
If you win a card we need somewhere to send it, and that is the only reason this table exists. You are asked once the claim has been accepted — never during it and never before — because only the person who actually won should be asked for a home address at all. A practice run is never asked: nothing ships, so there is nothing to hold.
| Stored | Why |
|---|---|
| Recipient name, one or two address lines, town or city, and country | The four things every address on earth has. They are stored exactly as typed; nothing is capitalised, reformatted, or checked against a postal database on your behalf. |
| Region or province, and postal code | Required for the United States and Canada, where both are needed to route reliably; optional where a country may have neither. The United Arab Emirates and Hong Kong issue no postal code at all, and Ireland’s reaches only some addresses in practice. |
| The claim it belongs to | So the right parcel goes to the right door. It is attached to one claim rather than to you as a person — there is no account record here to attach it to. |
| Which proof was accepted, and when | The winning browser supplied its private claim-management key. If a parcel ever goes to the wrong door, this is how we can say who changed the address and how they showed it was theirs to change. |
| Previous versions, kept rather than overwritten | People mistype their own street, and by the time you notice, a label may already have been printed from the old one. So a correction writes a new row and marks the old one replaced instead of erasing it. |
| A status alert that says an address is ready | The alert contains the claim and its state, but never the street address. It tells the operator to sign in to the protected operator view and read the current address there immediately before fulfilment. That prevents old addresses lingering in mailboxes after a correction or deletion. |
Exactly two parties can read it back or change it: the winning browser and us. The browser must present the eight-character receipt together with its private claim-management key. Typing an email address or signing in with one is not accepted as proof: the claim form did not verify that email, and a typo must not expose a winner’s home address to an unrelated mailbox owner. The six-digit pickup code is deliberately not accepted either: you show it to the drop host, and showing a pass must not show someone your home address or let them redirect a parcel.
Who else sees it. An address is shared to get the parcel to you: with Collector Crypt and the vault holding the card, who post it, and with the courier that carries it. Before that it is read by whoever at Cards Go prepares the parcel, on the protected operator page listing recent claims. A status alert may travel by email, but it never contains the postal address. Beyond fulfilment, nowhere: it is not published, it is not sold, and it is used for nothing but posting a card. Today that sharing has never happened — no card has been bought, redeemed or shipped by Cards Go, so no address has yet been given to anybody.
3. When you suggest a spot
| Stored | Why |
|---|---|
| Venue or pickup point, and city | To find and vet the place. Both are required. |
| Notes | Optional. Whatever you write about access, staff or timing. |
| Contact | Optional and free-form — an email or a social handle, whatever you choose to type. If you leave it blank the suggestion is anonymous to us. |
| Coordinates, status, created time | Coordinates only if the suggestion form supplies them for the place you named. Status tracks whether we have reviewed it. |
4. If you request a quote
This form is not on the site today. The table and the endpoint behind it still exist, so here is what they hold if it comes back.
| Stored | Why |
|---|---|
| Email address | To send the estimate and, later, a private checkout invitation. |
| Destination region | One of five broad regions — United States, Canada, Europe, Australia and New Zealand, or rest of world. A quote is priced from the region alone; it never asks for a street address. |
| The listing you asked about | Its name, category, type, marketplace asset address, the chain it sits on, its listing id and its certification number. This is public information about a card, not about you. |
| The quote figures | Listing price, shipping estimate, the proposed service fee and reward budget, the two estimate totals, and the currency — kept with the request key your browser sent, so repeating a request returns the same answer instead of a new one. |
| Status, quote expiry, created time | Quotes expire ten minutes after they are issued. |
5. When you vote or propose a location
| Stored | Why |
|---|---|
| Round, poll, choice, and timestamps | To count the ballot and let you change your choice while the round is open. |
| One-way account digest | To enforce one choice per verified account in each poll. It is derived from the signed-in account id; the raw id, email, and wallet address are not stored with the vote. |
| Public place name and exact coordinates | Only when you deliberately propose a map pin and confirm that it is a public place. The name, exact pin, and aggregate vote count are visible to everyone using the ballot. |
A location proposal is limited to one per verified account in a round. Other voters see the proposal, not who placed it. Community voting is advisory: it does not move treasury funds, buy a card, or publish a live drop.
What we never collect
- No Cards Go password. Privy handles optional sign-in credentials.
- No payment-card details, wallet private key, or seed phrase. The app can display a public embedded-wallet address and a read-only public treasury balance, but voting cannot sign or send a transaction.
- No street address, unless you have won a card and given us one to post it to. Nothing else on the site asks for an address: not browsing, not signing in, not claiming, not voting. What that one record holds is section 2 above.
- No identity documents, no photographs, no contacts, no browsing history.
These tables are in Cloudflare D1, the SQLite database attached to this site, and the site itself runs on Cloudflare. Cloudflare processes the request in order to serve it, in the same way any host sees the traffic it delivers.
What your browser talks to
Card images are loaded straight from the marketplace image servers rather than copied onto ours, and the map page loads its tiles from tiles.openfreemap.org. Those servers see your IP address and the file you requested, exactly as they would if you visited them directly. Marketplace searches do not work that way — they go through our server, so the marketplace sees our request, not yours.
What is public
The claim ledger publishes the first eight characters of a claim id, the drop it belongs to, the item, the category, the status and the timestamps. It never publishes an email address, a device id, a coordinate, a pickup code or a postal address, and it never will.
The community ballot publishes aggregate vote counts. A location you propose publishes the place name and exact coordinates after you confirm that disclosure. It never publishes the account digest or ties a named voter, email address, or wallet address to a choice.
There are no ad networks, tracking pixels, session recorders or analytics scripts on this site today, and no advertising or analytics cookies are set. We do not sell your data, rent it, or share it for marketing. If any of that changes, this page changes first and the date at the top moves.
How long we keep it
Honestly: there is no automatic deletion schedule yet. Claim, address, suggestion, quote, notification, vote, and location-proposal rows stay in the database until you remove an address, ask us to remove the rest, or until we clear the pilot data. When a retention period is set, it will be written here.
Email hello@cardsgo.app to request a copy or deletion. We will require the private claim-management key or another verification process appropriate to the data before disclosing or deleting anything; the public eight-character receipt alone is never enough. A postal address can also be deleted immediately from its address panel, without touching the claim it belongs to — every version of it, including the ones a correction replaced. Once a parcel has been handed to a courier we cannot take the address back out of their system, only out of ours. Operator status alerts never contain the street address.
Your rights, described honestly
We are not claiming GDPR or CCPA compliance, and it would be easy but wrong to paste that claim here. What we can tell you is the practice: the data set is small and listed above, you can ask for a copy of it or have it deleted by email, we do not sell it, and we do not send it anywhere except the third parties named on this page. If you are somewhere that gives you stronger statutory rights, write to us and we will do our best to meet them.
The site is not aimed at children. If a claim comes from someone under 18 and we are told, we will delete it.
Changes, and how to reach us
Any change to what we store will show up on this page with a new date at the top. For anything at all — a question, a deletion request, or a correction to something here that is wrong — write to hello@cardsgo.app. The rules for using the site are on the terms page.