Your cards stay on the phone.

Cardfold is an app for keeping loyalty cards on Android; it is available on Google Play. There is no company with a support department behind it: it is written and looked after by one developer, and the address at the bottom of this page reaches that person directly.

Everything you put into a card stays in the phone's own storage: the shop name, the card number and its code format, the colour or the photo cover you picked, the category, an expiry date if you set one, and — if you pinned the card to a shop — a pair of coordinates. Your settings sit next to them: language, colour scheme, theme.

• Card data and settings — local storage on the device, private to the app

• Photo covers — a folder that belongs to the app, which other apps cannot read

• Nothing else — no copy of your cards is made anywhere, and uninstalling takes all of them with it

• No accounts — nothing to sign up for, no email address asked for, no profile

• No ads — no advertising SDK; the advertising ID is not collected, and nothing is used to personalise ads

• No sharing of your cards — your cards are not sold, rented or handed to anyone, in any form; they are not part of the statistics either

• No tracking in the background — with the app closed it does not follow your location or what you do; the only things that may happen are a local reminder you asked for and statistics already collected being sent once there is a connection

Android asks for each of these separately, and the app asks only at the moment it genuinely needs one. Refusing any of them leaves the rest of the app working.

• Camera — reads a barcode when you add a card. The frame is not saved and not sent anywhere. Without the permission you type the number in by hand.

• Photos — asked for only when you pick a cover. The image you choose is copied into the app's own folder; nothing else in your library is visible to the app.

• Location — asked for only if you tie a card to a place. The reading is taken while the card list is open, to put the card of the shop you are standing in on top. The coordinates you saved never leave the device.

• Notifications — used for the reminder about a card that is about to expire. The reminder is scheduled by the phone itself — there is no push server and no device token.

• Fingerprint or face — used by the app lock. The check is done by the operating system, which tells the app yes or no; your biometrics are never seen by it.

Four moments, and they can all be named:

• The map — a screen with a map on it — the place picker, and the sheet of a card that already has a place — loads the Leaflet library from cdnjs.cloudflare.com and map tiles from tile.openstreetmap.org. Those servers see your IP address and the piece of the map being drawn, as any website would. They never receive your cards, and the requests stop when you leave the screen.

• A purchase — at every launch the app asks Google Play whether the Pro purchase exists: that is how it comes back by itself after a reinstall, and how a payment interrupted halfway is carried to the end. Buying happens in the same place. Google takes the payment and tells the app one thing: whether the purchase exists. Payment details are never seen by the app.

• The store page — the review button opens Google Play, where Google's own terms take over. The app may also offer to rate it — through Google Play's own dialog over the screen; neither the rating nor a dismissal is reported back to the app.

• Statistics — usage statistics and crash reports go to Google Firebase, run by Google — what exactly is in them is described in the next section. Without a connection they wait on the phone and are sent when one appears.

That is the entire list. Adding, showing, editing and sorting cards work in airplane mode.

The app uses two Google Firebase services, so that crashes get found and fixed and the next version is shaped by what people actually use. Google processes this data on our behalf, under the Google Analytics and Firebase terms. It is part of how the app works and cannot be switched off inside it.

• Google Analytics for Firebase — the screens you open and a few actions: adding a card (whether it was scanned or typed, and the barcode format — never the number), opening the Pro screen, exporting or importing a backup, the Pro purchase. Alongside them: app version, language, device model, Android version, a random app-instance identifier created on install, and the country or region Google works out from the IP address, which Google Analytics does not store.

• Firebase Crashlytics — when the app crashes or hits a serious error: where in the code it happened, the state of the app at that moment, device model, Android version, free memory and disk space, and a random installation identifier.

• Never sent — shop names, card numbers and barcodes, covers, saved places, categories, expiry dates, your backup, your name or email, the advertising ID.

• How long it is kept — analytics events for up to 14 months, crash reports for 90 days; after that Google deletes them.

• Why — to keep the app working and make it better — our legitimate interest. Nothing from it is used for advertising, sold, or combined with other data about you.

Export writes your cards, categories and covers into a single JSON file and hands it to the system share sheet. From that moment it is an ordinary document: where it goes and who can open it is entirely your decision. The file is not encrypted, so it deserves the care you would give a photograph of your cards.

Cardfold Pro is a one-time purchase, processed by Google Play. The app itself keeps a single flag saying that it is unlocked. Restoring the purchase on another device is a question asked of the store, not of us — no record of who bought what exists on our side, because there is no side.

Uninstalling the app removes the cards, the covers and the settings along with it. There is no copy of your cards anywhere else. Statistics and crash reports already sent are tied only to a random identifier, not to you, so they cannot be picked out and are deleted by Google when the period above runs out; a reinstall starts with a new identifier. The one thing that outlives the uninstall is the Pro purchase: it belongs to the Google account that made it, and comes back when you restore it.

If this policy changes, the date at the top of the page changes with it, and anything that actually affects you is mentioned in the release notes on Google Play. Questions about privacy — or about anything else in the app — are welcome at the address below.