Privacy Policy

1. Who We Are

CardAgain is operated by Triple Dynamic Solutions LLC, a limited liability company organized under the laws of the State of Illinois, United States ("we", "our", or "us"). We are the data controller responsible for the personal information described in this Policy.

Email: support@cardagain.me

This Policy explains what we collect, why we collect it, who we share it with, how long we keep it, and the choices you have. It applies to the CardAgain mobile application and to cardagain.me.

2. Information We Collect

Information you give us directly:

• Account information — your name, email address, and profile photo, received from Google or Apple when you sign in. If you use Sign in with Apple and choose to hide your email, we only ever receive Apple's private relay address.
• Card content — titles, messages, notes, photographs, videos, dates, sender names and occasions that you add to your cards.
• Voice recordings — audio you record or upload, including recordings used to create a cloned voice. See Section 3, which governs this category specifically.
• Calendar events — only the events you choose to import, and only if you grant calendar permission.
• Support messages — the content of messages you send us, and the account they came from.
• Reports and blocks — if you report a shared card, we record what you reported, the reason you gave, and who shared it. If you block someone, we record that you blocked them.

Information we receive automatically:

• Subscription status — your current plan, renewal date and purchase history, received from Apple through RevenueCat. We never receive your payment card details.
• Technical data — the app version at the moment you give voice consent, recorded as part of that consent record, and, if you turn on notifications, your device’s push token and platform so we can deliver them.

We do not collect crash reports, analytics or usage statistics: the app contains no analytics or crash-reporting software. We do not use advertising identifiers, we do not track you across other companies’ apps or websites, and we do not build advertising profiles.

3. Biometric Information — Voice Cloning

This section is a notice required by the Illinois Biometric Information Privacy Act (740 ILCS 14) and comparable laws in Texas and Washington. Please read it before using the voice cloning feature.

• What we collect. If you choose to create a cloned voice, we collect an audio recording of a human voice and our provider derives from it a "voiceprint" — a mathematical representation of the vocal characteristics in that recording. A voiceprint is a biometric identifier.
• Why we collect it. Solely to generate spoken readings of the card messages inside your own account. We do not use voiceprints for identification, authentication, security screening, profiling or any form of surveillance.
• Consent. We collect a voiceprint only after you affirmatively consent in the app. If the voice belongs to someone other than you, you must obtain that person’s informed written consent before recording them, and you confirm in the app that you have done so. Do not clone anyone’s voice without their permission.
• Who receives it. Voice recordings are transmitted to ElevenLabs, Inc. (United States), which performs the cloning and speech generation on our behalf under a written contract. They may not use your recordings to train their own models for other customers, and they may not sell or otherwise disclose them.
• We never sell, lease, trade or profit from biometric identifiers. We disclose them only to the processor named above, only to deliver the feature you asked for.
• Retention schedule. We keep a voiceprint until whichever of these happens first: (a) you delete the voice in the app; (b) you delete your account; (c) the purpose for collecting it is satisfied; or (d) three years after your last interaction with us. When any of those occurs we permanently destroy the voiceprint and the underlying recording, including instructing ElevenLabs to delete their copy.
• Your control. You can delete any cloned voice at any time from the Voice Library. Deleting your account destroys every voiceprint and recording associated with it.

4. How We Use Your Information, and Our Legal Basis

If you are in the European Economic Area or the United Kingdom, the table below is our legal basis under Article 6 (and, for voice data, Article 9) of the GDPR.

• To provide the app, store your cards and sync them across your devices — performance of our contract with you.
• To create and play cloned voices — your explicit consent, which you may withdraw at any time by deleting the voice.
• To process subscriptions and manage your plan — performance of our contract with you.
• To send reminders and notifications you have turned on — your consent.
• To answer support requests — performance of our contract, and our legitimate interest in supporting our users.
• To detect fraud, abuse and rate-limit violations, and to keep the service secure — our legitimate interest in protecting the service and its users.
• To review reports of objectionable content and act on them — our legitimate interest in keeping the service safe for the people who use it.
• To comply with tax, accounting and other legal obligations — compliance with a legal obligation.

We do not use your card content, photographs or voice recordings to train artificial intelligence models.

5. How We Share Information

We share personal information only with the service providers below, each of which processes it on our instructions under a written contract, and only to the extent needed to run the app:

• Supabase, Inc. — database, authentication and file storage (United States).
• ElevenLabs, Inc. — AI voice cloning and speech generation (United States). See Section 3.
• RevenueCat, Inc. — subscription status management (United States).
• Apple Inc. — App Store payment processing, Sign in with Apple, push notification delivery.
• Google LLC — Google Sign-In, and on-device text recognition for card scanning.

We may also disclose information if required by law, subpoena or court order; to establish or defend legal claims; or, if we are ever involved in a merger or sale of assets, to the acquiring entity, in which case we will notify you before your information becomes subject to a different policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

6. Data Storage and Security

Your data is stored on infrastructure operated by Supabase. Protections include:

• Encryption in transit (TLS) and encryption at rest.
• Row Level Security, so database queries can only ever return rows belonging to your own account.
• Media stored in per-account paths with scoped access controls.
• Authentication tokens held in the iOS Keychain on your device, not in general app storage.

No system is perfectly secure. We cannot guarantee absolute security, but if a breach affects your personal information we will notify you and the relevant regulators as required by law.

7. International Transfers

We are based in the United States and our service providers process data there. If you use the app from the European Economic Area, the United Kingdom or Switzerland, your personal information is transferred to the United States.

These transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), which we have in place with our processors, together with supplementary technical measures including encryption in transit and at rest. You may request a copy of the relevant transfer mechanism by writing to us.

8. Card Sharing

When you share a card, we generate a share link containing a random code. Anyone holding that link can view the card and save a copy until the link expires. Only the card content you selected is shared — your email address and account details are not disclosed to recipients. Choose carefully who you send share links to, and be aware that a recipient who saves a copy keeps that copy even if you later delete the original.

9. Calendar Access

If you grant calendar permission, we read events from your device calendar so they can be shown alongside your card dates, and we store the events you import in your account so they appear on your other devices. We never modify or delete anything in your device calendar. You can revoke calendar permission at any time in the iOS Settings app.

10. How Long We Keep Your Information

• Account information, cards and media — for as long as your account is open. Deleted immediately when you delete your account.
• Voice recordings and voiceprints — as set out in the retention schedule in Section 3.
• Support messages — up to 24 months after the request is resolved, so we can follow up on recurring issues. If you delete your account while a request is open, the message is kept for that period but no longer identifies you.
• Reports of objectionable content — up to 24 months after the report is resolved, so repeat offenders can be recognised. A report is kept even if the person who filed it deletes their account, but it no longer identifies them.
• Purchase and subscription records — up to 7 years where we must retain them for tax and accounting purposes. These are held by Apple and RevenueCat; the record identifies a transaction, not your card content.
• Backups — deleted data may persist in encrypted backups for up to 30 days before being overwritten.

You can delete your account at any time from Profile → Delete Account. Doing so permanently erases your cards, photographs, videos, voice recordings, voiceprints, calendar imports and profile. It cannot be undone, and we cannot recover the data afterwards.

11. Your Privacy Rights

Wherever you live, you can access, correct, export or delete your data — most of it directly in the app, and the rest by writing to us.

If you are in the EEA or the UK, you have the right to: access your personal data; have inaccurate data corrected; have your data erased; restrict or object to processing; receive your data in a portable format; and withdraw consent at any time without affecting processing already carried out. You also have the right to lodge a complaint with your national supervisory authority, or with the UK Information Commissioner’s Office.

If you are a California resident, you have the right to know the categories and specific pieces of personal information we have collected, the sources, and the purposes; the right to delete it; the right to correct it; and the right not to be discriminated against for exercising any of these rights. We do not sell or share personal information, so there is nothing to opt out of. The categories we collect are identifiers, customer records, commercial information, internet activity, and biometric information (voiceprints, only if you use voice cloning) — all as described in Section 2.

To exercise any right, use Settings → Contact Us, or email support@cardagain.me. We will verify your request against your account and respond within 30 days (45 days in California, where we may extend once with notice). You may use an authorised agent. Exercising these rights is free.

12. Children’s Privacy

CardAgain is not directed to children. You must be at least 13 years old to create an account, and at least 16 if you are in the European Economic Area or the United Kingdom. We do not knowingly collect personal information from anyone below those ages. If you believe a child has provided us with personal information, contact us and we will delete the account and its data promptly.

13. Changes to This Policy

We may update this Policy. When we make a material change, we will update the date at the top, post the revised Policy in the app and at cardagain.me/privacy, and — where the law requires it — ask for your consent again before the change applies to you. Continued use after a change takes effect means you accept the revised Policy.

14. Contact Us

Questions, requests or complaints about this Policy or your personal information:

Triple Dynamic Solutions LLC

support@cardagain.me

You can also reach us from Settings → Contact Us in the app.