Privacy Policy

Effective Date: July 26, 2026. Version 2026-07-26.

Code Blanket LLC, a Michigan limited liability company, doing business as Kardcore ("Kardcore", "we", "us"), operates the Kardcore platform at kardcore.app (the "Service"). This Privacy Policy explains how we collect, use, share, and protect personal information when you use the Service, and your rights over that information. By using the Service, you agree to this Privacy Policy.

1. Information We Collect

1.1 Information You Provide

• Account information: email address, display name, and password (stored only as a salted hash — we never store your plain-text password).
• Billing information: handled by our payment processor, Stripe. Full payment card details are sent directly to Stripe and never touch our servers; we retain only subscription status and transaction references.
• Content: card collections, decks, wishlists, trade binders, trade offers, match records, posts, comments, likes, uploaded images, and other material you create in the Service.
• Communications: messages you send us by email or through support channels.

1.2 Information Collected Automatically

• Usage data: features used, actions taken, and similar interaction data.
• Device and technical data: IP address, browser type, operating system, language, and time zone.
• Log data: server logs with access times, request URLs, and error information, used for security and diagnostics.

1.3 From Third Parties

We receive transaction confirmations and billing status from Stripe. We do not purchase personal information from data brokers.

2. How We Use Your Information

We use your information to provide and operate the Service; authenticate and secure your Account; process payments and manage subscriptions; power the features you use, including sharing your posts, trade binders, and trade offers with other users where you choose to share them; send transactional emails (such as password resets); respond to support requests; detect and prevent fraud, abuse, and violations of our Terms and Acceptable Use Policy; comply with legal obligations; and improve the Service.

We do not use your Content for advertising, we do not sell your personal information, and we do not use your Content to train third-party AI models.

3. Legal Bases for Processing (EEA, UK, Switzerland)

If you are in the European Economic Area, United Kingdom, or Switzerland, we process your personal data on these legal bases: contractual necessity (providing the Service and processing payments); legitimate interests (operating, securing, and improving the Service and preventing abuse, where not overridden by your rights); consent, where required (which you may withdraw at any time); and legal obligation.

4. How We Share Information

We do not sell your personal information. We share information only with:

• Service providers: Stripe for payments, our hosting provider for servers and storage, and our email provider for transactional messages. These providers process your information only on our instructions.
• Other users: information you choose to share — your display name, posts, comments, likes, match records with other participants, trade binder contents visible through matching, and trade offers you send.
• Legal and safety: where we believe in good faith that disclosure is necessary to comply with law or legal process, enforce our Terms, prevent fraud or abuse, or protect the rights, property, or safety of Code Blanket LLC, our users, or the public.
• Business transfers: if we are involved in a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction, and we will notify you.
• Aggregated or de-identified data that cannot reasonably identify you.

5. International Data Transfers

We are based in the United States and process data in the United States. For transfers of personal data from the EEA, UK, or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact us for more information.

6. Data Retention

• Account data and Content are retained while your Account is active.
• When you delete your Account, your account data and Content are deleted from our production systems promptly (typically within 30 days), and residual copies in backups are purged in normal rotation (typically within 90 days).
• Billing records are retained as required by tax and accounting law (typically up to 7 years).
• Server logs and security data are retained for short operational periods.
• We may retain limited information longer where required by law, to resolve disputes, or to enforce our agreements.

7. Your Rights, Including Full Deletion

7.1 Everyone

• Access and correction: view and edit your profile and Content in the Service, or contact us for a copy of the personal information we hold about you.
• Export: export your Content using the export tools in the Service.
• Full deletion: you may permanently delete your Account and all associated data at any time through your Account settings. This removes your profile, collections, decks, wishlists, trade binders, posts, uploaded images, and other personal data from our production systems, cancels any active subscription, and cannot be undone. Records other users need for their own history (for example, a shared match) are anonymized rather than attributed to you.

7.2 EEA, UK, and Swiss Residents

You additionally have the rights to restrict or object to certain processing, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority.

7.3 California Residents

Under the CCPA/CPRA you may have rights to know, access, correct, and delete personal information, to opt out of "sale" or "sharing" (we do not sell or share personal information as defined by the CCPA), and to non-discrimination for exercising your rights. You may designate an authorized agent.

7.4 Other Jurisdictions

If you are in another jurisdiction with similar laws (for example, other U.S. states, Brazil, or Canada), you may have analogous rights. Contact us to exercise them.

To exercise any right, use the tools in the Service or email support@kardcore.com. We may need to verify your identity and will respond within the timeframe required by applicable law (typically 30 to 45 days).

8. Data Security

We use reasonable safeguards designed to protect your information, including encryption in transit (HTTPS/TLS), hashed password storage, access controls, and routine backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password and tell us immediately if you suspect unauthorized access. If we become aware of a personal data breach that materially affects you, we will notify you and any required authorities in accordance with applicable law.

9. Cookies and Local Storage

The Service uses only what is needed to run: an authentication token stored in your browser to keep you signed in, and essential preferences. We do not use advertising cookies or third-party ad trackers. Clearing your browser storage signs you out. We do not currently respond to "Do Not Track" signals, as there is no industry-standard interpretation.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us personal information, contact support@kardcore.com and we will delete it.

11. Third-Party Services and Links

Card data and images are sourced from third-party services (including Scryfall, TCGdex, and YGOPRODeck), and community feeds may link to third-party sites. Their practices are governed by their own policies, and we are not responsible for them.

12. Changes to This Policy

We may update this Privacy Policy. For material changes, we will notify you by email or through the Service before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

Code Blanket LLC d/b/a Kardcore Email: support@kardcore.com