DRAFT for lawyer review. Placeholders in [brackets] must be filled in before launch.
The short version
Your cards stay in your browser unless you are a member using cloud save. We don't receive them otherwise.
With an account we keep what we need to run it: your email, a scrambled (hashed) password, your purchases,
your AI image balance, and a record of what you agreed to.
No ads, no trackers, no selling of data. The only cookie keeps you signed in.
What we collect and why
Account: email address, hashed password, sign-up date, email confirmation. To run your account.
Agreements: which Terms, Content Guidelines and Privacy Policy versions you accepted, when, and the IP
address and browser used. To prove what you agreed to.
Purchases: what you bought, amounts, dates and Stripe references. Card details go straight to Stripe
and never reach us. To provide what you paid for and to keep tax and accounting records.
Cloud save (members): your projects and the images and fonts they use. Only to store them for you.
AI art: your prompts, the images generated, and our content checks' results. Prompts are kept for
up to 30 days and blocked prompts for up to 90 days to prevent abuse; generated images are kept on our
servers for about 7 days so you can download them again.
Technical logs: IP address, browser and request times, kept up to 30 days for security.
Error reports: when something breaks in the editor, your browser sends us the error message, the page,
the app version and your browser type (and your account, if you're signed in). We remove web addresses'
query parts, email addresses and long codes first. Kept up to 90 days, only to find and fix bugs.
Who processes data for us
Stripe: payments.
OpenAI: generates AI images and checks prompts and images for our content rules. OpenAI does not use
API data to train its models by default and keeps it for up to 30 days for abuse monitoring.
Our email hosting provider: sends account emails and holds our support mailbox.
[Hosting provider]: runs the servers.
Child safety
CardGlyph is not for children under 13, and accounts are for people 18 and older. If we become aware of child
sexual abuse material, US law requires us to report it to the National Center for Missing & Exploited
Children and to preserve it for one year.
Your choices and rights
See your data: Account → Download my data.
Delete your account: Account → Delete account. Cloud projects are removed; payment and agreement
records are kept as the law requires.
Depending on where you live (for example California or the EU/UK) you may have further rights to access,
correct or delete data. Contact [email protected].
Cookies
One cookie keeps you signed in. The editor also stores your work in your browser's own storage. There are no
advertising or analytics cookies.
Contact
ENGRAIN AI LLC (CardGlyph), [postal address]. Privacy questions: [email protected].