Effective from:
Cardy is a collector platform for searching and tracking trading card game (TCG) collections. This policy explains what personal data we process, why, how long we keep it, and what rights you can exercise. It applies to every user of the service.
The data controller is Rocco Gallo. For anything concerning your personal data, including exercising the rights described below, write to support@cardy.pro.
Account data: email, display name, username, optional bio and profile image, country. Collection data: the cards you add, with the quantity, condition and language you declare. Technical data: IP address and the logs needed to run and secure the service. We do not process special categories of data, and we carry out no profiling or automated decision-making.
The scanning feature (/scan) uses your device's camera only while the scanning page is open, and only after you grant permission in your browser. When you press the shutter, the photo you just took is sent to our servers to identify the card. It is processed in memory only: it is never written to disk or to storage, never added to your account or any other record, never used to train any model, and is discarded as soon as the response is sent. Only the resulting catalogue match is kept. No other photo or camera data is transmitted, and the camera is not read except while you are on the scanning page. You can revoke camera permission at any time in your browser settings.
We process your data to: (a) provide the service (running your account and your collection) on the basis of performance of the contract (art. 6(1)(b) GDPR); (b) send you the price alerts and notifications you configure, again on a contractual basis; (c) meet any applicable accounting and legal obligations, on the basis of legal obligation (art. 6(1)(c) GDPR); (d) prevent fraud and abuse, keep the platform secure and establish or defend legal claims, on the basis of legitimate interest (art. 6(1)(f) GDPR). If we introduce promotional messages or analytics in future, we will do so only with your prior consent, which you may withdraw at any time.
Some data is visible to other users, and you should be aware of it. Your username, profile image and the reviews you receive are public. Your collection is visible to others only if you choose to make it public in your settings: until you do, it stays private.
We use providers that process data on our behalf as processors, bound by appropriate agreements: Neon for the database and authentication, Cloudflare R2 for image storage, Vercel for application hosting. Some of these providers are based in the United States: those transfers rely on the safeguards in Chapter V GDPR, namely an adequacy decision or standard contractual clauses approved by the European Commission. We do not sell your personal data and do not pass it to third parties for marketing purposes.
We keep your account and collection data for as long as your account exists. If you delete your account, identifying data is erased or anonymised without undue delay. Technical logs are kept for a limited period, no longer than twelve months.
You can delete your account at any time from your profile settings. Deletion erases or anonymises your identifying data without undue delay.
You may at any time request access to your data (art. 15), rectification of anything inaccurate (art. 16), erasure (art. 17), restriction of processing (art. 18) and portability in a machine-readable format (art. 20). You may also object to processing based on legitimate interest (art. 21). For access and portability you need not even write to us: you can download a file with all your data straight from your profile settings. For anything else, write to support@cardy.pro and we will respond within one month.
If you believe our processing breaches data protection law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority in the EU country where you live. You may also bring the matter before the courts.
Cardy uses only the technical cookies needed to keep you signed in and to keep the service secure. We use no profiling cookies, no analytics, and no advertising pixels, which is why you see no consent banner. If we ever introduce such tools, we will ask for your consent first and update this policy.
If we change this policy, we will update the effective date shown at the top of the page. Where changes are substantial, we will tell you in the app or by email before they take effect.
For questions about this policy or to exercise your rights, write to support@cardy.pro. For general help with the service, write to support@cardy.pro instead.