Privacy

This is the important part, so it comes first. CardVeda records the variant of a card — for example “HDFC Bank Infinia” — and nothing that could be used to transact.

• No card numbers, in full or in part.
• No CVV, no expiry date, no PIN, no name as printed on the card.
• No statements, transactions, balances or credit limits.
• No bank login, and no connection to your bank. CardVeda is not linked to any account.
• No credit bureau data, and no credit score.

The database rules enforce this rather than trusting the app: any attempt to write a field named number, cardNumber, cvv or expiry to your card list is refused outright.

• Your account: your email address, your display name and photo if your sign-in provider supplies them, and the dates you signed up and were last active.
• Your cards: which catalog cards you said you hold, plus any fee or lifetime-free correction you entered. For a card not in the catalog, the name, bank, network and tier you typed.
• Your sharing: who you invited, who accepted, and whether a share is active or revoked.
• Preferences: your priority categories and rough monthly spend per category. These stay in your own browser and are never uploaded.

Only you, and anyone you explicitly invite. A person you invite sees which cards you hold and what those cards offer. They cannot see your email preferences, your spend figures, or anything you typed that is not part of a card.

You can revoke a share at any time from the sharing page. Access ends immediately.

• Google Firebase (Google LLC) for sign-in and the database. If you sign in with Google, Google confirms your identity to CardVeda; CardVeda never receives your Google password.
• Cloudflare hosts the small service that sends your sign-up code and your invite emails.
• Brevo (Sendinblue SAS, France) delivers those emails. It receives the recipient address and the message.
• Firebase Analytics records anonymous usage events, such as that a recommendation panel was opened. It is not tied to your card list, and it is disabled if your browser blocks it.

Your data is stored in Google’s asia-south1 region (Mumbai). CardVeda does not sell your data, and does not use it for advertising.

Removing a card deletes it immediately. To delete your whole account, email the address on the contact page from your registered address, and the account, your card list and every share attached to it will be removed.

CardVeda sets no advertising or tracking cookies. Firebase stores a sign-in token in your browser so you are not signed out on every visit, and your display preferences are kept in local storage on your own device.

If this policy changes in a way that affects what is stored or who can see it, the date above changes and the change is described here. Questions go to the contact page.