Privacy policy

Last updated October 6, 2026

We keep only what we need to run your designs and payments, and we never sell your data.

What we collect

• Account: your email address, whether it is verified, and your name if your login provides one. Sign-in is handled by Auth0.
• Buying without an account: the email you give Stripe at checkout and what you bought, so we can email your download links and add the purchase to your account if you later sign in with that same, verified email.
• Your designs: the card images you upload and the artwork, previews, and PDFs created for you.
• Purchases: what you bought, the amount, and Stripe reference numbers. Card details are entered on Stripe and never reach Cardscape.
• Shop cart: when you're signed in, the designs in your cart are saved so they're still there next time. When you're not, your cart is kept for this browser session only and joins your saved cart if you sign in. If you leave a signed-in cart or an unpaid checkout, we may email you a one-time discount code for it, but only if you bought from us in the last 2 years or turned on "Email me occasional discounts" in My designs. You can turn it off there anytime.
• Creator partners: if you join our creator program, your handle, contact email, code, and the sales and payouts made with your code, so we can pay your commission. Buyers who use a creator's code are counted, not named, to the creator.
• Instagram comments: when you comment on one of our posts, we keep the comment's id and the id Instagram gives our app for your account, so we answer once and send a free PDF link only once. The link itself is stored only as a one-way hash.
• Visit counts: a daily total of visits that came from our Instagram links. It's a plain count with no names or IP addresses attached.
• Abuse protection: a one-way hashed network identifier used to rate-limit access attempts. We do not store raw IP addresses.

How we use it. To sign you in, create and store your designs, deliver your downloads, handle payments, prevent abuse, and answer support requests. We do not sell your data or use it for advertising.

Who processes it

• OpenAI analyzes your uploaded card and generates the surrounding artwork.
• Stripe processes payments.
• Auth0 provides sign-in.
• Render hosts the app and stores files.
• Emails, such as a design you choose to email or a cart discount code, are sent through our email provider.

These providers may process data outside your country, including in the United States.

Pinterest. Cardscape uses the Pinterest API only to pin our own designs to our own Pinterest account (@cardscapeart) and to read our own boards so each pin lands on the right one. We don't collect, store, sell, or share any data about other Pinterest users. The account's Pinterest access keys stay on our server, are never shared, and are deleted as soon as we disconnect; we keep only a list of the pins we made (pin id, design, and date) so we don't pin the same design twice. Cardscape is not endorsed by or affiliated with Pinterest.

Cookies. We use only the cookies needed to keep you signed in and keep the app working, including one random browser-session id that holds your cart and lets you download what you just bought without an account. It is deleted when you close your browser.

How long we keep it. Your designs stay available in My designs so you can download them later. Purchase records are kept as required for accounting. You can ask us to delete your account and designs at any time.

Your choices. Message @cardscape.tcg on Instagram to access, correct, or delete your data, or to stop discount emails.

Data deletion

To have your data deleted, email support@cardscape.art from the address you sign in with, or message @cardscape.tcg on Instagram, and tell us what to delete. We delete your account, designs, uploads, saved cart, and any Instagram comment records tied to you within 30 days and confirm when it's done. Purchase records are kept only as long as accounting law requires.

Questions? Message @cardscape.tcg on Instagram.