Privacy Policy

Effective date: July 27, 2026. A Card Page is operated by Sandpiper Media Group.

What we store

  • Your email address, used to sign you in with a one-time code.
  • Your organization name and card content: name, title, company, bio, phone, custom fields, theme (including any custom theme CSS), and your business logo or avatar.
  • Contact details people submit through your card’s share-back form (and, in reverse, details you submit through others’ cards).
  • Card interaction events: views, QR scans, contact saves, and share-backs. Each is stored as an individual timestamped event, and some carry a short-lived random session identifier so the steps of a single visit can be counted together. Events are not tied to a visitor’s name or account, and they are deleted after 12 months.
  • Messages you send through the contact form, which are delivered to our support mailbox as email.
  • If you use “Import from Bluesky,” we fetch your public Bluesky profile (photo, display name, and bio) once and store what you import as part of your card. The handle is used only for that lookup; nothing is sent to Bluesky about you beyond the lookup itself.

What we don’t store

  • Passwords, unless you choose to set one. Sign-in works with a one-time email code.
  • Payment details. We don’t sell paid plans yet, so no payments are processed.
  • Advertising or cross-site tracking cookies. The only cookie we set is your session.

Where it lives

Data is stored with our hosting and database providers (Vercel and Supabase). Transactional email (such as sign-in codes and connection notifications) is sent through Resend, our email provider.

Analytics

Card analytics are first-party and cookieless: we record the card interaction events described above and show owners counts and trends. The session identifier lives only for the duration of a browser session and is not used to identify or track you across sites. We don’t use advertising trackers or third-party analytics on cards.

How long we keep it

  • Account, card, and contact data: for as long as your account exists.
  • Card interaction events: deleted automatically after 12 months.
  • Deleted accounts: removed from our active systems immediately; provider backups expire on their standard rotation.

What we don’t do

We don’t sell your personal information, and we don’t share it for cross-context advertising.

Your choices

You can export your contact book anytime, and you can delete your account and its data from Settings (Settings → Danger zone → Delete account) — this removes your cards, contacts, analytics events, and uploaded images. You can also email us to request deletion or an export. Questions or requests: hello@acard.page.

Changes

Material changes will be posted here with a new effective date.