Privacy notice · Updated 26 July 2026

Your data, explained

This notice explains what Cardify Games knows about you, why we need it, who helps us provide the service, how long we keep it, and the choices you have.

Who is responsible?

Cardify Games is the controller of personal data used to provide Cardify Games. Contact our privacy team at privacy@cardify.games.

Cardify is not affiliated with or endorsed by Sony Interactive Entertainment, Google, Discord or Microsoft.

What we use and why

Data	Purpose and source	Lawful basis	Retention
Name, email, avatar and sign-in provider ID	Received from Google, Discord or Microsoft to create, secure and display your Cardify account.	Contract; legitimate interests in account security	While your account is open, then deleted with it unless a legal exception applies.
Session token, IP address and browser information	Used to keep you signed in, prevent misuse and investigate security incidents.	Contract; legitimate interests in service security	Sessions expire after seven days. Security evidence is kept only as long as reasonably needed for an investigation.
Public gaming username, profile, games and trophy history	You give us a public username. We obtain the related public gaming data to build your Cardify collection and decide which packs you can open.	Contract	The connection and imported checklist are removed when you disconnect. Cards already created remain until you delete the Cardify account.
Cards, packs, collections, rewards and sharing choices	Used to operate your collection, reproduce cards and provide sharing links you request.	Contract	While your account is open. Revoked sharing links stop resolving; account deletion removes the linked product records.
Name, email, delivery address and order contents	Collected from you at checkout to arrange payment, make and deliver physical cards, handle returns and keep transaction records.	Contract; legal obligation for tax and accounting records	Normally up to six years after the transaction where accounting, tax, dispute or fraud-prevention obligations require it.
Messages and security reports	Used to answer support and rights requests and protect Cardify and its customers.	Legitimate interests; legal obligation where applicable	Only as long as needed to resolve and evidence the matter, normally no longer than two years.

Who receives the data?

Railway hosts the customer application and PostgreSQL database.
Cloudflare R2 stores immutable card and sharing images.
Google, Discord or Microsoft handles the sign-in option you choose. Cardify receives profile and account identifiers, not your password.
Games Service, our private factual-data service, looks up public gaming profiles and trophy information on Cardify's behalf.
Delivery, print, payment, professional or public authorities receive only what is necessary when those services are used or disclosure is legally required.

We do not sell personal data and do not use it for third-party advertising.

International transfers

Some technology and identity providers operate internationally. Where data is transferred outside the UK, we require an approved transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, as appropriate. Contact us for a copy or description of the relevant safeguards.

Your choices and rights

Access and export: signed-in customers can download a machine-readable JSON copy from Account.
Correction: correct your name, email or avatar with your sign-in provider; contact us for any Cardify record you cannot correct yourself.
Disconnect: remove a public gaming profile from Game accounts.
Erasure: delete an eligible Cardify account from Account, or ask us to assess records that must be retained.
You may also ask us to restrict or object to processing, or to provide portable data where the right applies.

Email privacy@cardify.games. We may need to verify your identity. We normally respond without undue delay and within one month.

Complaints

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office (ICO).

How this notice is maintained

We review this notice when the service, processors or law changes. Material changes will be brought to signed-in customers' attention. Cardify does not use solely automated decisions that produce legal or similarly significant effects.

The ICO explains the required privacy information in its right-to-be-informed guidance.