What we collect, and what we don’t.
Plain language, no tricks. We collect what we need to send your cards and run the app — and nothing we’d be uncomfortable explaining to you here.
01 What we collect.
- Account. Your email, and your name if you add one — through email sign-in or, if you choose, Google / Apple.
- The cards you make. The card you pick and the message, recipient name, and sign-off you write — stored so the card can be delivered and kept in your Memories.
- Purchases. A record of credit packs you buy and your balance. Payment is handled by our payment processor; we receive a confirmation, never your full card number.
- Notifications. A device push token if you turn on reminders or in-app delivery.
- Light usage signals. Search terms typed into the card gallery and a coarse city/region (derived from network headers, not precise GPS) — used to understand which cards to make next.
02 What we don’t.
We don’t store your full payment-card number, we don’t sell your data, and we don’t run third-party advertising or cross-site ad tracking. We don’t collect precise GPS location.
03 How we use it.
To run ExpressoCards: deliver the cards you send, keep your Memories and replies, send the reminders you ask for, process credit purchases, prevent fraud and abuse, and decide which new cards to design. That’s it.
04 Who we share it with.
Only the service providers that help us run the app, acting on our instructions and under contract:
- Cloud hosting & database — to run the app and store your account and cards.
- Payment processing — to take credit purchases securely; the processor handles your card details, not us.
- Push-notification delivery — to send the reminders and alerts you turn on.
- Sign-in providers (Google / Apple) — only if you choose to sign in with them.
Some of these providers are based outside Canada (including the United States), so your information may be processed and stored there. We may also disclose information if the law requires it, or to protect people from harm.
05 Cookies.
We use a small number of essential cookies to keep you signed in and to remember an anonymous draft for a short while. No advertising or cross-site tracking cookies.
06 Keeping & deleting.
We keep your cards and account data for as long as your account is open. When you delete a card or close your account, we remove it from the live service; residual copies may sit in encrypted backups for a short period before they roll off. Purchase records may be retained longer where tax or accounting law requires.
07 Your rights.
Under Canada’s PIPEDA (and similar laws), you can ask to access, correct, or delete the personal information we hold about you, or withdraw consent. Email hello@expressocards.com and we’ll take care of it. You can also complain to the Office of the Privacy Commissioner of Canada.
08 Children.
ExpressoCards isn’t directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child has given us data, let us know and we’ll delete it.
09 Changes.
If we update this policy, we’ll change the date below and, for material changes, give account holders notice. Continued use after the effective date means you accept the update.
10 Contact.
Privacy questions or requests: hello@expressocards.com.