Privacy Policy

Last updated 12 October 2026

The short version

We collect what we need to run your account: your email, your cards and photos, and the sales and buyer details you choose to record.
On the Free plan your cards stay on your device. On Pro they're saved to your account so they sync between devices.
Payments go through Stripe. We never see or store your card number.
We don't sell your information, show ads or use tracking cookies.
You can ask us to delete your account and everything in it at any time.

Who we are

CardFlow (ABN 21 417 193 486) runs this website, which helps trading card sellers make listing images, write Facebook posts and track sales. In this policy "we", "us" and "our" mean CardFlow, and "you" means anyone who uses CardFlow.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you have a question, email us at coastaltechhelp@gmail.com.

What we collect

When you make an account

Your email address and the name you give us.
Your password. It's stored by our login provider in scrambled (hashed) form, so nobody, including us, can read it.
If you sign in with Google: your name, email address and profile picture from your Google account.

When you use CardFlow

Your cards: names, sets, numbers, rarities, conditions, descriptions, prices and the photos you take or upload.
Your sales: what sold, the price, payment and postage status, and notes.
Your buyers' details, if you choose to record them: name, Facebook profile link, email, phone number and postal address. See Information about your buyers below.
Your settings: shop name, currency, image style, post wording and postage options.
Card searches: searches for Pokémon cards run on your own device and aren't sent to us. Searches for Magic: The Gathering and Yu-Gi-Oh! cards send only the words you typed, through our server, to the free public card databases Scryfall and YGOPRODeck.

When you pay for Pro

Stripe handles the payment. We receive your Stripe customer and subscription IDs, your plan, and whether you've had a free trial. We never receive your full card number.

Automatically

Like any website, the services that host CardFlow see technical details when you visit, such as your IP address, browser type and the time of the request. They use these to deliver the site and protect it from abuse. We don't use analytics, advertising or tracking cookies.

Where your information is kept

Free plan: your cards, photos, sales and buyer details are saved in your browser on your device. They aren't sent to us. If you clear your browser data or lose the device, they're gone unless you've used Back up Vault.
Pro plan: the same information is saved to your CardFlow account so it syncs across your phone and computer. Your photos are stored privately and only your account can open them.

How we use it

To run your account and the features you use, including syncing and backups.
To take payment for Pro and manage your subscription.
To send emails you need, such as confirming your email address, resetting your password and payment receipts.
To answer you when you contact us.
To keep CardFlow secure and stop misuse.

We don't sell or rent your information, and we don't use it for advertising.

Services we use

We use a small number of trusted providers to run CardFlow. They only get what they need to do their job.

Provider	What for	Where
Supabase	Accounts, login emails, Pro cloud sync and photo storage	Sydney, Australia
Stripe	Payments and subscriptions	Australia and the United States
Cloudflare	Hosting the website	Global network, including Australia
Google	Google sign-in (if you use it) and the website's fonts	United States and worldwide
Scryfall, YGOPRODeck	Magic and Yu-Gi-Oh! card search (search words only)	United States

Some of these providers store or process information outside Australia. We choose providers that protect personal information to a standard similar to the Australian Privacy Principles.

Information about your buyers

If you record buyer details in CardFlow, you're responsible for that information. Only record what you need to complete the sale and post the card, keep it accurate, and delete it when you no longer need it. You can delete a sale, and the buyer details with it, at any time. We store this information for you and don't use it for anything else.

How long we keep it

We keep your account information for as long as your account is open. If you delete your account, we delete your cards, photos, sales and buyer details within 30 days. We keep payment records for as long as Australian tax law requires, usually five years.

Keeping it safe

Everything is sent over encrypted (HTTPS) connections. Each account can only read its own cards, sales and photos, and our database enforces this. Payment details are handled by Stripe and never touch our servers. No system is perfectly secure, so use a strong password that you don't use anywhere else.

Your choices and rights

See and change your information: most of it you can view and edit in CardFlow yourself.
Get a copy: use Back up Vault to download your cards, photos, sales and buyers, or ask us.
Delete your account: email us from your account's email address at coastaltechhelp@gmail.com and we'll delete it and everything in it. Cancel Pro first so you aren't charged again.
Shared devices: when you log out, CardFlow offers to remove your cards from that device.

Children

CardFlow is for people aged 18 and over, because Pro is a paid subscription and the app is for selling. Younger collectors can use it with a parent or guardian who manages the account.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use your information in a significant way, we'll tell you by email or in CardFlow before it takes effect.

Questions and complaints

Email coastaltechhelp@gmail.com. We'll reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.