Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Sascha Leineweber – Cardletics
Freelancer
Oppenheimer Str. 26
55130 Mainz
Germany
Email: datenschutz@cardletics.com

This Privacy Policy applies to the website at www.cardletics.com and to the mobile app Cardletics.

It explains which personal data we process, for which purposes, on which legal basis, and which rights are available to you.

Depending on how you use Cardletics, we may process in particular the following data:

• Account data: email address, username, internal user ID, registration time, login method (for example email, Apple or Google), authentication status and technical account data.
• Profile data: avatar or profile picture, selected background, username, Cardletics-internal progress values, Card Points, Coins, showcase card, marketplace-related status data, friend/visibility settings and a coarse two-letter country code derived from the device region setting (for example DE). This country code is not derived from GPS or IP location data.
• Game and inventory data: cards, card condition, card series, rarities, pack and Boost Pack data, activity, promo and set stamps including gameplay-related metadata stored for a stamp, backgrounds, inventory status, trading status, internal price information, transaction and progress data.
• Administrative correction and support data: if authorised administrators review, rebuild, set or remove card stamps for troubleshooting or in response to a support request, a change log may be stored containing the affected card or inventory ID, type of correction, previous and new stamp status, time, internal administrator ID and an optional note. This log is used for traceability, security and troubleshooting.
• Social, friends and communication data: friend requests, friends lists, chat messages, groups, group memberships, friendly battles, general matchmaking, leaderboards, online/offline status, times of messages and interactions, and visibility settings.
• Nearby and location data: if you enable the Nearby/Radar feature, location data may be processed in order to show players near you. Depending on your settings, other users may see your username, avatar, online status and an approximate distance or proximity. Display takes place only within the app feature and according to your chosen visibility settings.
• Health and movement data: if you explicitly consent and grant the required system permissions, Cardletics may read step counts and supported workout and distance data from Apple Health/HealthKit or Android Health Connect. Depending on the data available in the respective system, outdoor cycling, swimming, rowing and other workouts may be taken into account for gameplay. Walking, running and comparable activities may deliberately not be counted as an additional separate workout category for individual game mechanics. The data are used exclusively for movement-related game, progress and reward features of Cardletics.
• Data from fitness and health platforms: Cardletics currently accesses the operating-system health platforms Apple Health/HealthKit and Android Health Connect. Cardletics does not connect directly to services such as Strava, Garmin, Fitbit, Samsung Health, Google Fit or similar fitness services. If those services provide data to Apple Health or Health Connect and the data are made available there to Cardletics, they may indirectly be part of the data read by Cardletics.
• Subscription and purchase data: subscription model (Free, Club or Master), status, term, purchase history, Coin purchases, Coin usage and technical confirmation data from the respective app-store platform.
• Marketplace data: internal listings, bids, sales, purchases, fees, buyer/seller assignments and related timestamps.
• Affiliate and referral data: internal attribution and evaluation data for referrals and partner programmes.
• Support and communication data: name, email address, subject and message when you contact us, as well as the related email communication.
• Technical data: IP address, device and app information, browser data, operating system, access times, server logs, error data and security data.
• Notification information: information required to display local notifications on your device and manage the related permission. In the current app version, Cardletics does not use its own server-side push delivery for this purpose.

We process personal data in particular for the following purposes:

• providing the website and app,
• creating and managing user accounts,
• providing game functions and in-app features,
• managing inventory, cards, backgrounds, packs and showcases,
• calculating movement progress, goals, Daily Packs, activity stamps and rewards,
• providing the Nearby/Radar feature and showing nearby players,
• providing friends features, chats, groups, friendly battles, general matchmaking and leaderboards,
• processing Coin purchases, in-app purchases and subscriptions,
• providing and securing the internal marketplace,
• internal attribution of referral and affiliate activity,
• displaying game-related notices and reminders through local notifications,
• handling support and contact requests,
• troubleshooting, system security and abuse prevention,
• traceable administrative corrections to card and stamp data in support cases,
• complying with statutory retention and documentation obligations.

We process personal data on the following legal bases:

• Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract, in particular for user accounts, app features, game progress, inventory management, Coin functions, marketplace, showcases, friends, chats, groups, support and paid services.
• Article 6(1)(c) GDPR, where we are subject to legal obligations, in particular tax and commercial retention obligations.
• Article 6(1)(f) GDPR, where we process data on the basis of legitimate interests, for example system security, troubleshooting, abuse prevention, internal administration and improving service stability.
• Article 6(1)(a) GDPR for processing based on consent, in particular optional features such as notifications, location sharing, fitness/health integration or optional profile and visibility functions.
• Article 9(2)(a) GDPR for health and movement data based on your explicit consent.

Use of health and movement data is voluntary. Cardletics processes such data only after you have explicitly consented and granted the required permissions on your device.

On iOS, Cardletics reads — where you have permitted access and the data are available — in particular steps, swimming distance and workout data from Apple Health/HealthKit. On Android, Cardletics reads in particular steps and supported workout and distance data via Health Connect. Recorded workouts can therefore include outdoor cycling, swimming, rowing and other workouts. Cardletics does not connect directly to the respective sports watch; what matters is that the data are available in Apple Health or Health Connect and accessible to Cardletics. On Android, the Health Connect library currently used may technically read total calorie values as additional workout data. Cardletics does not currently use these values for game calculations and does not store them as a separate Cardletics gameplay value in the database.

The data are used in particular for progress displays, daily challenges, unlocking Daily Packs and activity stamps on newly generated Daily Pack cards. An activity stamp can be Bronze, Silver or Gold and depends on the number of different qualifying activity categories on the underlying day. Such a stamp can also apply an in-game battle bonus to the respective card: Bronze increases the battle strength calculated from rarity and card condition by 3%, Silver by 6% and Gold by 10%.

Gameplay-related daily values such as steps, cycling, rowing or swimming distance, workout minutes, the activity date and — if the location/Radar feature was already enabled and a place name was available for that day — a coarse place name such as “Mainz” may be stored for an activity stamp. These daily values and derived Cardletics values may be transmitted to the Cardletics backend and stored in association with your account. Exact coordinates, street or house number are not stored in the card’s stamp metadata.

Sharing health and movement data is not required for the basic use of Cardletics. If you do not consent or do not grant system permission, you can continue to use Cardletics in a limited mode. Features, progress or rewards that require movement data may then be unavailable or limited.

Without your consent, Cardletics does not access the health and movement data intended for Cardletics. Fitness-data use can later be enabled again in Cardletics. Individual permissions that were not previously granted or were later changed can also be adjusted in Apple Health or in the Health Connect/system settings of your device.

You can withdraw consent at any time with effect for the future in Cardletics. You can also change or revoke the relevant access rights in your operating-system settings. After withdrawal, Cardletics no longer accesses new health and movement data until you consent again.

Game or progress data previously generated during use may remain part of your Cardletics account until they are deleted or your account is deleted, unless statutory obligations prevent deletion.

Cardletics is not a medical device and does not replace medical advice. Health and movement data are used exclusively for game, motivation and progress features.

The app includes an optional Nearby/Radar feature. It is disabled by default. If you enable this feature and allow location access, Cardletics processes your location to show you nearby players and — depending on your settings — to allow other users to see your approximate proximity or presence. While the Radar screen is open and the feature is active, the location may be determined again and transmitted to the Cardletics backend approximately every 45 seconds.

Depending on your settings, other users may see:

• username and avatar/profile picture,
• online status or last active status,
• approximate distance or proximity,
• friendship status or interaction options.

The Nearby/Radar feature is optional. You can disable visibility and location access at any time. When Radar is disabled, Radar visibility ends and Cardletics no longer uses your location for active nearby visibility. The most recently stored precise coordinates and the timestamp of the location update may technically remain stored in the Cardletics presence row until they are overwritten by a later location update or removed when your user account is deleted. Technical security or server logs of the infrastructure used may remain independently in accordance with the respective technical retention periods. Cardletics does not publish an exact address as a public user profile.

If you have already enabled the Radar/location feature, Cardletics may additionally derive a coarse place name such as “Mainz” from the existing location processing. Such a coarse place name may be stored for an activity stamp generated on the same activity date. The exact coordinates of the Radar feature are not copied into card or stamp metadata for this purpose.

Cardletics includes social features such as friend requests, friends lists, chats, groups, friendly battles, general matchmaking and leaderboards. To provide these functions, we process the necessary data, in particular user IDs, usernames, profile pictures, message content, timestamps, group memberships and interaction status.

Within the app, you can determine which profile information should be visible to friends, for example Coins, subscription status, awards, registration time or card stamps, where those options are offered. Messages and group content are not public, but are intended only for the users or group members involved. For administration, security, abuse prevention or support, internally authorised persons may access the data required for those purposes.

Cardletics may display local notifications on your device, for example game-related reminders or notices.

Cardletics may request the operating system’s notification permission. You can disable that permission at any time in your device settings.

In the current app version, Cardletics does not use server-side push delivery for this function and does not store its own push token for delivery via a Cardletics push service. If server-side push notifications are introduced in the future, this Privacy Policy will be updated accordingly.

Users can create an account. Login is currently available by email and — where offered — via Apple and Google.

As part of the user account, we process the data necessary for authentication, account management and providing the functions. Certain profile information such as username, avatar, online status, friendship status or nearby visibility may be shown to other users in the app where this is required for the relevant function or enabled by you.

Cardletics uses a virtual currency in the form of Coins. Coins can be obtained through in-app purchases. Subscriptions may also be offered.

The following subscription models may be processed:

• Free
• Club
• Master

Purchase and billing information is processed to attribute purchases, provide entitlements, document payments and comply with legal obligations. Payment processing and subscription management are handled through the respective app-store platform or the payment service used there.

The marketplace is visible only internally within the platform. Marketplace data are processed in order to provide and secure listings, bids, purchases, sales, fees, assignments and records within Cardletics.

If you contact us — in particular via a contact form or by email — we process the data you provide, in particular your name, email address, subject and message, in order to handle your request.

Support is currently provided by email at support@cardletics.com.

You can delete your user account directly in the Cardletics app under Settings → Delete account. The technical account-deletion process is triggered immediately there. Alternatively, you can use the /delete page or contact support@cardletics.com.

Our website is provided through Vercel. We use Supabase for backend functions, in particular authentication, database, storage, realtime and Edge Functions.

Through Supabase, user accounts, database entries, chat and group data, location/presence data, images and other files may be processed.

We use IONOS for email mailboxes and processing incoming messages. We use Resend for transactional system emails, in particular account and password-reset messages. This may include the email address, message content, subject, send time and technical delivery information.

The website currently loads country flags in the language menu via FlagCDN (flagcdn.com). When these graphics are retrieved, the provider may technically receive in particular the IP address of the requesting device.

Technical server and security logs may be generated as part of operating the services.

Personal data are disclosed to third parties only where necessary for the purposes described, required by law or covered by valid consent.

This may include in particular:

• Vercel as hosting provider,
• Supabase as backend, database, realtime and storage provider,
• IONOS for email mailboxes and email communication,
• Resend for transactional account and password emails,
• FlagCDN for country flags in the website language menu,
• Apple App Store for iOS in-app purchases and subscriptions,
• Google Play Billing for Android in-app purchases and subscriptions,
• Apple Health/HealthKit as an iOS system data source where you explicitly permit access,
• Android Health Connect as an Android system data source where you explicitly permit access,
• fitness services such as Strava, Garmin, Fitbit, Samsung Health, Google Fit or similar services are currently not connected directly to Cardletics. Data from such services can reach Cardletics only indirectly if they have first been transferred to Apple Health or Health Connect and are made available there to Cardletics,
• tax advisers where necessary for proper accounting and legal obligations.

An internal administration area exists. Access is limited to internally authorised persons where required for administration, troubleshooting, abuse prevention, billing or support. Administrative corrections to card stamps are logged for traceability and security.

The app can be used by users in different countries. Individual service providers, platforms or app-store providers may also process data outside the EU or European Economic Area.

Where data are processed in third countries, this is done only in accordance with the applicable legal requirements, in particular on the basis of appropriate safeguards such as adequacy decisions, standard contractual clauses or comparable mechanisms where required.

We generally store personal data only for as long as necessary for the respective processing purpose or as required by statutory retention obligations.

User-account, profile, game and inventory data are generally stored for the duration of the user account. When the user account is deleted, personal data are deleted or anonymised unless they must continue to be retained due to legal obligations or for the establishment, exercise or defence of legal claims.

Friends, group, chat and other social data are generally stored for as long as required for the relevant function and user account. Individual content may be deleted earlier where corresponding deletion functions are provided.

Location data from the Nearby/Radar feature are processed where required for the feature. When Radar is disabled, active Radar visibility ends. The most recently stored precise coordinates and the timestamp of the location update may technically remain stored in the Cardletics presence row until they are overwritten by a later location update or removed when the user account is deleted. Independently, technically necessary server or security logs may remain in accordance with the retention periods of the infrastructure and platform providers used.

After consent is withdrawn, Cardletics no longer accesses new health and movement data. Game and progress data already created or stored from such data — including activity stamps already awarded and the gameplay-related daily metadata stored with them — may remain stored until they are deleted or the user account is deleted, where continued storage is permitted.

Purchase, payment and billing data are stored for as long as necessary for contract processing and due to tax, commercial or other statutory retention obligations.

Administrative correction logs relating to cards and stamps are stored only for as long as necessary for traceability, support, system security or defence against abuse. If the affected card or associated user account is deleted, related correction logs are also removed in accordance with the technical database relationships unless legal reasons require otherwise.

Technical server, security and error data are stored only for as long as necessary for operation, security, troubleshooting or abuse prevention. Where such data are processed by infrastructure or platform providers, their technical retention periods may also apply.

Cardletics can also be used by young people. Where consent is required for specific processing, minors must meet the applicable legal requirements. In Germany, consent for information-society services may generally be given independently from the age of 16; below that age, consent from a parent or guardian may be required.

For paid features, in particular in-app purchases and subscriptions, the rules of the payment or platform provider and, where applicable, the consent of parents or guardians must be observed.

Under our current setup, we do not use analytics or marketing tools on the website. The selected website language may be stored locally in the browser using Local Storage so that the choice is retained on the next visit. This storage is not used for advertising or user tracking.

Where technically necessary cookies or similar technologies are used beyond this, they are used to provide, secure and operate the website.

If additional cookies or similar technologies are introduced in the future, in particular for analytics, reach measurement or marketing, we will update this Privacy Policy and, where required, our consent processes accordingly.

Additional privacy disclosures may be required for publication in app stores, in particular Google Play and the Apple App Store. These disclosures must be consistent with this Privacy Policy and the actual data processing in the app.

In particular, disclosures concerning health/fitness data, workout and distance data, location/Radar, coarse place names, social features, marketplace functions and purchases must reflect the version of the app actually published. If these functions change, the corresponding app-store privacy disclosures will also be updated.

Subject to the applicable statutory requirements, you have in particular the right to:

• request access to your stored data,
• have inaccurate data corrected,
• request deletion of your data,
• request restriction of processing,
• object to processing,
• request data portability where applicable,
• withdraw consent at any time with effect for the future.

You can delete your user account directly in the Cardletics app under Settings → Delete account. Alternatively, you can use the /delete page or contact support@cardletics.com.

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

We take technical and organisational measures to protect personal data against loss, misuse, unauthorised access, unauthorised disclosure and unlawful alteration.

We may amend this Privacy Policy if legal, technical or organisational changes occur or if new functions, services or processes are introduced.

If you have questions about privacy or exercising your rights, you can contact us at any time:

Sascha Leineweber – Cardletics
Oppenheimer Str. 26
55130 Mainz
Germany
Email: datenschutz@cardletics.com