How CardyCraft uses data, and how you stay in control
Last updated
8 October 2026
Overview
This page explains how CardyCraft collects, uses, and protects personal data and cookies
on its website and services. CardyCraft is run by one person, Cardy. By using the site, you agree to this policy.
Data collected
Account data: email, username, password hash, and profile details you choose to provide.
Subscription and purchase data: tier, status, order IDs, prices, and checkout metadata.
Linked accounts: Discord/Patreon IDs and link status (when you connect them).
Commissions and contact forms: details you submit for quotes or support.
Reviews: messages and images shared in the CardyCraft Discord reviews channel.
Technical and analytics data: IP hash, user agent, pages visited, clicks, time on page,
and country derived from GeoIP.
Email preferences: whether you agreed to marketing emails, when and how you agreed,
which types of email you want, whether you opened CardyCraft emails or clicked a link in them, and your reason
for unsubscribing if you choose to give one.
How data is used
Provide access to maps, subscriptions, and user libraries.
Process purchases, manage orders, and handle refunds or disputes.
Sync tiers and permissions across connected services like Discord.
Respond to commission requests and support messages.
Improve performance, security, and content quality with analytics.
Send marketing emails, only if you agreed to receive them (see below).
Emails CardyCraft sends
CardyCraft sends two kinds of email:
Account and purchase emails: account confirmation, password resets, receipts, and
download or order updates. These are needed to provide the service, so they are sent regardless of
your marketing choices.
Marketing emails: announcements when new maps are released, the newsletter and
CardyCraft news, and a reminder if you leave something in your cart.
New accounts only get marketing emails if you tick the “Email me when new maps drop” box on
the sign-up form (it is unticked by default), or if you turn them on from the email preferences page.
Accounts created before 17 September 2026 were added to the mailing list when the account was created,
as stated on the sign-up form at that time. Everyone can unsubscribe at any time.
CardyCraft marketing emails contain a small image and links that show whether an email was opened and which
links were clicked, so CardyCraft can see which emails are useful. Some email apps load images automatically,
so this is an estimate.
You can stop marketing emails at any time: use the Unsubscribe link at the bottom of
any CardyCraft email, or the unsubscribe button in your email app. That page also lets you choose which
types of marketing email you still want. Unsubscribing does not affect account or purchase emails.
Sharing and processors
CardyCraft does not sell your data. It shares limited data only with service providers needed to run the site:
Payments: Stripe handles card and wallet payments.
Security: Google reCAPTCHA helps block abuse.
Social login and linking: Discord, Google, and Patreon for OAuth.
Email: email delivery providers that send CardyCraft's account, purchase, and marketing emails on its behalf.
File delivery: external download hosting (for large map files).
Infrastructure: hosting, CDN, and security services.
Payments
CardyCraft does not store full card details. Payment data is processed by Stripe.
Cookies and local storage
Essential: session cookies, CSRF tokens, and security features.
Preferences: theme and cookie consent settings.
Analytics (optional): anonymous usage metrics to improve the site.
Third-party: reCAPTCHA, payment checkout, and OAuth providers may set their own cookies.
Your choices and rights
Accept or reject optional cookies with the banner or the button below.
Clear cookies and local storage in your browser at any time.
Unsubscribe from marketing emails, or choose which ones you get, using the link in any CardyCraft email.
Request access, correction, or deletion of your data by emailing cardycraft@gmail.com.
Disconnect linked accounts inside your Account settings.
Data retention
CardyCraft keeps data only as long as needed for the purposes above or as required by law.
Security
CardyCraft uses encryption in transit, access controls, and monitoring to protect your information,
but no system is 100% secure.