Every byte that leaves the device.

The retailer catalogue: no requests at all

Every country's list of shops is built into the app, all 12 of them (see the full list), so nothing is downloaded. A new list arrives with a new version of the app.

An install with backup left off, which is the default, makes no network requests whatsoever.

Backup, and what goes to Google

Two different things, with two different answers.

Android's own backup is on. Your cards, your settings and the backup key are included in Android's Auto Backup and in device-to-device transfer, so a new phone set up from a Google backup (or straight from your old phone over a cable) arrives with your cards already in it. This is Android's mechanism rather than ours: it goes into your Google account, no CardJar code makes the request, we never receive it and have no way to ask for it. On Android 9 and later it is encrypted against your screen lock before it leaves, so Google holds something it cannot read either. Turning it off is a setting on your phone, not in our app: Settings, then Google, then Backup.

An exported file goes wherever you put it. Export seals all your cards into one file with a passphrase you choose, and hands it to your phone's file saver. It opens on any phone with that passphrase and on none without it. Nobody holds a copy of it, not Google and not us, and nobody can open it without your passphrase.

Google Drive, switched off in this release

The Drive backup is built but turned off, and this version of the app makes no request to Drive at all. When it is switched on it will ask for one scope, https://www.googleapis.com/auth/drive.appdata, which can only see a private folder this app created, not your documents and not anything else in your Drive. This policy will be updated to describe it when that happens.

Reading your cards does not send them anywhere

Importing pictures reads two things out of each one: the barcodes, and the words printed around them. The words help put the right shop name on a card when the number alone cannot. The camera does the same when you scan a card, reading the frame the barcode was found in, once. All of this reading happens on your phone, with nothing downloaded to do it, so scanning and importing both work in aeroplane mode and make no request while they work.

Nothing about the pictures or the camera frames leaves the phone: not the image, not the text read out of it, not the name it produced, and not the fact that you scanned or imported anything at all. Frames from the camera are never saved anywhere. They are read as they arrive and released. The words are held only long enough to compare them against the retailer list already inside the app, and are then dropped along with everything else about the frame.

Asking for a rating

Once you have been using CardJar for a while, the app asks your phone's app store to offer its rating card. It asks on the way back from the till to your cards, never while a barcode is on screen, and only once you have had the app for a week, have three cards in it and have shown them at a till five times. It asks at most once every six months.

The card is the store's, not ours. On Android the app asks the Play Store app on your phone; on an iPhone or iPad it asks the App Store. The store decides whether to show anything at all, draws it, and keeps whatever you choose on it. Nothing comes back to the app: not whether the card appeared, not a rating, not a review. The request carries nothing about your cards, and the app makes no network request to send it.

What the store learns is that CardJar asked, and whatever you choose to tell it. The store may check with its own servers before deciding whether to show the card. That is the store's own request, under its own policy, about an app it installed and already knows you have. A rating or review you give there is published by the store like any other.

That is the entire list

• No analytics in the app. The website counts page views, and says how below.
• No third-party crash reporter.
• No advertising identifier, no attribution, no fingerprinting.
• No card number, name, colour or count is ever sent anywhere.
• Android's own backup is on, and carries your cards into your own Google account. That is Android doing it, not the app, and the backup section above explains it in full.
• Now and again your app store is asked to offer its own rating card, and it keeps whatever you choose on it. Nothing comes back to the app and nothing about your cards goes with it.

Sharing

A share link carries the card in the part of the URL after the #, which browsers never send to a server. The card travels between the two devices and nowhere else, even when the person receiving it opens the link in a browser rather than in the app. The page it opens on is a plain page with no server behind it, and cannot record a card number.

The watch

If you use the Wear OS app, your favourite cards travel from your phone to your watch over the connection your paired phone and watch already share. Nothing about that reaches us. Only favourites travel, and only what the watch needs to show them.

The watch keeps its own copy so it works with your phone out of range. If you would rather a card were not on your wrist, do not favourite it.

The launcher's long-press menu

Holding the app icon down offers to add a card, and lists up to three of your cards to open straight away. This works on Android, and as Home Screen quick actions on iPhone and iPad. Naming a card there hands its name to your launcher, which is another app on your phone: it draws that menu, and what it remembers afterwards is its own. Only the name and the colour ever go, never the number.

Switch the fingerprint, face or PIN lock on and no card is listed at all, because a list of your shops readable from a locked phone would undo much of what the lock is for. The entry for adding a card stays, since it names nothing.

Delete a card, or switch that lock on, and the app stops offering it and switches off any copy of it you had pinned to your home screen. What it cannot do is take the name back: only your launcher can remove a pinned icon, and anything it has already noted is out of the app's hands. That is true of anything you put on a home screen.

What is stored on the device

Everything: your cards, held in the app's private storage, protected by your phone's own encryption and, if you switch it on, a fingerprint, face or PIN lock. That is the point of the app. It works in aeroplane mode because your cards are simply there.

Uninstalling removes all of it from the phone. Android's backup copy in your Google account outlives the uninstall for a while, as it does for every app; you can delete it yourself from Google One's backup settings without asking us. Any file you exported is yours and stays wherever you put it.

This website

cardjar.app is a static site on Cloudflare Pages, and it counts its page views with Google Analytics. Here is exactly what that does and does not do. The app is not involved: nothing on your phone or your watch reports anything to anybody.

It asks first. On your first visit a small banner asks whether the site may count your visit, and until you answer nothing is sent to Google at all. "No thanks" means it never is; "Allow" turns the counter on, and "Cookie settings" at the foot of every page asks again whenever you like. Your answer is kept in your own browser and goes nowhere. Saying no after saying yes switches the counter off and deletes the cookies it set.

The theme switch at the foot of every page keeps a choice of Light or Dark in your browser the same way, and Auto removes it. It is only read to draw the page in that theme, it is not a cookie, and it is never sent anywhere.

If you allow it, the counter is told that a page was opened, and which page. It sets a cookie, as an ordinary analytics tag does, so a second visit from the same browser is recognised as the same browser. Google is given the address of the page, the site you arrived from, and what any web server sees of a request: a rough location worked out from your IP address, and which browser you used. Advertising features, Google Signals and personalisation are switched off, so nothing here is used to build an advertising profile. If your browser sends Global Privacy Control or Do Not Track, you are not asked, nothing loads and nothing is counted.

The share page at /c, where a card sent to you opens, takes extra care. The card is in the part of the link after the #, which your browser never transmits to anyone, but a standard analytics tag reports the whole address of the page, including that part. On that page the counter is never given the real address. It is only ever told cardjar.app/c, so the card cannot reach Google, even by mistake. The card is not in Cloudflare's request logs either, and could not be.

Everything else on these pages, the styles, the fonts and the pictures, comes from cardjar.app itself.

Children

CardJar is not directed at children and collects no personal data from anyone, regardless of age.

Changes

If this policy ever changes, the change ships with a version of the app and this page is updated at the same time. The app cannot change what it does without a new version.

Contact

hello@convertcase.net