Privacy Policy for CardDeck

This Privacy Policy describes how CardDeck ("we", "our", or "the app") handles your information[cite: 2].

1. Information Collection and Storage

CardDeck allows you to track and manage credit cards, nicknames, payment due dates, and EMI schedules[cite: 2].

• Local Storage Only: All card metadata, EMI schedules, and transaction records are stored strictly in an encrypted database directly on your device[cite: 2].
• No Cloud Transmission: We do not operate remote servers to host or sync your information[cite: 2]. The app does not transmit your personal or financial data over the internet[cite: 2].
• Card Safety: CardDeck is designed for personal card management and organization (e.g. tracking due dates, billing cycles, and last 4 digits)[cite: 2]. We strongly advise users against storing full card numbers, CVVs, or online banking passwords[cite: 2].

2. Data Security & Encryption

• Encrypted Backups: If you use the backup export feature, CardDeck creates an encrypted backup file using AES-256-GCM encryption with a password/passphrase that you define[cite: 2]. You retain complete ownership and custody of your backup files[cite: 2].
• Biometric Protection: When enabled, CardDeck utilizes your operating system's built-in Biometric authentication (Fingerprint, Face Unlock, or PIN lock) to protect app access[cite: 2]. The app never has access to your raw biometric credentials[cite: 2].

3. Device Permissions

CardDeck only requests device permissions required for core offline utility functions[cite: 2]:

• Notifications (POST_NOTIFICATIONS): Required to deliver local notifications and reminders for your upcoming EMI and bill due dates[cite: 2].
• Exact Alarms & Boot Completed (SCHEDULE_EXACT_ALARM, RECEIVE_BOOT_COMPLETED): Required to re-register local notification alarms following device reboots[cite: 2].
• Biometric Authentication (USE_BIOMETRIC): Used to confirm identity before unlocking the app or revealing card entries[cite: 2].
• No Internet Permission: The app does not request or use internet permissions (android.permission.INTERNET), ensuring your data cannot leave your device[cite: 2].

4. Third-Party Services & Advertising

• No Analytics or Trackers: We do not integrate any third-party analytics (like Google Analytics or Firebase), trackers, or advertising SDKs[cite: 2].
• No Data Sharing or Selling: Because we do not collect any user data, your personal information is never sold, traded, or shared with third parties[cite: 2].

5. Children's Privacy

CardDeck does not knowingly collect or solicit personal information from anyone under the age of 13[cite: 2]. The application is a general-purpose offline card management utility[cite: 2].

6. Data Retention and Deletion

Because all data resides exclusively on your device, you are in total control[cite: 2]:

• You can edit or delete individual cards and EMIs at any time in the app[cite: 2].
• Clearing app data or uninstalling the app permanently deletes all stored cards and records from the device[cite: 2].

7. Changes to This Privacy Policy

We may update this policy occasionally[cite: 2]. Any updates will be published with a revised "Effective Date" at the top of this page[cite: 2].