Every byte that leaves the device.

The retailer catalogue: no requests at all

Every country's list of retailers is compiled into the app. All five together are under a hundred kilobytes, so there is nothing worth fetching. A new list arrives with a new version of the app.

That was the app's only unprompted outbound request, and it is gone. An install with backup left off, which is the default, makes no network requests whatsoever.

Google Drive, only if you turn backup on

Backup asks for one scope, https://www.googleapis.com/auth/drive.appdata, which can only see a private folder this app created. It cannot see your documents or anything else in your Drive.

What is written there is a single AES-256-GCM encrypted file. The key is generated on your device and never leaves it, so Google holds ciphertext it cannot read, and so do we. You choose the account, through the system account picker, and CardJar never sees a password.

Reading your screenshots does not send them anywhere

Importing pictures reads two things out of each one: the barcodes, and the words printed around them. The words are what let a card whose scheme publishes no number format still arrive with the right name on it. Both readers run on your phone, from models built into the app rather than fetched, so an import works in aeroplane mode and makes no request while it works.

Nothing about the pictures leaves the phone: not the image, not the text read out of it, not the name it produced, and not the fact that you imported anything at all. The words are held only long enough to compare them against the retailer list already inside the app, and are then dropped along with everything else about the picture.

That is the entire list

• No analytics in the app. The website counts page views, and says how below.
• No third-party crash reporter.
• No advertising identifier, no attribution, no fingerprinting.
• No card number, name, colour or count is ever sent anywhere.
• Android's own automatic backup is switched off, so nothing leaks that way either.

Sharing

A share link carries the card in the part of the URL after the #, which browsers never send to a server. The card travels between the two devices and nowhere else, even when the person receiving it opens the link in a browser rather than in the app. The page it lands on is static, has no backend, and could not record a card number if it wanted to.

The watch

If you use the Wear OS app, your favourite cards travel from your phone to your watch over the link the two devices already have with each other as a paired pair. Nothing about that reaches us. Only favourites travel, and only the parts the watch draws.

The watch keeps its own copy so it works with your phone out of range. If you would rather a card were not on your wrist, do not favourite it.

What is stored on the device

Everything: your cards, held in the app's private storage, protected by your phone's own encryption and, if you switch it on, a fingerprint, face or PIN lock. That is the point of the app. It works in aeroplane mode because your cards are simply there.

Uninstalling removes all of it. If you turned backup on, the encrypted file stays in your own Drive until you delete it, and you can do that yourself from Google's account settings without asking us.

This website

cardjar.app is a static site on Cloudflare Pages, and it counts its page views with Google Analytics. That is the one thing on this page that is not nothing, so here is exactly what it does and does not do. The app is unaffected: nothing on your phone or your watch reports anything to anybody, which is what the rest of this page is about.

The counter is told that a page was opened, and which page. It sets no cookie and keeps nothing in your browser, so nothing here recognises you on a second visit or follows you to another site, and that is why this site has no banner asking you to accept anything. Google is given the address of the page, the site you arrived from, and what any web server sees of a request: a rough location worked out from your IP address, and which browser you used. Advertising features and personalisation are switched off. If your browser sends Global Privacy Control or Do Not Track, nothing loads and nothing is counted.

The share page at /c, where a card sent to you is opened, is why that is written so carefully. The card is in the part of the link after the #, which your browser never transmits to anyone, and an analytics tag left as it comes reports the whole address of the page including that part. So this one is never given the address: the page hands it one it has already cut off at the #, and what Google receives for a shared card is cardjar.app/c with nothing after it. The card is not in Cloudflare's request logs either, and could not be.

Everything else a page here asks for, the stylesheet, the fonts and the pictures, is served from this domain.

Children

CardJar is not directed at children and collects no personal data from anyone, regardless of age.

Changes

If this policy ever changes, the change ships with a version of the app and this page is updated at the same time. There is no back channel through which the app's behaviour could change without a new version.

Contact

hello@convertcase.net