Privacy Policy

• Customer name, email, and shipping address (for fulfillment)
• Stripe payment token (we never see your full card number)
• Uploaded child photo (used only to generate the card)
• Player details (name, jersey number, team, league, city)
• IP address and consent timestamp at checkout

To generate your card, process payment, and ship the physical product (when applicable). We do not sell your data, and we never use it to train any AI models.

With your consent we do share a limited amount of advertising-measurement data. Under California law, loading an advertising tag counts as “sharing” for cross-context behavioral advertising even though no money changes hands. Exactly what is shared, on which pages, and how to switch it off is in Advertising measurement below.

Uploaded photos are deleted by default. The photo you upload is used to generate your card and is then automatically deleted from our servers: within hours for abandoned checkout sessions, and otherwise within 120 days of upload (kept so you can come back, finish a purchase, fix a card, or reorder without uploading again). If you’d like us to keep your uploaded photos — so reorders don’t need a fresh upload — you can opt in under Account → Settings → “Uploaded photos,” and change that choice anytime.

Generated card images (the finished cards) are retained in private storage so you can re-download or reorder them. You can request permanent deletion of your child’s photos and cards at any time by replying to your order confirmation email; we delete them and log the action for audit purposes.

• Stripe — payment processing
• OpenAI — AI image generation
• Anthropic — AI text and image review
• fal.ai — AI image generation (print bleed fill)
• EasyPost — shipping label generation and tracking
• Resend — order confirmation emails
• Mailgun — outreach and announcement emails
• Print fulfillment partner — receives the card image and shipping address only, for the purpose of producing and shipping your order

With your consent, we use advertising measurement tags (Google Ads, Meta) to understand whether our ads led to a purchase.

What the tags receive from your browser. A page visit, and on a purchase: the order value and currency, the number of items, our own cart number and cart ID, and the sport and template of the card. That is the complete list — it is a fixed allowlist in our code, so a field we have not named here cannot be added by mistake. Never uploaded photos, player or child names, jersey numbers, or anything else printed on a card.

What we send from our own server. If you reached us by clicking one of our ads and advertising consent was in place when you bought, we also report that purchase to the ad platform directly from our server, so the sale is counted even if your browser blocked the tag. That report carries the same order details above, the ad-click identifier, and your own email address in one-way hashed (SHA-256) form — which the platform can only use to match the purchase to the click. It is the buyer’s email, never a child’s, and we never send a name in any form, hashed or otherwise.

Where they run. Our marketing pages; the checkout funnels (“create” and coach team links); and the pages where a purchased card is shared, revealed, or claimed.

Pages a child may open. A shared card link, a pack reveal, and a claim link are frequently opened by the child pictured. If advertising consent has been given in that browser, an advertising tag loads on those pages and sets a cookie that identifies the browser. No photo, name, or card content is sent — but that identifier is itself personal information, and it is collected from whoever is holding the device.

Parents and guardians: to prevent this entirely, choose “Reject non-essential” on the cookie banner in the browser your child uses, or enable Global Privacy Control — we honor that signal automatically and it overrides any previous acceptance. You can change the choice at any time through the “Do Not Sell or Share My Personal Information” link in the footer. See the Cookie Policy.

This service is directed at parents, guardians, coaches, and leagues — not at children. Accounts, photo uploads, and purchases are made by adults on a child’s behalf.

Some pages are meant to be shown to the child: a shared card, a pack reveal, a claim link. We collect no account data, photo, or card content from anyone viewing those pages. We do, where advertising cookies have been accepted in that browser, allow an advertising tag to set a browser identifier — see Advertising measurement above for what that is and how to prevent it.

If you believe a child has been identified this way without your permission, email orders@cardgenie.shop and we will delete the associated data and tell you what was held.

California residents have the right under CCPA to request access to, deletion of, or correction of their personal data. To make a request — including a request to permanently delete your child’s card image from our storage — reply to your order confirmation email. We will action the request and keep an internal log of who performed the deletion and when.