Card Cubbie

Card Cubbie Privacy Policy

Effective date: September 12, 2026
Company: Arch Harbour LLC d/b/a Card Cubbie, a Florida limited liability company
Contact: support@cardcubbie.com

1. Overview

This Privacy Policy explains how Arch Harbour LLC d/b/a Card Cubbie (“Card Cubbie,” “we,” “us,” or “our”) collects, uses, shares, retains, and protects information when you use the Card Cubbie mobile application, websites, software, subscriptions, wallet features, reminders, sponsored offers, shared wallet features, and related services (collectively, the “Service”).

Card Cubbie helps users organize physical and digital gift cards in a digital wallet, create Cubbie wallets, use shared wallet features, receive reminders, and access related features.

This Privacy Policy applies globally, but some rights and disclosures apply only to users in particular countries, states, provinces, or regions.

2. Controller / responsible entity

For purposes of applicable privacy laws, the responsible entity is:

Arch Harbour LLC d/b/a Card Cubbie
privacy@cardcubbie.com

3. Information we collect

We collect information in several ways: information you provide, information created when you use the Service, information from your device, information from app stores and service providers, and information generated through wallet sharing or reminders.

3.1 Account information

We may collect:

  • name;
  • email address;
  • password hash or authentication credential information;
  • account ID;
  • login method;
  • profile preferences;
  • country, region, city, ZIP/postal code, or other location information you provide;
  • communication preferences;
  • privacy choices and consent records.

3.2 Gift card and wallet information

When you add gift cards or wallets, we may collect information such as:

  • retailer, restaurant, merchant, or company name;
  • merchant category or company category;
  • gift card name, nickname, or description;
  • gift card number;
  • PIN or access code;
  • barcode, QR code, or other redemption code;
  • card image, screenshot, or uploaded photo;
  • card balance, if you enter or obtain it through supported features;
  • expiration date or reminder date, if applicable;
  • purchase or receipt notes you add;
  • wallet names;
  • wallet organization preferences;
  • shared wallet roles, members, permissions, invitations, and activity.

Gift card numbers, PINs, barcodes, card images, and similar redemption data may have monetary value. We treat this information as high-risk wallet information.

3.3 Shared wallet information

If you use shared wallets, including the primary Family Cubbie wallet, we may collect:

  • invitee email addresses or identifiers;
  • membership status;
  • roles and permissions;
  • wallet activity;
  • card additions, edits, moves, deletions, or other shared wallet actions;
  • information visible to other shared wallet members based on permissions.

When you invite someone to a shared wallet, that person may see information you choose to share.

3.4 Subscription and purchase information

If you purchase Card Cubbie Plus, we may receive subscription status and purchase metadata from Apple, Google, RevenueCat, or another authorized provider, such as:

  • product ID;
  • entitlement status;
  • subscription start/end dates;
  • renewal status;
  • billing retry or grace period status;
  • transaction identifiers;
  • app store account region;
  • RevenueCat app user ID or customer identifiers.

We do not receive your full payment card number from Apple or Google for in-app subscription purchases.

3.5 Device, app, analytics, and log information

We may collect:

  • device type, operating system, app version, language, country, and time zone;
  • IP address;
  • approximate location inferred from IP address;
  • device identifiers or app instance identifiers;
  • app interactions, screens viewed, buttons tapped, feature usage, and session data;
  • crash logs, diagnostics, performance data, and error reports;
  • security logs, fraud-prevention logs, and audit records.

3.6 Notifications and reminders

If you enable reminders or push notifications, we may collect:

  • push notification token;
  • reminder preferences;
  • reminder schedule;
  • reminder interactions;
  • notification delivery and engagement data.

3.7 Location information

We may collect location information if you choose to provide it or enable location-based features.

Depending on your settings and the feature used, location information may include:

  • country, state, city, ZIP/postal code, or other coarse location;
  • precise device location, only if enabled through your device permissions.

You can disable location permissions through your device settings.

For free users, we may collect information about sponsored offer and affiliate interactions, such as:

  • offer impressions;
  • offer clicks;
  • offer dismissals;
  • retailer/category match that caused an offer to appear;
  • affiliate campaign IDs;
  • destination URL metadata;
  • general app context where the offer was shown.

We do not use gift card numbers, PINs, barcodes, or full card images to target sponsored offers.

3.9 AI Smart Reminder information

If you use AI-enabled Smart Reminders, we may process limited wallet context to generate reminder suggestions, such as:

  • retailer name;
  • merchant category;
  • balance or balance range;
  • gift card age;
  • expiration or reminder dates;
  • prior reminder interactions;
  • coarse location if you enabled relevant location-based features.

We do not intend to send gift card numbers, PINs, barcodes, card images, passwords, or authentication tokens to AI providers for Smart Reminders.

3.10 Information from third parties

We may receive information from:

  • app stores;
  • RevenueCat or subscription management providers;
  • authentication providers;
  • cloud hosting providers;
  • analytics and crash reporting providers;
  • customer support tools;
  • affiliate networks;
  • merchants or offer partners when you interact with offers;
  • other users who invite you to a shared wallet.

3.11 Image processing

When you submit new card scans, receipt photos, or profile images, a Cloudflare gateway sends the selected images to OpenAI to check content safety and whether they match the intended purpose before accepted images can be saved in Supabase. Card front and back images are analyzed together in one request, including extraction of visible card details for your review. Receipt processing can extract a remaining balance. Images may contain sensitive information visible in the photo; review what you choose to submit.

Rejected images are not saved in Supabase, and the gateway does not retain submitted images or analysis responses in application storage or request logs. OpenAI provider retention rules still apply; disabling application-level response storage is not a promise of zero provider retention. This process applies to new or replaced uploads, not retrospective analysis of existing stored images. Image-free manual card entry remains available.

4. Personalized offers preference

The Personalized offers preference is enabled by default. It lets Card Cubbie tailor future first-party in-app merchant offers and referral suggestions, and you can turn it off during signup or later in the Privacy Center.

This preference does not authorize cross-context behavioral advertising, third-party tracking, or the sale or sharing of personal information. It does not change whether free users see contextual AdMob ads or whether Card Cubbie Plus is ad-free.

Card Cubbie does not send wallet contents, gift card numbers, PINs, barcodes, balances, precise location, identity, or app behavior to AdMob for ad targeting. If a future advertising or referral integration would require additional disclosure, consent, or an opt-out, we will provide those controls before enabling that use.

5. How we use information

We use information to:

  • provide, operate, maintain, secure, and improve the Service;
  • create and manage accounts;
  • store, sync, organize, display, and back up gift card and wallet information;
  • provide shared wallet and household control features;
  • process subscriptions and manage Card Cubbie Plus entitlements;
  • provide reminders, notifications, and AI-enabled Smart Reminders;
  • personalize future first-party in-app merchant offers or referral suggestions when the Personalized offers preference is enabled;
  • show contextual advertising to free users while keeping Card Cubbie Plus ad-free;
  • measure sponsored offer impressions and clicks;
  • provide customer support;
  • troubleshoot, debug, and improve app performance;
  • detect, investigate, and prevent fraud, abuse, security incidents, and policy violations;
  • comply with legal obligations, app store rules, tax/accounting obligations, and enforce our Terms;
  • communicate with you about service, account, subscription, security, legal, and support matters;
  • send marketing messages where permitted and where you have not opted out.

If you are in the European Economic Area, United Kingdom, Switzerland, Brazil, or another jurisdiction that requires a legal basis for processing, our legal bases may include:

  • Contract: to provide the Service, manage your account, store wallet data, provide subscriptions, and support shared wallet features.
  • Consent: for optional features such as certain marketing communications, location-based features, certain AI-enabled features, or future processing where consent is required.
  • Legitimate interests: to secure, maintain, improve, and analyze the Service; prevent fraud; provide contextual advertising or permitted first-party product personalization; and understand feature performance, where those interests are not overridden by your rights.
  • Legal obligation: to comply with laws, tax/accounting rules, app store obligations, lawful requests, and regulatory requirements.
  • Vital interests or public interest: only where applicable and legally permitted.

You may withdraw consent where processing is based on consent. Withdrawal does not affect processing that occurred before withdrawal.

7. How we share information

We may share information as described below.

7.1 Service providers

We may share information with vendors and service providers that process information on our behalf, such as:

  • cloud hosting and database providers;
  • authentication providers;
  • subscription management providers such as RevenueCat;
  • Apple App Store and Google Play for purchases and subscription management;
  • analytics and crash reporting providers;
  • customer support providers;
  • email and notification providers;
  • AI service providers for AI Smart Reminders;
  • security, fraud prevention, and debugging providers;
  • professional advisors such as lawyers, accountants, and auditors.

Service providers are authorized to process information only as necessary to provide services to us or as otherwise permitted by law.

7.2 Shared wallet members

If you use shared wallets, information in the shared wallet may be visible to other members based on their permissions. You control whom you invite and what permissions you assign, subject to available features.

7.3 App stores and subscription providers

If you purchase Card Cubbie Plus, Apple, Google, RevenueCat, or another provider may process purchase and subscription information to complete transactions, verify entitlement, manage renewals, handle refunds, and provide subscription support.

If you click a sponsored or affiliate offer, we or our partners may receive information needed to route the offer, attribute the click, measure conversion, prevent fraud, and pay commissions.

Information shared in this context may include affiliate campaign IDs, click IDs, basic app metadata, and destination URL data. We do not share wallet contents, gift card numbers, PINs, barcodes, balances, precise location, or full card images with sponsored offer or affiliate partners for ad targeting.

We may disclose information if we believe disclosure is reasonably necessary to:

  • comply with law, regulation, legal process, or governmental request;
  • enforce our Terms or other agreements;
  • detect, prevent, or address fraud, security, abuse, or technical issues;
  • protect the rights, property, or safety of Card Cubbie, users, merchants, app stores, service providers, or others.

7.6 Business transfers

We may share or transfer information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar business transaction. If required by law, we will provide notice or obtain consent.

7.7 Aggregated or de-identified information

We may use and share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you. For example, we may publish or share insights about gift card categories, redemption reminder trends, or general wallet usage.

We will not attempt to re-identify de-identified information except as permitted by law, such as to test whether our de-identification processes work.

8. Selling or sharing personal information

As of the effective date of this Privacy Policy, Card Cubbie does not sell personal information or share personal information for cross-context behavioral advertising.

Free users may see contextual AdMob ads; Card Cubbie Plus is ad-free. Card Cubbie does not send wallet contents, precise location, identity, or app behavior to AdMob for ad targeting.

If we later sell personal information, share personal information for cross-context behavioral advertising, work with data brokers, or introduce another use that requires additional choice, we will update this Privacy Policy and provide required notices, opt-outs, or consent mechanisms before enabling that use.

9. Your choices and controls

You may have the following controls, depending on your location and app version:

  • access, update, or delete account information;
  • add, edit, move, or delete gift cards;
  • create, rename, manage, or delete wallets;
  • manage shared wallet members and permissions;
  • disable push notifications through device settings;
  • disable location permissions through device settings;
  • manage reminder settings;
  • manage marketing email preferences;
  • turn Personalized offers on or off;
  • manage privacy preferences in Settings;
  • request account deletion;
  • request access, correction, deletion, restriction, portability, or objection where applicable;
  • opt out of sale/share if applicable in the future.

Uninstalling the app does not delete your account or server-stored data. To delete your account, open Settings → Privacy Center → Delete account. If you cannot access the app, email privacy@cardcubbie.com; we may need to verify your identity.

10. Data retention

While your account is active, we keep information only as long as needed to provide the Service and for the purposes described in this Policy. Account deletion follows the narrower rules below, not a general business-operations retention exception.

When you confirm account deletion, access ends immediately and permanent deletion begins. We delete your account, personal information and data that can be linked to you, and your user-generated content, including owned gift cards, card numbers, PINs, photos, notes, and associated activity. Your identity and personal content are removed from shared records. There is no grace period or recovery option, and we cannot restore your deleted account or content.

Before deleting: You permanently lose access to gift-card numbers, PINs, barcodes, and photos stored in Card Cubbie. If you have no other copy, you may be unable to redeem remaining gift-card value. Reviewing your cards or downloading your data first is optional. A data export excludes full card numbers, PINs, and redemption images; it is not a redemption backup. Keep any original cards or other redemption information you need in a safe place outside Card Cubbie.

Subscriptions: Account deletion does not cancel Apple App Store or Google Play subscriptions. Manage or cancel your subscription separately through the store where you purchased it. Apple, Google, and gift-card issuers handle their own records and obligations; deleting Card Cubbie data does not delete their independent records or redeem a gift card.

Processor deletion and confirmation: Card Cubbie automatically requests and verifies deletion of your personal data held on our behalf by RevenueCat; you do not need to contact RevenueCat or make a separate request. Processor deletion can take time: while verification is pending, the request is processing, not complete. We send a completion receipt by email only after verifying deletion in our core systems and at RevenueCat, subject to the limited legal-record and backup rules below.

Anonymous analytics: Card Cubbie sends PostHog limited product-usage and app-performance events under a random in-memory identifier that resets when the app restarts or the signed-in account changes. We do not send PostHog your Card Cubbie account ID, email, account profile, wallet contents, or subscription information, and we disable person profiles, IP-address storage, location enrichment, session replay, console logs, and automatic exception capture. Because these analytics records are not linked to your Card Cubbie account, they cannot be selected using your account ID and may remain under PostHog's analytics retention practices after account deletion. We do not use them to restore your account or content.

Limited legal records: The only legal-record exception is the minimum separately controlled business records required by applicable tax or accounting law, or a specific legal preservation duty. If such records are required, they must be kept separately from the deleted account, with restricted access and use limited to that legal purpose, only for the required period or until the preservation duty ends. They must then be deleted and must not be used for account restoration, marketing, or product analytics. This does not authorize retaining raw profiles, analytics, or purchase history as a blanket exception.

Outside the deletion scope: Genuinely nonpersonal business information that cannot identify or be linked to you may remain. Cards and other resources belonging to other owners are not deleted merely because you once shared a Cubbie; your personal information and links to those records are removed. A user ID or linkable hash is not anonymous data.

Backups: Backup copies may persist for a limited time before being overwritten or deleted through the backup cycle. Such backup data is isolated from ordinary use and is not used to restore your account, for marketing, or for analytics. If a backup is restored for disaster recovery, deletions must be reapplied before the affected data returns to service. This is not an account-recovery period or permission to keep a usable copy of your account.

11. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These may include encryption in transit, encryption at rest for sensitive wallet data, access controls, logging, monitoring, and vendor review.

No system is perfectly secure. You are responsible for protecting your device, account credentials, and access to shared wallets.

Because gift card numbers, PINs, barcodes, and card images may have monetary value, you should treat access to your Card Cubbie account like access to a financial or payment-related account.

12. International transfers

Card Cubbie is based in the United States. We and our service providers may process information in the United States and other countries where privacy laws may differ from those in your location.

Where required, we use appropriate safeguards for international transfers, such as contractual protections, standard contractual clauses, adequacy mechanisms, or other legally recognized transfer mechanisms.

13. Children’s privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13 without legally required parental consent.

If you believe a child under 13 has provided personal information to us, contact us so we can take appropriate action.

Users under the age of majority should use the Service only with the involvement and consent of a parent or legal guardian.

14. U.S. state privacy notices

This section applies to residents of California and other U.S. states with consumer privacy laws, to the extent those laws apply to Card Cubbie.

14.1 Categories of personal information we may collect

Depending on how you use the Service, we may collect:

  • identifiers, such as name, email address, account ID, device identifiers, and IP address;
  • customer records information, such as account details and subscription records;
  • commercial information, such as subscription status, offer interactions, and gift card retailer/category information;
  • internet or electronic network activity, such as app interactions, logs, diagnostics, and analytics;
  • geolocation data, such as approximate location and precise location if enabled;
  • audio, electronic, visual, or similar information, such as uploaded gift card images or screenshots;
  • inferences, such as reminder preferences or offer relevance based on retailer/category;
  • sensitive personal information, such as account credentials, precise location if enabled, and gift card redemption data like card numbers or PINs.

14.2 Purposes

We collect and use these categories for the purposes described in “How we use information,” including service delivery, account management, wallet functionality, subscriptions, reminders, security, analytics, customer support, legal compliance, contextual advertising, and permitted first-party personalization.

14.3 Disclosure

We may disclose categories of personal information to the categories of recipients described in “How we share information,” including service providers, app stores, subscription providers, shared wallet members, affiliate partners when you click offers, legal/compliance recipients, and business transfer recipients.

14.4 Sale/share

As of the effective date of this Privacy Policy, we do not sell personal information or share personal information for cross-context behavioral advertising.

If this changes, we will provide required opt-out mechanisms.

14.5 Sensitive personal information

We do not use or disclose sensitive personal information for purposes that would require a right to limit under California law unless we provide the required notice and choice.

14.6 Your U.S. state privacy rights

Depending on your state, you may have rights to:

  • know/access personal information;
  • receive a portable copy of personal information;
  • correct inaccurate personal information;
  • delete personal information;
  • opt out of sale, sharing, or targeted advertising;
  • limit certain uses of sensitive personal information;
  • appeal a denied privacy request;
  • not be discriminated against for exercising privacy rights.

To exercise rights, contact us at privacy@cardcubbie.com or use in-app privacy controls where available. We may need to verify your identity before fulfilling a request.

15. European Economic Area, United Kingdom, and Switzerland privacy rights

If you are in the EEA, UK, or Switzerland, you may have rights to:

  • access your personal data;
  • correct inaccurate or incomplete personal data;
  • delete personal data;
  • restrict processing;
  • object to processing;
  • receive a portable copy of personal data;
  • withdraw consent where processing is based on consent;
  • lodge a complaint with a data protection authority.

You may exercise these rights by contacting us at privacy@cardcubbie.com or through in-app controls where available.

You also have the right to complain to your local data protection authority. We encourage you to contact us first so we can try to resolve your concern.

16. Brazil, Canada, Australia, and other regions

Depending on where you live, you may have additional privacy rights under local law, such as access, correction, deletion, portability, consent withdrawal, complaint, or objection rights.

We will respond to requests as required by applicable law.

17. Automated decision-making and profiling

Card Cubbie may use limited automated processing to provide reminders, organize wallets, suggest AI Smart Reminders, detect fraud/security issues, show contextual ads to free users, and tailor future first-party offers when the Personalized offers preference is enabled.

We do not intend to use automated decision-making that produces legal or similarly significant effects about you without appropriate notice and rights required by law.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice through the app, by email, or by other reasonable means.

The updated Privacy Policy will be effective when posted or as stated in the notice. Your continued use of the Service after the updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy.

19. Contact us

For questions or privacy requests, contact:

Arch Harbour LLC d/b/a Card Cubbie
support@cardcubbie.com