This English policy applies to users outside the Republic of Korea and reflects the EU/UK GDPR and California (CCPA/CPRA) requirements. Users residing in Korea are covered by the Korean version (see §13).
1. Information We Collect
| Category | Data | Required? |
|---|---|---|
| Sign-in — Apple | Apple user ID, the email address Apple shares (may be a private relay address) / your name | Required / optional (if you choose to share it; used only to prefill your display name) |
| Sign-in — Google | Google account ID, email address / your name | Required / optional (if Google provides it; used only to prefill your display name) |
| Sign-in — email | Email address, one-time code (stored only as a hash) | Required |
| Profile | Handle, display name / bio, avatar | Required / optional |
| Cards | Photos you upload (location and other metadata removed), card titles and text | Required to create cards |
| Activity | Cards, drops, gifts, trades, Offers, albums, and follows you make, and their history; reports you send and accounts you block | Required |
| Purchases | Purchase records (product, transaction ID, date, subscription status) | Required when you buy |
| Automatically | Access logs (IP address, time of access) | Required |
| Marketing | Whether you agreed to receive marketing | Optional |
- How we collect it: from what you enter or upload in the app, from your sign-in provider (Apple or Google) with your permission, and automatically as you use the Service.
- What we don't collect: precise location, your contacts, advertising identifiers, payment card details (handled by the app stores), government ID numbers, or sensitive data. Background removal on cards runs on your device, and no biometric data is sent to our servers.
- New data: if a new feature needs additional personal data (for example, shipping physical cards or push notifications), we will update this policy in advance under §11 and, where required, ask for your consent when you first use that feature.
2. How We Use It & Legal Basis (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Create and operate your account; provide the Service (create, drop, gift, trade, Offers, collect) | Performance of a contract |
| Show your public profile, public albums, and cards you share to other users and through share links | Performance of a contract |
| Deliver credits and subscription benefits, verify purchases, and handle refunds | Performance of a contract; legal obligation |
| Prevent abuse and fraud, secure the Service, and handle reports | Legitimate interests |
| Answer your questions and send service notifications (trades, drops, Offers) | Performance of a contract; legitimate interests |
| Send marketing and product news | Consent (opt-in; withdrawable anytime) |
| Comply with legal obligations | Legal obligation |
3. Retention
| Data | How long we keep it |
|---|---|
| Account data (sign-in data, profile) | Until you delete your account; deleted (anonymized) immediately on deletion |
| Card and transaction history | Kept to preserve editions and ownership history; after account deletion it no longer identifies you and shows "deleted user" |
| Photos used on cards | As long as the card exists. Cards you shared stay in other users' binders even after you delete your account |
| Email sign-in codes | 10 minutes; deleted after use or expiry |
| Access logs (IP address, time of access) | Up to 3 months |
| Purchase records | As required by law (under Korean e-commerce law: 5 years for contract, withdrawal, and payment records; 3 years for complaint records) |
| Marketing consent | Until you withdraw it or delete your account |
4. Processors & Third Parties
We do not sell or share personal data for advertising. We use the following service providers, solely to run the Service and under data-processing terms. We disclose personal data to other third parties only with your consent or where required by law (for example, a valid legal request).
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting | US |
| Neon (Databricks) | Database hosting (AWS) | US |
| Cloudflare, Inc. | Image storage and delivery | Global |
| Plus Five Five, Inc. (Resend) | Sign-in email delivery | US |
| Apple Inc. | Sign in with Apple; App Store in-app purchases | US |
| Google LLC | Google Sign-In; Google Play in-app purchases | US |
5. International Data Transfers
Your data is processed in the United States and other countries where our providers operate. Where required, transfers rely on appropriate safeguards (e.g., EU Standard Contractual Clauses) or an applicable adequacy decision.
6. Your Rights
GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may also lodge a complaint with your local supervisory authority. California (CCPA/CPRA): right to know, delete, correct, and opt out of "sale"/"sharing." We do not sell or share personal information, and we do not discriminate against you for exercising rights. To exercise any right, use Settings in the app (edit your profile, turn off marketing, or delete your account) or email support@mintage.cards. We may need to verify your identity, and we respond within the time required by law (generally one month under the GDPR and 45 days under the CCPA).
7. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal or similarly significant effects.
8. Children
The Service is not intended for anyone under 14. We do not knowingly collect data from children under 14 (and, for US users, not under 13 per COPPA). Age is confirmed at sign-up.
9. Security
We use administrative, technical, and physical safeguards appropriate to the risk to protect personal data against loss, theft, unauthorized access, and alteration. No method of transmission or storage is completely secure, but we work to protect your data and review our safeguards regularly.
10. Cookies & Tracking
- Our website (mintage.cards) uses one cookie to remember the language you choose. You can block cookies in your browser; you may then need to choose your language again.
- The app does not use cookies; your sign-in is kept in your device's secure storage (Keychain).
- We do not collect advertising identifiers, track you across other apps or websites, or use third-party advertising or analytics tools. Because we do not track you, browser "Do Not Track" signals do not change how the Service works, and no third parties collect your personal information through our Service for their own purposes.
11. Changes
We review this policy at least annually and update it when our practices change. When we change it, we post the updated policy with its effective date at least 7 days in advance; for material changes (for example, new categories of data, new purposes, or new recipients), we will make reasonable efforts to post them at least 30 days in advance and to notify you individually (for example, by email or in the app). Previous versions remain available on our website.
12. Contact & Privacy Officer
This policy is provided by Binary Star (the "Operator"). Privacy Officer: MUN SUNG MIN (Representative). Privacy inquiries and requests: support@mintage.cards.
13. Language
This policy is provided in Korean and English. The Korean version applies to users residing in the Republic of Korea, and the English version applies to all other users. If a translation into any other language differs from the English version, the English version prevails.