Privacy Policy

Last updated: October 22, 2026

CardEnvoy (“the App”, “we”, “us”) is operated by Aydahwa Enterprise FZ LLE. This policy explains what we collect and how we use it when you use our web application athttps://cardenvoy.com, our iPhone app and our Android app.

1. Information we collect

• Account information: your email address, your name (optional) and, if you sign up with a password, a one-way hashed password.
• If you sign in with Apple or Google: the provider tells us a unique account identifier, your email address (with Apple this can be a private relay address if you choose “Hide My Email”), whether that email is verified and, if you allow it, your name. On the web, Google may also share the link to your Google profile picture, which we store with your account but do not display. We never receive your Apple or Google password. We also store the sign-in tokens the provider issues for that sign-in (such as an ID token and, where the provider issues them, access and refresh tokens) with your account; the Apple token is used to revoke CardEnvoy’s access to your Apple account when you delete your account. The provider learns that you signed in to CardEnvoy; its own privacy policy applies to that sign-in.
• Passkeys (Face ID, fingerprint or screen-lock sign-in): if you create a passkey in the iPhone app, the Android app or in your browser, we store its public key, an identifier, the date it was created and last used, and a label. The private key and your Face ID, Touch ID or Windows Hello data stay on your device and in your iCloud Keychain, Google Password Manager or other password manager; we never receive them. On Android, the passkey is created and held by Android’s Credential Manager and Google Password Manager.
• Card content you enter: name, job title, organization, phone number, email, address, website, and any profile photo or company logo you upload. In the apps you pick a photo with the system photo picker or take one with the camera; we only receive the pictures you choose to use on a card, never your whole photo library. The iPhone app asks for camera access only if you choose to take a photo; the Android app uses the system camera and needs no camera permission. Finding a face to centre your profile photo is done on your phone (Apple Vision on iPhone, Google ML Kit on Android); the picture is not sent anywhere for that purpose.
• Purchase records: which cards you have unlocked and an Apple, Google Play or Stripe transaction reference (for Google Play, the order ID and purchase token, which we check with Google to confirm the purchase). We never see or store your payment card number: payments are handled by Apple (in-app purchases on iPhone), Google Play (in-app purchases on Android) or Stripe (on the web).
• Apple Wallet pass updates: when you add a CardEnvoy pass to Apple Wallet, your device registers with our server (a device identifier and a push token) so that the pass can be kept up to date. These registrations are deleted when you delete your account.
• Technical data: standard server logs (IP address, browser/app type, time of request) kept for a short period for security and troubleshooting. When a script error occurs in our website, your browser may also send us a technical error report (the error message and stack trace, and the address of the page without its query part). We do not use advertising or analytics trackers and we do not track you across other companies’ apps or websites.

2. How we use it

• To create your digital business card, its QR code and your Apple Wallet or Google Wallet pass.
• To let you sign in (with a password, a passkey, Apple or Google), edit and manage your cards.
• To process purchases and unlock Wallet downloads.
• To respond to support requests and keep the service secure.

3. Your public card page

Each card has a public page (https://cardenvoy.com/c/…) with a long random address. Anyone who has the link or scans your card’s QR code can see the details on that card (name, title, organization, phone, email, address, website, photo and logo) and save them to their contacts. The page is not indexed by search engines. You choose what goes on a card; you can also set a card’s QR code to contain only the contact text instead of the page link.

4. Who we share data with

We do not sell your personal information. We use these service providers only to run the App:

• Apple (App Store in-app purchases, Apple Wallet, Sign in with Apple) and Stripe (web payments). Google also processes Google Play in-app purchases (see the next item).
• Google (Sign in with Google, Google Play in-app purchases, Google Wallet and Google Password Manager passkeys on Android). When you tap “Add to Google Wallet”, we send Google the content of that card (name, job title, organization, phone, email, address, website, photo and logo) so it can create the pass in your Google Wallet. The photo and logo are served to Google from long random links that exist only for cards you have unlocked. Google’s own privacy policy applies to the pass once it is in your Google Wallet.
• Google Workspace / Google Drive, where uploaded photos and logos are stored.
• Brevo, which sends our password-reset emails (your email address and the content of the message).
• Cloudflare, which delivers the website and protects it (CDN and web application firewall), and Google Cloud Platform, which hosts the service and its database.

5. Storage and security

Data is sent over encrypted HTTPS connections. Passwords are stored using one-way hashing. Uploaded photos and logos are stored in Google Drive and are delivered through image addresses on our website (cardenvoy.com/api/media/…). Those image addresses do not require a sign-in: anyone who has the address of a photo or logo can open it, and the addresses are used on public card pages and for Wallet passes. Treat a photo or logo you upload as visible to anyone who obtains its link. We keep database backups to be able to recover the service. No system is perfectly secure, but we take reasonable measures to protect your information.

6. Your choices and deleting your data

You can delete your account at any time in the iPhone or Android app (Settings → Delete Account). This permanently removes your account, the link to your Apple or Google sign-in, your passkeys, your cards, your purchase records, your Apple Wallet pass registrations and your uploaded photos and logos. If you used Sign in with Apple, we also revoke CardEnvoy’s access to your Apple account when you delete your account. How to delete your account and data, including by email, is described at cardenvoy.com/account-deletion. You can also request access, correction or deletion by emailing support@5usd.shop. Apple Wallet and Google Wallet passes you already added stay on your device or in your Google account until you remove them.

After you delete your account we keep payment references (the type and date of the entitlement event and the Apple, Google or Stripe transaction reference) for refund handling and financial reconciliation. They are kept without a link to your account: the card identifier in them is replaced by a one-way pseudonym and any free-text note is removed. Copies of our rotating database backups, including an encrypted off-site copy, may still contain deleted data for up to 56 days after deletion, until those backups are overwritten.

You can also remove CardEnvoy’s sign-in access yourself at any time: for Apple, in Settings → your name → Sign-In & Security → Sign in with Apple; for Google, at myaccount.google.com/permissions. Doing so does not delete your CardEnvoy data; use the deletion options above for that.

7. Signing in with the same email in different ways

If you sign in with Apple or Google using an email address that already has a CardEnvoy account, and the provider has verified that address, we connect both to the same account so your cards stay together. For security, the password on that account is then removed and you sign in with Apple or Google from then on. Without a verified email, we do not connect the accounts.

8. Children

The App is not directed to children under 13 and we do not knowingly collect personal information from them.

9. Changes

We may update this policy; the “Last updated” date above will change when we do.

10. Contact

Aydahwa Enterprise FZ LLE — support@5usd.shop