Version free-open-beta-v1. Effective when this version is published on Cardmaku.

Cardmaku Privacy Policy

Notice

This is the Cardmaku Privacy Policy for the free open public beta (version free-open-beta-v1). Effective when this version is published on Cardmaku. It is published as a notice. Using Cardmaku is not treated as agreement to it, and no acceptance is recorded.

1. Who is responsible

Cardmaku is operated by Noena LLC, a California company (“we”). This policy covers the free Cardmaku service, currently in open public beta, offered in Taiwan, Japan and the United States. It is a notice describing our actual data practices; it is not a request for your consent and does not rely on your agreement. Cardmaku accounts are for adults who are legally able to enter into a contract where they live.

2. What Cardmaku handles

• Account and sign-in data. We use Clerk to provide sign-in and manage sessions. Cardmaku is in open public beta, and sign-in currently runs on a Clerk testing configuration. Cardmaku uses your sign-in identifier and email address to associate your session with your account and household. Depending on how you sign in, Clerk may also hold your name and other sign-in details you give it.
• Wallet. The cards and memberships you say you hold, and any details you add about them.
• Household and traveller records. Names and relationships of people travelling with you. You can optionally add a date of birth, nationality or nationalities, and country of residence for a traveller.
• Trips. Trip details you enter and the checks Cardmaku records for them.
• Cookies and browser storage. The website and app use cookies and browser storage for sign-in and functional state, including public wallet selections. These include storage from Clerk (such as session and client cookies) and Cardmaku's own storage (such as a public wallet selection and an authenticated-session marker). The hosting platform may also set a cookie. We have not determined that every one is strictly necessary. You can clear or block cookies and site storage in your browser; doing so may sign you out or reset functional settings. Clearing browser data does not delete your account or the records we hold.
• Technical and diagnostic data. Our servers and providers may record technical information and errors, which can include account or record identifiers. We have not completed an inventory of these logs or their settings.
• Support emails. What you send when you email us, together with your email address.

Do not send passwords, authentication codes or complete payment-card numbers in a support email. The free service does not take payments.

3. How information is used

To sign you in, show your wallet, household and trips, compute benefit checks, show the sources behind them, keep the service secure and working, and respond to your requests. A displayed source helps you check a result; it is not a guarantee of accuracy.

4. Service providers

We use Clerk to handle sign-in and sessions. Cardmaku is hosted on Replit and stores application records using Replit's database service. These providers handle information for those purposes. We have not verified, and do not state here, the regions in which they process or store information, their backup arrangements or their log retention. Information you give to external sources or services that Cardmaku links to is handled under their own terms and privacy practices.

5. Other people's information

Traveller records can describe people other than you, including children. Add another person's details only if you have the authority to provide them, and share only what is needed. For a child, you must be the parent or legal guardian, or otherwise hold legal authority to provide the child's information. A child's traveller record is separate from an account and gives the child no account access. We do not currently run a separate process to collect or verify a parent's or guardian's consent.

6. Keeping and deleting information

You can delete individual items in the app, such as a traveller, a wallet item or a trip. Deleting an item is not deleting your account, and it does not necessarily remove every related record or copy. For example, deleting a trip removes the trip and several of its derived records, but we have not verified that it removes every related record, such as supplier-order or payment-attempt records.

Whole-account deletion is not currently available in the app. Signing out is not deletion. To ask about deleting your account, email josephh@outlook.com with the subject “Cardmaku account deletion request.” Sending an email is a request, not an automatic deletion. We do not promise a completion deadline, and we do not promise that backups, provider-held copies or logs will be deleted.

A complete, verified retention schedule is not yet available. Do not assume that inactivity, signing out or removing one item erases your other records. Provider-held copies, logs and backups have not been fully inventoried. This is an unresolved operational limitation, not permission to retain information indefinitely or an exception to applicable legal duties.

7. Your choices and rights

You can ask about access to, correction of or deletion of your information by email. Rights under the law that applies to you remain available whether or not they are described here, and this policy does not limit them.

When you send a request, we may ask you to verify your identity. If the request concerns a household or another traveller's information, we may also check that you have authority over that information. We will explain what action we took or, if we could not act fully, what the limitation is. We cannot promise automatic erasure or a voluntary completion deadline. Any response or action required by applicable law remains required.

8. Contact

For privacy questions or requests, email josephh@outlook.com with the subject “Cardmaku privacy request.” Joseph personally monitors this inbox. Correspondence address: #101 Fuxing North Road, Taipei taiwan. Email is the primary contact method listed. Sending a request does not guarantee completion or a response time.

9. Changes

If we change this policy materially, the new version will have its own version identifier and take effect when it is published on Cardmaku. Where applicable law requires your explicit agreement to a change, we will ask for it and will not treat continued use or silence as your agreement.