Privacy Policy

Connected By Cardboard recognizes that privacy and trust are important parts of building a successful community.

This Privacy Policy explains the categories of information we collect, how we use it, how it may be shared, and the choices available to members.

Our goal is to operate responsibly, protect member information, and be transparent about our practices.

Depending on how members use the Service, we may collect the following categories of information.

Account information

• Email address.
• Authentication identifiers.
• Password credentials handled by our authentication provider.
• Account registration and security information.

Passwords are managed through the authentication system and are not stored as readable passwords in our public application tables.

Age information

• Date of birth for age eligibility verification.
• Age information where the member has chosen to display it.

Full birthdates are stored separately from public profile information.

Profile information

• Display name.
• Username.
• Collector card serial number.
• Biography.
• General city or regional location.
• Connection preferences.
• Trading card games and formats.
• Play styles.

Photographs

Photographs uploaded by members are processed and stored for profile display and moderation.

The current implementation processes uploaded images and removes embedded EXIF and GPS metadata before storage.

Photographs remain pending until approved through the moderation process.

Interactions

We process information associated with:

• Likes and passes.
• Matches.
• Messages.
• Blocking.
• Reports.
• Account restrictions.
• Moderation actions.

Security and technical information

We may process technical information necessary to authenticate members, maintain sessions, secure the Service, troubleshoot problems, prevent abuse, and maintain reliable operations.

This may include technical logs and diagnostic information generated by our infrastructure and service providers.

The current application uses general location information supplied through member profile settings, such as city and state or region.

The current implementation does not request GPS coordinates or continuous precise device-location tracking.

As the platform develops, we may introduce optional location-based functionality, such as nearby events, local game store discovery, or distance-based discovery features.

If future functionality requires precise location or additional device permissions, we will provide appropriate explanations, permission requests, and privacy disclosures before introducing that functionality.

Members should not be required to grant unnecessary location permissions to use unrelated core features.

We may use collected information to:

• Create and maintain member accounts.
• Authenticate members.
• Display collector profiles.
• Provide discovery and matching.
• Support messaging and connections.
• Provide community and event features.
• Improve platform functionality.
• Protect account security.
• Detect and prevent fraud and abuse.
• Review reports and moderate content.
• Respond to support requests.
• Comply with legal obligations.
• Support legitimate business operations.

Information will be used in ways consistent with the purposes disclosed to members and applicable legal requirements.

We use third-party service providers to help operate the platform.

These may include providers of:

• Hosting and application infrastructure.
• Database services.
• Authentication.
• Private file storage.
• Email delivery.
• Security and technical services.

The current project uses Lovable Cloud infrastructure and Google Fonts as an external typography resource.

Underlying infrastructure and providers may change as the business develops.

These providers may process information as necessary to perform their services.

We may also disclose information when reasonably necessary to:

• Comply with applicable law or valid legal process.
• Respond to legitimate governmental requests.
• Protect members from credible threats.
• Investigate fraud, abuse, or security incidents.
• Protect our rights and the integrity of the Service.

The current application does not contain third-party advertising networks, advertising pixels, or third-party behavioral advertising SDKs, according to our latest technical audit.

We do not currently operate a behavioral advertising business.

We may pursue individually approved sponsorships, promotional arrangements, and partnerships with established trading card game companies and related brands.

Sponsored content may appear within the Service and will be identified appropriately.

We may change our commercial model as the business evolves. If we introduce advertising, marketing, analytics, or other commercial activities that involve additional processing or sharing of personal information, we will update our disclosures and obtain any permissions or consent required by applicable law and platform policies before implementing those practices.

Connected By Cardboard may undergo changes in ownership, financing, corporate structure, or business operations.

If the business is involved in a merger, acquisition, corporate restructuring, financing, or sale of all or substantially all of its assets, information associated with the Service may be transferred as part of that transaction where legally permitted.

Any such transfer will be handled in accordance with applicable law and relevant platform requirements.

Where required, members will receive appropriate notice.

A successor or acquiring organization may continue operating the Service or use transferred information subject to applicable legal obligations and any required additional notices or permissions.

This provision does not grant blanket permission to sell personal or sensitive member information as a standalone product.

The current technical audit identified no third-party analytics SDKs, advertising tracking pixels, or third-party advertising networks.

Our hosting, authentication, database, and other infrastructure providers may generate technical logs needed to maintain security, reliability, and service functionality.

We may introduce additional analytics or technical measurement tools in the future where appropriate and legally permitted.

Any additional collection or tracking will be disclosed, and required permissions or consent will be obtained.

Uploaded photographs are stored in private storage.

Photographs are subject to moderation before becoming approved collector card artwork.

Authorized administrators can approve or reject submitted photographs.

We may remove or restrict content that violates our policies or applicable law.

Private messages are intended for the participants in a conversation.

The application currently uses automated content screening to prevent certain prohibited material from being submitted.

Reported message evidence may be reviewed by authorized personnel when necessary to investigate abuse or enforce community standards.

We do not use private messages for third-party behavioral advertising.

Members may delete their accounts through the in-app account deletion feature.

We also provide an external account deletion request process.

Account deletion removes associated information from the active application database, including profile information, photographs, games, interactions, matches, messages, blocks, and other associated records, subject to legitimate retention exceptions.

Certain limited information may remain when reasonably necessary for:

• Legal compliance.
• Security investigations.
• Fraud prevention.
• Enforcement of account bans.
• Dispute resolution.
• Legitimate operational purposes.

The current application may retain an irreversible SHA-256 email hash for previously banned accounts to help prevent ban evasion.

Minimal audit records may also remain without preserving ordinary profile content, photographs, or private message bodies.

Protected backups and infrastructure systems may retain information temporarily until normal deletion cycles are completed.

We use technical and organizational measures intended to protect member information.

These include:

• Database access controls.
• Row-Level Security.
• Restricted access to private profile information.
• Private photograph storage.
• Server-side authorization.
• Content screening.
• Administrative access restrictions.
• Security audit records.

No electronic system can guarantee absolute security.

Connected By Cardboard is intended exclusively for adults aged 18 and older.

We do not knowingly permit individuals under 18 to register or use the Service.

If we discover an account belonging to an individual under 18, we may restrict or terminate that account and take appropriate action regarding its information.

Depending on your location, you may have rights to:

• Request access to personal information.
• Request correction of inaccurate information.
• Request deletion.
• Object to or restrict certain processing.
• Withdraw consent where applicable.
• Request information about how your information is used.

Contact us to submit a privacy request.

We may need to verify your identity before responding.

The application uses third-party infrastructure and may load external resources such as fonts.

These services may process technical information as part of providing their functionality.

External websites and services linked through the application are governed by their own terms and privacy policies.

This Privacy Policy may change as the application, business, infrastructure, and applicable legal requirements evolve.

We will update the policy when our practices materially change and provide additional notices or obtain consent where required.

For privacy questions, data requests, or account deletion assistance: CardboardHelpDesk@yahoo.com