What you store in the app
You can store card details (card number, cardholder name, dates, CVV, PIN, bank, notes), photos of your cards, and, in the Document Vault, documents (photos or PDFs) and notes. All of it is encrypted on your phone with a key that only your master password, or your phone's fingerprint, Face ID or Touch ID, can unlock. We never see it, and we can't recover it if you forget your master password.
Internet access
The Android app has no internet permission, and the iPhone app contains no networking code. The app contains no analytics, crash reporting, advertising or other third-party services that send data.
Backups
If you make a backup, the app creates one encrypted file, locked with your master password, and hands it to the place you choose: your phone's storage, a USB drive, or another app such as Google Drive or OneDrive through your phone's share sheet. That app, not Card Box, uploads it, under its own privacy policy. We never receive your backups.
Fingerprint, Face ID and Touch ID
Biometric checks are done by your phone's operating system. The app only learns whether a check succeeded; it never receives your fingerprint or face data.
Camera
The app uses the camera only when you choose to photograph a card or a document. Photos are encrypted at once inside the app and are never saved to your photo gallery.
Photos and files you add
When you add a photo from your gallery or a file (a PDF or an image) to the Document Vault, the app reads only the one you pick, encrypts it at once, and deletes the copy your phone's picker makes. It never sees the rest of your photos or files.
Notifications
Reminders are scheduled on your phone. They show only a card's nickname and last 4 digits.
Purchases
The Lifetime upgrade is sold through Google Play or the App Store. Payment is handled by Google or Apple under their privacy policies. The app checks the store's signed confirmation on your phone. The store gives us a record of each sale, such as an order number, the date, the price and the country, but never your card or payment details.
Crash reports
The app itself sends nothing. If you've chosen in your phone's settings to share diagnostics with app developers, Google or Apple may pass on reports of the app's crashes. They describe the crash and the phone model, not your cards.
Emails to us
If you write to us, we receive your email address and your message, and use them only to answer you. We don't add you to any mailing list. Please don't send card numbers, PINs or other card details.
Treepisode accounts
Card Box has no account of any kind. It isn't linked to a Treepisode account, and shares nothing with Treepisode's other apps or with this website.
Phone backups
The app's data is excluded from Google and iCloud device backups. Only backup files you make yourself contain your cards, documents and notes.
Children
The app is meant for adults and isn't directed at children.
Changes to this policy
If this policy changes, we'll update this page and the date at the top.