Last updated 2026-08-18. This policy covers both the Kardhaus iOS app and this website. They are very different documents joined together, so they are kept separate below. The controller is the developer of Kardhaus, reachable at hello@kardhaus.com.

The iOS app

The app transmits nothing, to us or to anyone

Kardhaus contains no networking code. There is no URL session, no API key, no analytics endpoint and no server of ours anywhere in the app. It is not that we promise not to look — there is no channel through which we could. Airplane mode is the test, and every feature passes it.

What the app holds. Card images, the text recognised from them, your notes, tags, and — if you allow location access — the place you were when you saved a card. All of it lives in the app’s own storage on your iPhone.

Where it syncs. If iCloud is on for Kardhaus, that store syncs through your own iCloud private database, under your Apple Account. That is a channel between your devices and Apple, not one that includes us: we are not a party to it and have no ability to read it. Switching iCloud off for Kardhaus in iOS Settings stops the sync and leaves the data on the device.

Recognition. Text is read by the OCR built into iOS. A second pass uses Apple’s on-device language model to sort the recognised text into fields. Both run on the phone. No card image and no card text is sent anywhere for processing.

Permissions, and what each is actually for. Camera — photographing cards. Location, optional — recording where you were given a card. Microphone and speech recognition — searching by voice, processed on device and not retained. Contacts — only written to, and only when you ask to save a card. Photos — only written to, and only when you ask to save an image. Every one of these can be refused, and the app keeps working without it.

Purchases. Handled directly by Apple through StoreKit. We never see your payment details, and we deliberately use no purchase-analytics service, so there is no third party linking a purchase to a person either.

No SDKs. No advertising, attribution, crash-reporting or analytics SDK is embedded in the app. There is no advertising identifier, no App Tracking Transparency prompt, and no device fingerprinting, because there is nothing that would use them. The App Store privacy label reads *Data Not Collected*.

If this ever changes. Any future feature that sends a card off the device will be off by default, will name the company receiving it on the screen where you switch it on, and will be documented here before it ships — not delivered in a silent update.

Children. Kardhaus is a tool for working adults and is not directed at children. It collects nothing from anyone, of any age.

No account, and how to delete everything

There is no account. Nothing to register, no email address required, no password, no profile. That is also why there is no “delete my account” button anywhere in the app: there is no account of yours to delete, and no copy of your library on our side either.

How long the app keeps things. For as long as you keep them. There is no expiry and no retention schedule, because the data sits on your device and the decision is yours.

Deleting it. Removing the app deletes the library it holds on that iPhone. If iCloud sync was on, a copy remains in your own iCloud until you remove that too: iOS Settings → your name → iCloud → Manage Account Storage → Kardhaus → Delete Data. We can do neither of those for you, and neither can be undone afterwards.

Website analytics

Until you accept the banner, this site loads nothing from any other company. No analytics, no fonts, no embeds, no pixels. That is checkable in about ten seconds: open your browser’s network tab and reload — every request goes to kardhaus.com and nowhere else.

Google Analytics 4 — on by default, off in one tap

GA4 sets cookies, so it stays a choice you can change at any time. Outside the EEA, the UK and Switzerland it is on when you arrive, and a notice on your first visit says so and offers Turn it off in one tap. Inside the EEA, the UK and Switzerland it is the other way round: Google Consent Mode v2 starts with `analytics_storage` set to denied for those regions, and `gtag.js` is not requested from Google at all until you tap Allow. Either way `ad_storage`, `ad_user_data` and `ad_personalization` stay denied everywhere — including after you agree — so this traffic never becomes an advertising audience. A refusal is kept in your browser as `kh-consent` and honoured on every later visit.

If you do allow it, GA4 receives page views, referrer, approximate location derived from your IP (GA4 does not retain the IP itself), device and browser type, and a `waitlist_signup` event if you sign up. Google Signals and ad personalisation are disabled, so the data is not used to build advertising audiences. Your choice is stored in your browser under `kh-consent` and is never asked twice.

GA4’s Enhanced Measurement is on, which adds a handful of automatic events alongside page views: how far down a page you scrolled, clicks on links that leave this site, file downloads, and the fact that you started or submitted the wishlist form. It records that those things happened, not what you typed — the contents of the form reach us through our own endpoint, described below, and never through Google.

To change your mind, clear this site’s data in your browser settings and the banner will appear again.

There are no Google Fonts, no Google Tag Manager container, no advertising pixels and no third-party embeds on this site.

The wishlist

If you submit the wishlist form, we store the email address you type, the region you optionally select, anything you write in the optional “what would make you switch” box, the page you submitted from, your locale, the country your request came from, and a timestamp. We also store a coarse, hashed rate-limit token derived from your request so the form cannot be flooded; it is not reversible to an IP address and is discarded on a rolling basis.

The comment box is free text, so please treat it as such. It is read by a person and used to decide what gets built. Do not put anything confidential in it, and please do not put a third party’s contact details in it.

Purpose. To email you when the TestFlight build opens and when the app launches, to attach your free scan allowance to that address, and to prioritise what to build.

Legal basis. Your consent, given by submitting the form.

Retention. Until launch plus 90 days, or until you ask us to delete it — whichever is sooner. Unsubscribing deletes the record rather than flagging it.

Where it is stored, and who processes it. The form posts to kardhaus.com itself, never to a third-party form service, so no other company sees the submission as it happens. The record is written to Cloudflare D1 in our own account, and mirrored into a private Google Sheet we control so the list can be read without a database client. Google therefore processes your address and your comment as a storage provider. It does not receive your IP address or your user agent: the copy is sent from our server, not your browser.

Recipients beyond that: nobody. The list is not sold, rented, shared, or used for anything other than the two emails described above.

Your rights. Access, correction, deletion and withdrawal of consent. Email hello@kardhaus.com and it is done, with no verification hoops beyond replying from the address in question. Deletion removes the record from both the database and the Sheet.

If you asked for the Android test. The address you leave on the Android page goes onto Google Play’s tester list for Kardhaus, which means Google receives it — that is how Play sends the invitation and decides who may install the test. It is used for that and nothing else, kept until the test ends or you ask us to remove it, and taken off the list whenever you ask.

Contact

hello@kardhaus.com — privacy requests, deletion requests, accessibility problems, or anything else. It is the only address we use, and a person answers it.