Effective October 31, 2026
Privacy Policy
This policy covers the hosted cardstock service at cardstock.guinetik.com, its API and its command-line client. cardstock is run by João Guilherme Ribeiro de Sousa (Guinetik), an individual based in Brazil (“we”). If you run cardstock yourself from the open-source code, you are the one holding the data, and this policy does not apply to your copy.
Short version: we keep what you need to sign in and the work you put on your boards. We do not sell it, we do not show you ads, and we do not track you across other sites.
What we collect
Your account
- Your email address and display name, and your password if you sign in with one. Passwords are stored hashed by our authentication provider; we never see them in plain text.
- If you sign in with Google, we receive your name, email address and profile picture from Google, and nothing else. See Google sign-in below.
- Your preferences, such as notification settings, and the command-line tokens you create (stored so we can check them, and revocable from your profile).
Your work
Projects, boards, cards, comments, checklists, imported markdown files, and the history of who changed what and when. This is the content of the service; it is stored so you and the people you share a project with can use it.
When you ask for an invite
The landing-page form sends us your email address and anything you write in the team and note fields, so we can reply.
What your browser stores
One sign-in session cookie, which is required for the service to work. Your browser’s local storage also keeps a few conveniences on your device only: your light or dark theme, pinned lanes, and which AI provider you last picked. We use no analytics, advertising or cross-site tracking cookies.
Server logs
Our hosting providers record standard request data, such as IP address, browser type and time of request, to run and secure the service.
How we use it
- To sign you in and keep your account secure.
- To store, display and sync your boards and cards.
- To send email you asked for or that the service needs: password recovery, sign-up confirmation, invitations, project transfer offers, and notifications about cards you watch. You can turn watch notifications off in your profile.
- To prevent abuse, investigate problems and keep the service running.
We do not sell your information, use it for advertising, or use your content to train AI models.
AI summaries
When you click Summarize on a card, that card’s saved title, summary, status, body, comments and checklist are sent to the AI provider you picked, OpenAI or Anthropic, to generate the summary. Nothing is sent unless you click. We keep a record of each generation (the result, the model used and token usage). Both providers process this data under their API terms, which do not allow it to be used to train their models; we ask OpenAI not to store it.
Google sign-in
If you choose to sign in with Google, we request only the basic openid, email and profile scopes. We use your name, email address and profile picture solely to create your cardstock account, sign you in, and show who you are to the people you work with. We do not access your Gmail, Drive, Calendar, contacts or any other Google data, and we do not share Google user data with anyone except the service providers listed below, as needed to run sign-in.
cardstock’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect cardstock from your Google account at any time at myaccount.google.com/connections.
Who else sees it
People you work with
Members of a project can see that project’s boards and cards, along with the name, email address and portrait of everyone in it. The project’s owner decides who is invited and can remove people.
Service providers
We rely on these companies to run cardstock, and share only what each needs:
- Supabase: database and authentication.
- Vercel: application hosting.
- Google: sign-in, if you choose it.
- OpenAI and Anthropic: AI summaries, only when you request one.
- Gravatar (Automattic): your portrait is loaded using a one-way hash of your email address. If you have no Gravatar, a generated pattern is shown instead.
- Our email delivery provider, to send the messages described above.
We may also disclose information if the law requires it, or to protect the rights and safety of our users or the service.
Where it is stored
Our providers may store and process data outside your country, including in the United States. Where data protection law requires it, those transfers rely on the providers’ standard contractual safeguards.
How long we keep it
We keep your account and work while your account exists. When you ask us to delete your account, we delete your personal information within 30 days. Work in projects owned by someone else stays with that project, since it belongs to their shared record, but we remove or anonymize your personal details from it where we can. Backups roll over and expire on their own schedule. Server logs are kept only briefly by our hosting providers.
Your rights
Wherever you live, you can ask us to show you the personal information we hold about you, correct it, export it, or delete it. You can also object to or ask us to limit how we use it. Most of your profile you can edit yourself; for everything else, email email@guinetik.com. We will answer within 30 days.
If you are in Brazil, you have the rights described in the LGPD (Lei Geral de Proteção de Dados). If you are in the European Economic Area, you have the rights described in the GDPR, and our legal bases are performing our agreement with you (running your account), our legitimate interest in keeping the service secure, and your consent where we ask for it. You may also complain to your local data protection authority.
Security
Data travels over HTTPS, access to projects is enforced in the database itself, and secrets stay on the server. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you.
Children
cardstock is not meant for anyone under 16, and we do not knowingly collect information from them. If you believe a child has given us information, email email@guinetik.com and we will delete it.
Changes
If we change this policy, we will update the date at the top. If the change is significant, we will tell you by email or in the app before it takes effect.
Contact
Questions, requests or complaints: email@guinetik.com. See also our Terms of Service.