Privacy policy

1. Who this covers

This policy covers the Cardගොඩ desktop application for Windows and macOS, and this website. Cardගොඩ is made by an independent developer in Sri Lanka.

2. What stays on your computer

Effectively everything. The app stores its data in a database file on your own machine, under your user account:

• Your statements, transactions, cards, balances and payments
• The original statement files you imported, if you kept them
• Your monthly plans, categories and settings
• Your beta start date, used for the founder discount

Two things are kept in your operating system's keychain — Windows Credential Manager or the macOS Keychain — rather than in the database: your Google Gemini API key, and any statement passwords you asked the app to remember. They are never written into a backup file.

We cannot see any of this. There is no mechanism by which we could: nothing sends it anywhere, and there is nowhere for it to go.

3. What can leave your computer

Four things. The first three stay off until you turn them on; the fourth, anonymous usage counts (3.5), is on by default and one click from off. This is the section worth reading carefully.

3.1 AI statement reading (Google Gemini)

Most statements are read by a parser that runs entirely offline. When a layout defeats it — a scanned page, an unusual table — the app can send that statement's text to Google Gemini to be read.

• It uses a free API key you create in your own Google account. The request is made by your key, to your Google account, not through us.
• It happens per statement, only when the offline parser cannot cope.
• The text sent is the statement's contents, which includes transactions and may include your name and card number as printed.
• Google's handling of it is governed by Google's own terms for the Gemini API, not by this policy.
• If you never add a key, this never happens. Statements that need it will simply not import, and the app tells you so.

3.2 Google Drive backup

If you connect Google Drive, the app writes a compressed snapshot of your data to your own Drive.

• It goes to your Drive, not ours. We have no access to it.
• It uses the drive.appdata permission, the narrowest scope Google offers. That is a private per-application folder: the app cannot see, read or touch any other file in your Drive, and other apps cannot see what it writes there.
• Connecting is a deliberate action in Settings, and you can disconnect at any time.

3.3 Problem reports and ideas you send

When you use the report button, or send a feature idea, that message goes to a Google Firebase project we operate. Nothing is sent unless you press send. A report contains:

• What you wrote
• The app version, your operating system family (for example “Win32”), and the time
• Which page of the app you were on — the route only, never what was displayed on it
• For a statement that read incorrectly: a diagnostic summary, which you see in full before sending, with merchant names reduced to their shape unless you choose otherwise
• The statement PDF itself, but only if you tick the box asking for it. It is never attached automatically. If you do send one, it contains your name, card number and every transaction, and you should send it only if you accept that.
• An e-mail address, only if you type one in

No account identifier, device fingerprint or advertising ID is attached, because none exists.

3.4 Update checks

On launch the app asks GitHub whether a newer version exists. That request reveals your IP address to GitHub, as any web request does. It carries no information about you or your data, and it is the only thing the app contacts on its own.

3.5 Usage counts & error reports (on by default)

Unlike everything else in this section, this one is on from first launch rather than something you switch on — a usage count from almost nobody is not useful, and disclosed-but-on with an easy off switch is the more honest trade than a checkbox almost nobody ticks. It sends small, anonymous data to the same Firebase project as reports and ideas:

• Which page you opened, as a route only (for example /recurring), never what was on it
• Whether the app just started, whether a trial-ended screen was shown, whether a licence was activated, whether Drive backup was connected, or whether an export button was pressed — as a label, never the file itself or what was in it
• If something goes wrong: the error's name, a sanitized message, and a stack trace (which file and line, not any of your data). Sanitizing means your computer's username is replaced with a placeholder before anything is sent, and any run of three or more digits — the shape of an amount or a reference code — is replaced with ###. The same error is sent at most once per session, so a repeating bug cannot flood anything
• A random id generated on your computer, so repeat counts from the same install can be told apart from a new one. It is not derived from your hardware, your account or anything else about you, and cannot be turned back into who you are
• The app version and your operating system family

No merchant name, amount, statement, card number or e-mail is ever part of this — the app does not have a code path that could put one there. Turn it off anytime in Settings → About; that stops it immediately and deletes nothing already sent — ask us to delete it the same way you would for a report.

4. What this website does

This site counts visits with Google Analytics, through the app's Firebase project: which pages are read, where visitors came from, and how many press a download button. It sets no cookie unless you accept one in the box shown on your first visit. Without that, visits are counted anonymously, with no identifier linking one page or visit to the next. Advertising features and Google Signals are off either way. The cookies page has the details and lets you change your choice.

Fonts are loaded from Google Fonts, which means Google's servers see your IP address when a page loads. The tutorials are screenshots served from this site rather than embedded videos, so watching them contacts nobody else.

5. How long things are kept

Data on your computer stays until you delete it. Settings → Clear All Data removes it, and asks for the last four digits of one of your cards first so it cannot happen by accident. Uninstalling the app does not delete your data.

Reports you send are kept while they are useful for fixing what they describe. Any statement PDF you attached is deleted once the problem is resolved.

6. Your choices

• Leave the Gemini key unset, and nothing is ever sent for AI reading.
• Do not connect Drive, and nothing is ever backed up off your machine.
• Do not send reports, and turn usage counts off, and we learn nothing about your use of the app.
• Turn usage counts and error reports off at any time in Settings → About — it is on by default, but one click away from off.
• Ask us to delete a report or usage count you sent — get in touch and quote roughly when you sent it.

Because we hold no account for you, we cannot identify “your” data beyond a report you tell us about. That is a consequence of not collecting anything, and it is the trade we intend.

7. Children

Cardගොඩ is meant for adults managing their own credit cards and is not directed at children.

8. Changes

If this policy changes in a way that affects what leaves your computer, the change will be described in the release notes of the version that introduces it, not quietly edited in here.

9. Contact

Questions about this policy, or a request to delete something you sent: see the contact page.