CardMerryWho is responsible for your data
The data controller is Marcin Chuć, based in Wrocław, ul. Przyjaźni 6c/3, NIP 8842279975, REGON 020349997 — operator of the dobry.doctor platform. Data protection contact: [email protected].
The key point in one sentence
Your cards are encrypted on your phone with a key that only you have — we don’t have it, so we can’t see your cards, numbers or passwords, even if we wanted to. We also don’t know which shops you have cards for.
What data you save in the app
The card name, card label (e.g. “Work 2”), number and barcode, the card holder (e.g. “Mum”), a note, the card colours, places you link to the card yourself, fields required by the card issuer (e.g. a login, password or PIN for checking points), your points balance and — for family — your loved ones’ names (as they introduced themselves) and their public keys. This is not health data.
Where your data is
- On your phone — always encrypted. The key is created on the phone and protected by the lock you choose (phone lock, PIN or no lock).
- On the server — only if you connect an account and turn on sync. Only an encrypted copy is stored there: to us it is an unreadable string of characters.
- Key on the server — only if you turn it on yourself. We then store your key locked with your key password (we don’t know the password). This lets you use your cards in a browser and recover them on a new phone.
- dobry.doctor account — sign-in is handled by auth.dobry.doctor (separate privacy policy). The app receives your account ID, email address and first name — the name is used for greetings and as a “from” suggestion when sending cards.
Card for a nearby shop
To show the card for the shop you are in when you open the app, your phone downloads the ENTIRE list of shops from the catalogue (regardless of which cards you have) and calculates the distance itself. Your location never leaves the phone and is not stored. You can turn this off in More → Card in shop, or by not allowing location access.
Scanning a card
The camera is used to read the code and the card colours (the main colour and accents — so the card in the app looks like the real one). The image is analysed on your phone and is neither stored nor sent anywhere; only the colours are kept in the card.
Anonymous card patterns
When you add a card, the app sends an anonymous pattern of it to our server so we can analyse and improve the app: the catalogue card or the name you gave the card, the barcode type and an ANONYMISED number layout — every digit replaced with 9, every letter with A (capital) or a (lower case), e.g. “BCD12345” → “AAA99999”. We never send the card number or the code content, the card label, holder, issuer fields, note, colours or photos. The pattern is not linked to your account, device or IP address. Patterns help us match covers and code types in the catalogue and format the cards you add next correctly. You can turn this off in More → Privacy → Anonymous card patterns.
Sending cards to your loved ones
A card link contains the key after the “#” sign — browsers and apps never send this part to the server. The server stores the card encrypted with that key until the link expires (1, 7 or 30 days) and only knows how many times the link was opened. In a family, the server knows which accounts are connected (who with whom) and stores encrypted cards waiting to be collected — without their content. You can revoke a link or remove a person from your family at any time.
Points balance
If the card issuer supports it, the app asks their server for your points balance — with the card number and the fields they require (e.g. a PIN). Your phone sends the request directly to the issuer. For some issuers our server relays it: it passes on the request and response, stores nothing and does not link it to your account.
Notifications
If you turn on notifications, we store your device token to let you know that someone in your family sent you a card or joined your family. Notifications never contain card data. They are delivered by Google (Firebase Cloud Messaging) and Apple (APNs) under data processing agreements and standard contractual clauses.
Companies — card keepers
A card issuer (e.g. a shop) working with us can describe their card in the catalogue: logo, design, shop locations and how to check points. They cannot see your account or your other cards; if they ask for it, they only learn that their card was added to or removed from CardMerry (see “Notice for the card issuer” below).
Notice for the card issuer
Some card issuers (e.g. Brilliant Care — Karta DIAMENTY) want to know that their card is in CardMerry — just like with Apple Wallet and Google Wallet. When you add, delete or change the number of such a card, the app sends the issuer, through our server, the card number and the event (“added” or “removed”), signed with the CardMerry key so the issuer knows it comes from us. The issuer already knows its card number — it only learns that the card is in CardMerry. We send nothing else (no account, name, card fields, balance or location), and our server stores none of it. This applies only to cards whose issuer asked for it; it is part of the service described in the terms of service and cannot be turned off for such a card — if you don't want the issuer to know, don't add its card to CardMerry.
Trademarks
The logos, names and card designs shown are the property of their respective owners and are displayed solely to identify cards. Their use does not imply any partnership, sponsorship or endorsement by the owners — unless a card is marked as managed by its issuer.
Legal basis
- The app, account, sync, family and points balance — performing the service you request (Art. 6(1)(b) GDPR).
- Notifications — your consent (Art. 6(1)(a) GDPR); you withdraw it by turning notifications off.
- Anonymous card patterns — our legitimate interest: analysing and improving the catalogue and the app (Art. 6(1)(f) GDPR); you can turn them off.
- Notice for the card issuer — performance of the contract, i.e. the service described in the CardMerry terms of service (Art. 6(1)(b) GDPR), and the issuer's legitimate interest: running the loyalty programme you belong to (Art. 6(1)(f) GDPR).
- Security and the technical log (without your card content) — our legitimate interest (Art. 6(1)(f) GDPR).
How we really protect your data
- On-device AES-256 encryption — before anything leaves the phone.
- The key never leaves the phone in plain form; it is protected by the system vault (Keychain / Keystore) and the lock you choose. After several wrong PINs the app makes you wait longer.
- With a lock, the app locks itself after a minute in the background and hides your cards in the recent apps preview.
- The server doesn’t have your key. A database leak would not reveal your cards.
- Server keys are kept in an external key store, and data — within the European Economic Area.
- Connections are encrypted (HTTPS).
Risks you should know about
- If you forget your PIN and haven’t set a key password, the cards can’t be decrypted — nobody, not even us, has a spare key.
- Without a lock, anyone with your unlocked phone will see your cards and the passwords saved in them.
- When you turn on “Key on the server”, security depends on the strength of your key password: someone who stole the database or took over your account could try to guess it. Use a long, unique password.
- The “cards in plain form (JSON)” export creates an unencrypted file — store it carefully.
How long we keep data
- On your phone — until you delete them.
- The encrypted copy and key on the server — as long as you use sync; you can delete them with one button.
- Card links — until they expire (30 days at most).
- Cards from family waiting to be collected — 30 days at most.
- Anonymous card patterns — as long as they help improve the catalogue (no numbers, not linked to any account or device).
- The server’s technical log (without card content) — 60 days.
Your rights
You have the right to access, rectify and erase your data, restrict processing, data portability (export to a file), withdraw consent and lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw). Since we don’t have your key, you exercise most rights yourself in the app: export, import, deleting cards from the phone and the server. For anything else, write to: [email protected].
What we don’t do
We don’t sell data, don’t show ads based on your data, don’t profile you and don’t track where you shop. The app contains no analytics or advertising tools — the only thing we collect to improve the app are the anonymous card patterns described above (no numbers; you can turn it off). The front-of-card artwork (from the issuer) is the same for everyone.