Privacy Policy
Last updated: November 2026
What we collect
When you sign in (with Google, Apple, or an email code), we receive your email address and use it to identify your account. Creators also provide a display name, a handle, a bio, and the photos they upload; when applying for verification, they give us the Instagram account to check. Depending on what you use, we also store the cards you issue, claim, and collect; the comments you post, including any photo you attach; who you follow, follow requests, and who you block; the people you choose to send a private card to; the reports you file; and your account settings, such as whether your account is public or private and when you last read your activity. We also record which version of iOS your device runs, as reported by the app and as Apple Wallet states when it fetches a card from us. We use it only to check that cards and features display correctly on each version. We also record which creators’ pages you open in the app and which Studio cards you view, with the first and latest time and how many times, to understand which creators you follow closely. When you view a creator’s Studio card, that creator sees your account in its viewer list.
Views
When you view someone’s card, the creator can see you in that card’s views. If you turn on “Browse privately” in Settings, you’re counted but not shown; in return, the views on your own cards show only a count. Claiming, commenting, and following still show who you are.
Apple Wallet
When you add a card to Apple Wallet, your iPhone registers a device identifier and a push token with us. They are used only to send the new version to your Wallet when the creator updates the card. Removing the card from Wallet ends the registration.
Photos
Uploaded photos have their location and other metadata (EXIF) removed before they’re used on a card. To keep out inappropriate content, every uploaded image — card photos, behind the scenes, profile pictures, and comment photos — is scored by OpenAI’s moderation service; under OpenAI’s API policy, these images aren’t used to train models. Images judged high-risk are not published. A copy of high-risk and borderline images is kept in private storage for us to review by hand; it stays there, even if the card or account is later deleted, until we delete it.
Cards made on the website
You can make a card at valendex.com/make without signing in. The photo you choose is handled like a photo uploaded in the app: its metadata is removed, and it is scored by OpenAI’s moderation service. It is then kept in private storage, both to make your card and so that we can review it by hand, and it stays there until we delete it. We also record the date you made the card, the country we infer from your IP address (used only to fill in the card’s Location field), and how many times the card is opened or added to Wallet. Your IP address is used only to work out the country and to limit how many cards can be made; it isn’t stored with the card. Anyone with the card’s address (valendex.com/make/…) can open it. To have a card you made on the website deleted, send us its address.
External links
Web links in a card’s back message or in a bio open through valendex.com first, which checks that the destination isn’t on our blocklist before sending you on. We record the address that was tapped, the card or creator page it was on, the time, and the result of the check, to block inappropriate sites and count taps. This record doesn’t include your account or IP address, and is kept for 90 days. To check the destination, our server connects to the address itself and reads only where it redirects. Your device then goes to the site directly; how that site handles your data is covered by its own privacy policy.
Explore order
In the app’s Explore, we record which cards your account saw (at least half of the card on screen) and which you opened from there, and use it to order what you see next: cards you’ve passed several times without opening move down, and new cards you haven’t seen yet move up. Everyone’s records are also combined into the share of viewers who opened each card, which affects the order in Explore; that share counts people only and never shows who they are. Nothing is recorded when you’re not signed in. The record is kept for 30 days.
How we use it
Your email is used only to identify your account and to make sure each person claims a card only once. Photos are used only to make the cards you issue or collect and to show comments. We don’t sell your data, share it with third parties for advertising, or track you across other websites or apps.
Where it’s stored
Data is stored with Supabase (database and files), and the website is hosted on Vercel. Published photos are stored at web addresses that anyone with the address can open, so please don’t upload images you don’t want to be public.
Deleting your data
You can delete your account yourself: on the web, from the Settings page; in the app, from Settings → Delete account. Your sign-in details, collection, and profile are then removed. Cards already in your Wallet stay on your phone but no longer update. Cards others have claimed are not affected. You’re also welcome to contact us directly, and we’ll handle your request within a reasonable time.