Privacy policy

What we collect

• Newsletter signups. Your email address, an optional note on what you collect, the page you signed up from, your consent choice, and the time of signup. We also store a hashed form of your IP address and browser user agent for a limited period to detect abuse.
• Server logs. Our web server and Cloudflare record standard request logs (IP address, URL, user agent, time) for security and troubleshooting.
• Analytics. We use PostHog (US cloud) to understand which pages and features are useful. By default it runs in cookieless mode: nothing is stored in your browser, IP addresses are anonymized, and visitors are counted with a server-side hash that rotates daily and cannot be used to follow you across days or sites. If you choose Allow in the analytics prompt, PostHog also sets a first-party cookie with a random ID and records anonymous session replays (every form field is masked) and click heatmaps, so we can see where pages confuse people. Your choice is saved in this browser; you can change your mind at any time by clearing this site's data (cookies and storage). No thanks keeps you in cookieless mode.
• Crawler logs. We count visits from search engines and AI crawlers (for example Googlebot, GPTBot or PerplexityBot) from our server logs to measure how the site is indexed. These records contain the crawler name and the page, not personal data.

What we do not do

• We do not sell, rent, or share your email address with anyone.
• We do not put personal data in URLs or analytics events.
• We do not run advertising trackers.

Why we use it

To send you the emails you asked for, to keep the site secure, and to understand what content is useful. The legal basis is your consent (for email) and our legitimate interest in running a secure website (for logs).

Retention

Signup records are kept until you unsubscribe or ask for deletion. Hashed IP and user-agent values are deleted after 90 days. Server logs rotate on a short schedule.

Your choices

Every email includes an unsubscribe link. You can also email [email protected] to unsubscribe, to ask what we hold about you, or to have it deleted.

Third parties

The site is served through Cloudflare, which processes request data as our provider. Product analytics are processed by PostHog Inc. as our processor. Email (sign-in links, sale alerts and the weekly digest) is delivered by Resend, Inc., acting on our instructions.

Children

CardVolume is written for adults. We do not knowingly collect data from anyone under 16.

Changes

We will update the date at the top when this policy changes and describe material changes in the newsletter.