Privacy Policy
Last Updated: July 24, 2026
Welcome to CardToons (the "App", "we", "us" or "our"). Welcome to CardToons ("App", "we", "us", or "our"). CardToons allows you to create and share greeting cards and invitations, manage birthdays and special events, import events from Google Calendar, and receive reminders so you never miss important occasions. We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use it, the legal bases on which we rely, with whom we share it, how long we keep it, and the rights you have. By using the App you confirm that you have read and understood this Privacy Policy.
1. Who We Are & Scope
This Privacy Policy applies to the CardToons App and to the services we provide through it. It does not apply to third-party services that you interact with through the App, such as WhatsApp / Meta or Google, which have their own privacy policies. For privacy questions, you can reach us at cartoonsapp@gmail.com.
2. Information We Collect
We collect only the information needed to operate the App: • Account information: your email address (and, if provided by Google, your name and profile picture) obtained when you sign in with Google. We never receive or store your Google password. • Events you create: names, dates, categories (such as birthday or anniversary), and any notes you add to events you save in the App. • Google Calendar import (optional): if you explicitly choose to import birthdays/events from your Google Calendar, we read event titles and dates from your calendar on a one-time basis at the moment of import, and we only store the events you actually import into the App. • Reminder & notification data: your notification permission status and, if you enable push notifications, a device push subscription (an opaque endpoint and cryptographic keys issued by your browser/OS push service) so that we can deliver reminders. • Usage & device information: basic technical data such as device type, browser, operating system, language, time zone, IP address, and app interaction logs, used for security, debugging, and reliability. • Communications: any information you send us when you contact support. We do NOT access your WhatsApp account, your WhatsApp contacts, your WhatsApp chats, or the content of any message you send through WhatsApp. When you choose a greeting card, the App simply opens WhatsApp on your device with the message prepared; sending and storage of the message is handled entirely by WhatsApp / Meta. We do not knowingly collect personal information from children under the minimum age required by applicable law. If you believe that a child has provided us with personal information, please contact us so that we can promptly delete it.
3. How We Use Your Information
We use your information to: • create and maintain your account and authenticate you; • save and organize the events, dates, and notes you enter; • send you in-app and push reminders so you don't forget important dates; • import calendar events when you explicitly request it; • operate, maintain, secure, debug, and improve the App; • prevent fraud, abuse, spam, and other violations of our Terms; • respond to your support requests; • comply with legal obligations and enforce our rights. We do not sell your personal information, we do not rent it, and we do not use it to build advertising profiles. We do not use your data to train AI models.
4. Legal Bases (GDPR / UK GDPR)
If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with similar laws, we process your personal data on the following legal bases: • Performance of a contract — to provide the App and the features you request (account, events, reminders, calendar import). • Your consent — for optional features such as push notifications and Google Calendar import. You may withdraw consent at any time. • Our legitimate interests — to keep the App secure, prevent abuse, debug issues, and improve the service, balanced against your rights. • Compliance with legal obligations — when we are required to retain or disclose data by law.
5. Google Sign-In
We use Google Sign-In to authenticate you. When you sign in, Google shares limited profile information with us (typically your email address and, if available, your name and profile picture). Your Google password is never shared with us. Your use of Google Sign-In is governed by Google's terms and privacy policy. You can revoke the App's access from your Google Account at any time.
5a. Where Your Data Is Stored (Lovable Cloud)
The App is built on the Lovable platform and uses Lovable Cloud (which is powered by Supabase) as its backend infrastructure for authentication, database, and file storage. This means: • Your account information (such as your email and Google profile data received via Google Sign-In), the events and notes you create, your push-notification subscriptions, and other app data are stored on Lovable Cloud servers operated by Lovable and its sub-processor Supabase. • Data may be processed and stored in data centers located outside your country of residence (including in the United States and the European Union), subject to appropriate safeguards as described in the "International Data Transfers" section. • Access to the database is protected by row-level security so that each user can, in principle, access only their own data. • Lovable and Supabase act as our data processors and are bound by contractual obligations to protect your data and to use it only to provide hosting and infrastructure services to us. You can find more information about these providers in Lovable's and Supabase's own privacy policies.
6. Google Calendar Integration (Optional)
If you choose to import events from your Google Calendar, the App requests read-only permission to access your calendar events. We use this access on a one-time basis, only at the moment you trigger an import, only to copy event titles and dates that you choose to import into the App. We do not write to, modify, or delete anything in your Google Calendar. We do not maintain continuous background access. We only store the events you actually import. You can revoke calendar access at any time from your Google Account settings. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only access Google user data that is necessary to provide the functionality you explicitly request, and we never use Google user data for advertising, profiling, or training artificial intelligence models.
7. WhatsApp Messaging
CardToons does NOT send messages on your behalf. When you choose a greeting card, the App opens WhatsApp (or WhatsApp Web) on your device with the selected message and/or media prepared, and you decide whether to send it and to whom. We have no access to your WhatsApp account, contacts, chats, or message history. Any messages you send are processed and stored entirely by WhatsApp / Meta and are subject to WhatsApp's own terms and privacy policy.
8. Notifications & Reminders
To deliver reminders for the events you save, the App may ask your browser or operating system for permission to send push notifications. If you grant permission, we store a push subscription provided by your browser/OS so the relevant push service (for example, Google's or Apple's push infrastructure) can route notifications to your device. You can disable notifications at any time from the App, your browser, or your device settings; once disabled we will not be able to deliver reminders to that device. Reminders are provided on a best-effort basis. Delivery depends on factors outside our control, including your device settings, operating system, browser settings, internet connectivity, battery optimization, and third-party push notification services. Therefore, we cannot guarantee that any particular reminder will always be delivered or delivered on time.
9. How We Share Information
We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances: • Service providers (data processors) acting on our behalf — including cloud hosting and database providers, authentication providers, push-notification infrastructure, and error-monitoring providers — bound by contractual obligations to protect your data and use it only to provide services to us. • Third-party platforms you choose to use — Google (sign-in, optional calendar) and WhatsApp / Meta (when you send a greeting), as described above. • Legal & safety — when we believe in good faith that disclosure is required by law, legal process, or a government request, or is necessary to protect the rights, property, or safety of us, our users, or the public, or to prevent or investigate fraud, abuse, or security issues. • Business transfers — if we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections.
10. International Data Transfers
We and our service providers may process and store your information in countries other than the one in which you reside, including countries that may have data-protection laws different from those in your country. Where required by law (for example, transfers out of the EEA or UK), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
11. Data Retention
We retain your information only for as long as needed to provide the App to you, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Specifically: • Account data is kept while your account is active. • Events and reminders are kept until you delete them or delete your account. • Push subscriptions are kept until you disable notifications or revoke them. • Limited security, audit, and backup logs may be retained for a reasonable period after deletion. When we no longer need your data, we delete or anonymize it.
12. Security
We implement reasonable technical and organizational measures designed to protect your information against unauthorized access, alteration, disclosure, loss, or destruction — including encryption in transit, access controls, and least-privilege access for our personnel. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your Google account and your device secure.
13. Your Rights
Depending on where you live, you may have the right to: • access the personal data we hold about you; • correct inaccurate or incomplete data; • delete your data ("right to be forgotten"); • restrict or object to certain processing; • withdraw consent you previously gave (for example, for notifications or calendar access); • receive a portable copy of your data; • lodge a complaint with your local data-protection authority. If you are a California resident, you have additional rights under the CCPA/CPRA, including the right to know, the right to delete, the right to correct, and the right to opt out of "sale" or "sharing" of personal information (note: we do not sell or share your personal information for cross-context behavioral advertising). We will not discriminate against you for exercising your rights. To exercise any of these rights, contact us at cartoonsapp@gmail.com. We may need to verify your identity before responding.
14. Account Deletion
You can permanently delete your account at any time directly from the App using the Delete Account option in the settings menu, or by contacting us at cartoonsapp@gmail.com. When your account is deleted, we will permanently remove your account information, saved events, reminders, notes, and push-notification subscriptions associated with your account, except where retention is required by law, necessary to resolve disputes, prevent fraud or abuse, or maintained temporarily in secure backup systems that are automatically overwritten over time.
15. Third-Party Services & Links
The App relies on, and may link to, third-party services (including Google, WhatsApp / Meta, push-notification providers, and cloud-hosting providers). We are not responsible for the privacy practices of those third parties. We encourage you to review their policies before using them.
16. Cookies and Local Storage
CardToons may use cookies, browser local storage, or similar technologies that are necessary for the App to function properly. These technologies help keep you signed in, remember your preferences, improve performance, and maintain the security of the App. We do not use cookies or similar technologies for advertising, cross-site tracking, or behavioral profiling.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the App, in applicable law, or in our practices. When we make material changes, we will update the "Last Updated" date and may ask you to re-accept the updated policy inside the App. Your continued use of the App after the changes take effect constitutes your acceptance of the updated Privacy Policy.
18. Contact Us
If you have questions or requests regarding this Privacy Policy or your personal information, please contact us at: Email: cartoonsapp@gmail.com
19. Consent
By using CardToons, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and processing of your information as described in this Privacy Policy.