The
fine print.

This policy explains what CardPager collects, why, and how, and the rights you have over it.

Data controller

CardPager is operated by FEAD Mühendislik Ltd. Şti., a company registered in Türkiye. Privacy inquiries: [email protected].

What we collect, and why

• Account — email, username, display name, and the photo, location, and public email you choose to add, to run your account and card.
• Content — the links and blocks you add, to show your card.
• Messages — the text sent to you through the pager, plus keyed hashes (not the raw values) of the sender's IP and device, to deliver messages and limit abuse.
• Network — a connection exists only when one member requests it and the other accepts; a Pager message never creates one, and a message from a signed-out visitor never does.
• Stats — page views, link clicks, and pager interactions, for your own dashboard.
• Account history — past usernames and email-change events, for accountability.

Message text is not end-to-end encrypted — it passes through our servers so we can deliver it and apply abuse controls.

Where it goes

We use the infrastructure providers below to run the service; your data may be processed in the regions they operate.

• Supabase — database and authentication.
• Vercel — application hosting and scheduled jobs.
• Cloudflare — network proxy, file/image storage, bot-protection, and email routing.
• Resend — transactional email.
• Sentry — error monitoring, including a masked, text-and-media-hidden session replay on client errors.
• Telegram — internal abuse-report alerting.

How long we keep it

• Messages — 7 days (free) or 30 days (Pro), then deleted automatically.
• Stats — 90 days, then deleted.
• Deleted account — free accounts purge 7 days after the request; Pro accounts purge when the paid period ends, unless you choose to forfeit it immediately.
• Backups — encrypted copies are taken daily and kept 7 days, so deleted data can persist that long before it is gone.
• Deactivated account — your card is hidden right away; email [email protected] to reactivate or delete.

Your rights

You can access, correct, delete, or export your data — most of this is self-service in Settings (change email, username, or password; download your data; deactivate; or delete your account). For anything else, email [email protected]; we reply within 30 days.

Reporting illegal content

Anyone can report a card or message used for illegal activity — including impersonation, harassment, fraud, or CSAM — by emailing [email protected] with the username and a short description. We review every report and act under applicable law and our Acceptable Use rules below.

Law enforcement requests

We respond to valid legal requests from competent authorities, disclose only what the request requires, and notify the affected user first where lawful.

Data breach

If a breach affects your rights, we notify the relevant authority within 72 hours.

Age

CardPager is not intended for users under 16; creating an account confirms you meet this.

Cookies

We use only essential cookies for sign-in and bot protection — none for advertising or cross-site tracking.

KVKK Aydınlatma Metni (Türkiye)

Bu bölüm, 6698 sayılı Kişisel Verilerin Korunması Kanunu ("KVKK") uyarınca Türkiye'deki kullanıcılara yönelik aydınlatma yükümlülüğünü karşılar; yukarıdaki İngilizce Gizlilik Politikası ile aynı uygulamayı Türkçe olarak özetler.

Veri sorumlusu: FEAD Mühendislik Ltd. Şti., Türkiye'de kayıtlı bir şirkettir. Başvuru adresi: [email protected].

İşlenen kişisel veriler: hesap bilgileri, kartınıza eklediğiniz içerik, mesaj metni, kötüye kullanımı önlemek için tutulan tek yönlü özet değerler, kişi listesi kayıtları, kullanım istatistikleri ve hesap geçmişi — yukarıdaki "What we collect" bölümü tam listedir.

İşleme amaçları: hizmetin sunulması ve sözleşmenin ifası, kötüye kullanımın önlenmesi amacıyla meşru menfaat, ve kanunlarda öngörülmesi halinde hukuki yükümlülüğün yerine getirilmesidir.

Aktarım: Kişisel verileriniz, yukarıdaki alt işleyenler listesi aracılığıyla yurt dışına aktarılabilir.

Haklarınız: verinizin işlenip işlenmediğini ve işlenme amacını öğrenme, aktarıldığı üçüncü kişileri bilme, eksik/yanlış işlenmişse düzeltilmesini isteme, şartları oluştuğunda silinmesini isteme, bu işlemlerin aktarılan kişilere bildirilmesini isteme, otomatik sistemlerle analiz sonucu aleyhinize bir sonuca itiraz etme, ve zarara uğramanız halinde giderilmesini talep etmedir.

Başvuru: [email protected] adresine yazılı olarak başvurabilirsiniz; başvurunuz en geç 30 gün içinde ücretsiz sonuçlandırılır.

By creating an account or using CardPager, you agree to these terms.

Your account

• You must be at least 16 to use CardPager, and you're responsible for keeping your account secure.
• Usernames are first come, first served; you can change yours up to twice per 30 days, and old URLs stop working right away.
• Don't impersonate another person, brand, or organisation, and keep to one active account per person.

Your content

You own what you put on your card and are responsible for it not breaking any law or third-party right.

You grant CardPager a licence to host, store, display, and transmit it to run the service; the licence ends when you delete the content or your account.

Messages (Pager)

• Visitors can message without signing in and stay anonymous to the recipient; signed-in senders are named and can ask to connect. You can set your pager to members-only or closed in Settings.
• Senders are limited to one message per IP per minute; visitors are additionally capped at three per IP per day.
• You can report or delete any message you receive; reported messages can lead to the sending device being banned.

Pro & payment

The free plan is free.

Purchases are processed by Paddle.com as Merchant of Record, and Paddle's terms govern the transaction.

See Refund below for our refund policy.

Account lifecycle

Deactivating hides your card right away; data is kept until you email [email protected] to reactivate or ask us to delete it.

Deleting removes your account and its data after the grace period described in Privacy above; you can cancel a pending deletion during that window.

Termination

We can suspend or close accounts that break these terms or the Acceptable Use rules below; the refund policy below still applies if it does.

Limitation of liability

CardPager is provided as is; to the extent the law allows, we're not liable for indirect or consequential damages, or for more than what you paid us in the past 12 months. Mandatory consumer rights where you live are not affected.

Governing law

These terms are governed by the laws of Türkiye, where FEAD Mühendislik Ltd. Şti. is registered; if you're a consumer, the mandatory consumer-protection rules of your own country still apply.

Changes

We may update these terms; material changes are posted here and, where required, emailed to you.

Contact

Questions: [email protected].

Purchases and refunds are handled by Paddle.com as Merchant of Record.

Within 14 days of any purchase or renewal, you can request a full refund for any reason, no conditions.

Outside 14 days, no refund is given for the remaining subscription period.

Email [email protected] with your username to request one; we handle every request.

These rules apply to every account, card, and message sent through the pager. Violations can lead to suspension, closure, or a report to law enforcement.

Prohibited use

Prohibited: CSAM; harassment, threats, or doxxing; extortion or blackmail; fraud, phishing, or scams; encouraging self-harm; infringing someone's intellectual property; spam; impersonating a person, brand, or institution; and any other illegal activity. Confirmed CSAM is reported to the relevant authority.

Self-hosted embeds

Pro users can deploy an HTML export of their card on their own domain through our public embed loader. Embedded cards must not impersonate banks, payment providers, government services, or major brands, and must not be used for phishing or credential harvesting. You choose your own host and are responsible for anything it requires or any abuse complaints it receives.

Reporting & enforcement

Report abuse by emailing [email protected] with the username and a short description; we review every report. Confirmed violations lead to suspension or closure without refund, other than the refund policy above; a banned account's public embed also stops serving. Repeated violations from the same device against the same recipient can get that device permanently blocked from messaging them. If you believe a suspension or closure was a mistake, email [email protected] from the account's verified address to appeal — we review appeals and reinstate the account if warranted.