Last updated: 19 October 2026.
This Policy explains how personal information is collected, used, disclosed and protected when you use the CardNest app, website and related gift-card trading services (the “Service”). “CardNest”, “we” and “us” refer to the operator offering the Service under the CardNest name and responsible for the purposes described here. Privacy questions and requests may be sent to support@cardnest.cc.
1. Information we collect
- Account and contact data: name or display name, email address, phone number, country or operating market, password credential or authentication record, and referral code where provided.
- Identity and verification data: information and images you provide for identity checks, which may include name, date of birth, identity-document details, document images and a selfie. We request these only where verification is required for an available feature or legal obligation.
- Gift-card and transaction data: selected brand, issuing region, card type, denomination, card codes or uploaded card images, quotes, order history, approval decisions, wallet entries, coupons, referral rewards, points, growth and VIP records. Card codes and identity documents are sensitive and must not be put in a public profile or support message unless requested through a secure channel.
- Payment and withdrawal data: bank name, account-holder information, account number and masked identifiers, withdrawal details, status and related security checks. CardNest may receive transfer status from a bank or payment provider.
- Communications: support requests, messages, attachments and feedback you submit, and the information needed to respond.
- Technical and usage data: IP address, device and browser information, operating system, app version, security and diagnostic logs, approximate location inferred from network information, and the pages or actions needed to operate and protect the Service. We do not describe this as precise GPS location unless the app actually asks for that permission.
- Third-party sign-in data: if you choose an enabled sign-in provider, we receive the account identifiers or contact details that provider makes available under your settings. We do not receive that provider's password.
- Push notification data: if native notifications are available, an app installation may provide a device identifier, Firebase Cloud Messaging registration token, notification preference and delivery or opening status. Notification previews do not include full card codes, bank account details or identity documents.
We collect data directly from you, from your use of the Service, and where applicable from verification, card, bank, payment or sign-in providers. Some information is necessary to create an account, verify a card or process a withdrawal; if you do not provide it, the relevant feature may not be available.
2. How and why we use information
- Create and secure accounts; authenticate sign-in and transaction PIN actions; provide support and account notices.
- Assess card eligibility, calculate quotes, review submitted evidence, process approved orders, maintain wallet and withdrawal records, and resolve errors or disputes.
- Conduct identity, fraud, abuse and security checks; comply with applicable recordkeeping, anti-fraud and other legal requirements.
- Operate optional coupons, referrals, leaderboards, points and VIP benefits under the rules displayed for those features. Public rankings should use the name and avatar presentation shown in the app, not expose card codes, bank details or identity documents.
- Maintain, troubleshoot and improve the Service using operational and diagnostic information; send service-related notifications. Optional promotional messages or non-essential tracking require the controls and consent that applicable law and platform rules require.
Where a privacy law requires a legal basis, processing may be necessary to provide the Service or perform a contract, comply with a legal obligation, protect legitimate security and service interests, or rely on consent for an optional activity. We will not treat consent as a substitute for another required legal basis. You can ask us which basis applies to a particular activity.
3. When information is shared
We share only what is reasonably necessary with service providers that support hosting, secure storage, communications, identity verification, card review, banking or payment processing, customer support and security. Where native push is enabled, we use Google Firebase Cloud Messaging and, on Apple devices, Apple Push Notification service to route notifications using device tokens; those providers process the information needed to deliver them under their own terms. They must handle information under appropriate instructions and safeguards. We may also disclose information to a regulator, law-enforcement body or court when legally required, to protect users or the Service, or as part of a genuine business transfer subject to appropriate protections and notice where required. We do not publish your full card code, identity document or bank account in a leaderboard or other public feature. A provider's separate privacy notice may apply when you choose its service.
4. International handling
CardNest and its providers may process information in countries other than your own. This may include locations where hosting, email, payment, support or notification services operate. We apply technical and organizational safeguards appropriate to the information and seek to use any additional transfer protections required by applicable law. Contact us if you want more information about a particular transfer.
5. Security
We use access controls, transport protection and restricted storage for sensitive card, identity and banking data, together with operational monitoring and staff access controls. No online service can guarantee absolute security. Please protect your password and transaction PIN, use current app versions and tell us promptly at support@cardnest.cc if you suspect unauthorized access. Do not send complete gift-card codes, passwords or identity documents through ordinary email unless we have instructed you to use an appropriate secure process.
6. Retention and deletion
We keep account data while your account is active and as needed to provide the Service. Transaction, payment, card-verification, fraud and identity records may need to be retained after account closure for applicable legal duties, dispute resolution, fraud prevention or accounting. Support messages and technical logs are retained only as long as reasonably needed for those purposes. Push-device tokens are removed when the relevant account/device binding is revoked, the token becomes invalid or the account is deleted; inactive devices may be excluded from new sends. When a retention purpose ends, we delete or de-identify the data using appropriate processes. The exact period can vary by record type and applicable operating-market law; you may ask us about the period relevant to your records.
You can start account deletion in the app or use cardnest.cc/delete-account. We may need to resolve open orders, pending withdrawals or other obligations before completing deletion, and may retain records that the law requires. We will explain any retained categories and respond to your request in accordance with applicable law. Removing the app from your device does not by itself delete your account.
7. Your choices and rights
Depending on your location, you may request access to, correction or deletion of personal information; object to or restrict certain processing; receive a portable copy; or withdraw consent where consent is the basis. You may also complain to a relevant data-protection authority. Contact support@cardnest.cc to make a request. We may verify your identity before disclosing sensitive information and may decline or limit a request where the law permits or requires us to retain records. App or device settings may let you manage optional notifications and permissions.
8. Cookies, local storage and analytics
The website or Web App may use essential cookies or local storage for sign-in, security and interface settings. Server logs and diagnostic data help us keep the Service available and investigate failures. If we add advertising, cross-app tracking or non-essential analytics, we will update this Policy and obtain any required consent or platform permission before using them. You can manage browser storage in your browser settings, but disabling essential storage may prevent sign-in or other functions.
9. Children
The Service is intended for adults aged 18 and over. We do not knowingly offer accounts to children. If you believe a child has provided personal information, contact support@cardnest.cc so we can review and take appropriate action.
10. Changes and contact
We may update this Policy as the Service, providers or legal requirements change. We will show the current version and update date and give additional notice for material changes where required. Changes do not excuse an earlier undisclosed use of data. For privacy questions, rights requests or complaints, email support@cardnest.cc.
11. Additional security and service information
To recognise installations and authorise sensitive actions, we process installation identifiers, device public keys, device and browser descriptions, session records, sign-in times, IP addresses, verification outcomes, device revocations and withdrawal-protection periods. The matching installation private key is held in device or browser storage. These records help distinguish a signed-in installation from one that has completed withdrawal verification; device names and IP addresses alone do not establish trust.
If you enable an authenticator, we process the authenticator setup and verification information needed to check time-based codes. Authenticator secrets are encrypted at rest; recovery codes are stored as verification hashes. Passwords and transaction PINs are verified using protected credential records rather than displayed to support staff. Verification codes and security authorisations are time-limited and linked to their intended operation. Do not send setup secrets or recovery codes to support.
We also record account-recovery actions and bank-account changes, including verified holder names and checks needed to protect a particular transaction. Security emails and in-app notices may identify the action, time and masked account or device details. They do not include your PIN, full verification codes or authenticator secret.
Android push delivery uses Google Firebase Cloud Messaging; Apple-device push delivery uses Apple Push Notification service. Depending on the platform, a registration or device token and delivery information are processed to route messages. Email providers process your email address and the message necessary to send verification, recovery and service notices. Hosting and storage providers process the account records and files stored for the Service; banking and payment providers receive the receiving-account and transaction data needed to verify or process a payment. These purposes are distinct from selling personal data for advertising.
Account deletion includes revoking account access and removing account-linked device and authenticator credentials through the deletion process. Necessary transaction, security or dispute records may remain subject to the retention purposes above, and protected backups follow their retention lifecycle rather than being individually rewritten immediately. If you cannot sign in or complete the deletion page, contact support@cardnest.cc for identity-verified assistance. We do not require you to disclose your PIN or recovery codes to make a request.