Your data deserves a clear answer.
What we collect, why we need it, who helps us process it and how to get it deleted. No ads, no selling your data.
Plain-English draft. Have it reviewed by a lawyer before launch.
The short version
- We collect what we need to run your account, your cards, your purchases and your games.
- We don't sell your personal data and we don't show ads. We don't use analytics or advertising cookies (see our cookie notice).
- Payments are handled by Stripe. We never see or store your full card number.
- AI prompts are sent to an AI provider to generate your card. Keep personal details out of prompts.
- You can ask for a copy of your data or have it deleted at any time through our contact page.
bingo cards.io is operated by [Company legal name and address], which is responsible for your personal data under this policy.
What we collect
Account information
Your name, email address and password when you sign up with email (the password is stored only in hashed form by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
Cards you make
Titles, words, numbers, grid settings, designs and other choices you make in the editor, so we can show, save and print your cards.
Uploads
Images you upload for picture bingo or card backgrounds.
AI prompts
The text you type into the AI generator and the card it produces, plus a count of how many generations you've used so we can apply plan limits.
Purchases
What you bought, when and for how much: credit packs, bundles, subscriptions, your credit balance and the templates you own. Stripe gives us a customer reference and the status of your subscription. Card numbers and bank details go directly to Stripe and are never stored by us.
Support messages
What you tell us when you contact us, and our replies.
Technical data
Like any website, our servers and hosting providers receive technical information such as your IP address, browser type and request logs. We use it to keep the service working and secure. We don't use it to build advertising profiles.
On your device
Some things stay in your browser's local storage instead of on our servers, such as your favorite templates and the template you're opening in the editor. See the cookie notice.
How we use it
- To provide the service: your account, the editor, printing, live games, purchases and plan limits.
- To take payments and keep records that tax and accounting law requires.
- To support you when you ask for help, and to send service emails such as receipts and important account notices.
- To keep things safe: preventing fraud, abuse and attacks.
- To improve the product: for example, fixing bugs we find in logs. We don't use your cards or prompts to train AI models ourselves.
Where the law asks for a legal basis, we rely on performing our contract with you (running the service you signed up for), our legitimate interests (security and improving the product), legal obligations (tax records) and your consent where we ask for it.
We'll only send marketing emails if you've agreed to receive them, and every one will have an unsubscribe link.
Who processes it
We use a small number of providers to run bingo cards.io. They only process your data on our behalf and for these purposes:
| Provider | What for | Data involved |
|---|---|---|
| Our hosting provider | Running the servers the site and live games run on | Request data such as IP address, kept briefly in server logs for security |
| Supabase | Database, sign-in and file storage | Account details, cards, uploads, purchases and credit records |
| Stripe | Payments, subscriptions, invoices and the billing portal | Name, email, payment details, billing address where required |
| OpenRouter and the AI model provider it routes to | Generating cards from your prompts | The prompt text you enter (not your name or email), handled under the provider's own data terms |
| “Sign in with Google”, if you choose it | Your Google name, email and profile picture | |
| Our email provider | Account emails and the game invites you send | Recipient email address and message content |
| Our hosting provider | Running the website and live game server | Technical data and the content passing through the service |
Some of these providers process data outside the country you live in. Where that happens, we rely on the safeguards the law requires, such as standard contractual clauses. We may also share data if the law requires it, or with a buyer if the business is ever sold, in which case this policy continues to apply.
Live games & invites
- Players joining a live game don't need an account. They type a name, which is shown to the host and the other players in that game.
- If a player is signed in, their account name (or, if they haven't set one, their email address) is shown to the others in the game instead.
- The name a guest player types is remembered in their own browser so they don't have to type it again.
- When you send email invites, we pass the addresses to our email provider to deliver them. We don't keep a list of the addresses you invite.
How long we keep it
- Account, cards and uploads: for as long as your account is open. If you delete a card, it's removed from your account.
- After you ask us to delete your account: we delete your account data within 30 days. Copies in backups are overwritten on a rolling schedule.
- Payment and order records: kept for as long as tax and accounting law requires, even after account deletion.
- Support messages: kept while we need them to help you, then deleted.
- Server logs: kept for a short period for security and debugging.
Your rights
Depending on where you live, you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that's wrong;
- delete your data;
- send your data to you in a portable format;
- restrict or object to some uses of it, and withdraw consent you've given.
Ask through our contact page or at hello@bingocards.io. We'll confirm it's you, then respond within the time the law requires. You also have the right to complain to your local data protection authority.
Deleting your data
There's no self-serve delete button yet. To delete your account and everything in it, contact us from the email address on your account. Cancel any subscription first so you're not charged again. Deleting your account removes your cards, uploads, credits and owned templates permanently. Here's how deletion works.
Children & classrooms
Accounts are for adults, or children with a parent or guardian's permission where local law requires it. We don't knowingly collect personal data from children under 13 without that permission. Students playing in a classroom live game don't need an account; teachers should ask them to use a first name or nickname. If you believe a child has given us personal data without permission, contact us and we'll delete it.
Security
We use encrypted connections (HTTPS), store passwords only in hashed form, and limit who can access personal data. No system is perfectly secure, so if we ever have a breach that affects you, we'll tell you and the authorities as the law requires.
Changes
We'll update this policy when our product or providers change. The date at the top shows the latest version. If we make a significant change, we'll tell you by email or in the app before it takes effect.
Contact
Privacy questions or requests: hello@bingocards.io or our contact page.
[Company legal name and address]