Legal

Privacy Policy

Last updated: 3 October 2026

1. Who we are

This privacy policy ("Policy") is issued by Cardi LLC, a Delaware limited liability company ("Cardi", "we", "us" or "our"). We are the data controller for personal data processed in connection with the Cardi mobile application, any Cardi experience shown on a connected TV, the website at getcardi.app, and related services (together, the "Service").

This Policy applies to all users worldwide, with additional sections for users in the European Economic Area, the United Kingdom and Switzerland (Section 14) and the United States, including California (Section 15).

2. Summary

We keep what we collect to what the Service needs. In short:

• No sign-up needed. The app creates an anonymous account automatically. Signing in with Apple is optional and only links that account to your Apple ID. We may receive your name from Apple; we do not store your email address.
• We process the body and goal data you give us (such as birth year, gender, height, weight and target weight) to build your plan and estimate calories.
• If you connect Apple Health, the app reads active energy and steps on your iPhone and writes your Cardi workouts; only one daily active-calorie total is sent to our servers. We do not read heart rate. Health data is never used for advertising or marketing and never sold.
• If you log a meal with a photo or a description, it is sent to our food-recognition provider (Edamam) without your name or account details to estimate nutrition. Meal photos are stored with your meal log until you delete the meal or your account.
• The camera reads your movement on your iPhone. No gameplay video or images are recorded or uploaded, and the TV never shows the camera picture.
• Other players see only your @handle, your profile photo (or a default avatar if you don't add one), your country flag, your league tier and your kilometres this week.
• Our servers, database and photo storage run on Cloudflare in the United States.
• Subscriptions are billed by Apple. We never see your card details.
• No ads, no tracking. Usage statistics go to PostHog (hosted in the EU) only from our servers, under a keyed pseudonym, without your IP address, name or account details. We do not sell your personal data or share it for cross-context behavioural advertising.

3. Personal data we process

3.1 Account and identifiers

An account identifier created automatically when you first open the app, app-generated device and install identifiers (random codes, not your iPhone's hardware or advertising identifiers), your @handle (generated automatically, and you can change it) and friend code, your default avatar or, if you add one, the profile photo you upload, and, if you enable notifications, your Apple push-notification (APNs) token. If you use Sign in with Apple, sign-in goes through Google Firebase Authentication; we store the Apple user identifier and the Firebase user identifier that link your account, and the name Apple shares with us if you choose to share it. Apple may also share an email address (or a private relay address); we do not store it.

3.2 Profile, body and goal data

Information you enter during onboarding or in the app: your name (optional), year of birth, gender, height, current weight, target weight, goals and your other onboarding answers, your reminder time, your country (taken from your iPhone's region setting; you can change it), time zone and language. We use it to build your plan, set a daily calorie budget and estimate the calories you burn. Some of this is health data under data-protection law; see Section 5.

3.3 Runs and game data

Runs you play: date, duration, estimated calories burned, kilometres covered in the game, the game world, moves performed, the number of players, streaks and league position.

3.4 Meals and nutrition

Meals you log, their estimated calories and macronutrients, foods you save, and the photos and descriptions you use to log them. See Section 4.

3.5 Apple Health data

Only if you connect Apple Health, and only the types you approve on Apple's permission screen. See Section 5.

3.6 TV connection

To show the game on your TV, the app uses AirPlay or a cable connection. The TV shows the game and a simple figure drawn from your movement, never the camera picture. When a TV connects, the app reads the name the TV reports to your iPhone (for example "Living Room TV", or a name you gave it), shows it in the app and sends it to our servers in a product event (Section 3.8), so we can see which TVs Cardi is used with. We do not collect any other information about your TV or your home network.

3.7 Purchases

Subscription status, product, trial and offer status, renewal and expiry dates and transaction identifiers (purchase history). We do not receive or store your payment-card number or bank details; Apple handles payments.

3.8 Product interaction

First-party, in-app events about how the Service is used: when you open the app, the screens you visit, whether you allowed camera and notification access, when a run starts and ends, food-logging errors, onboarding screens reached and the options you choose there, paywall and purchase steps, features used, and some values from what you did, such as the estimated calories of a logged meal or a scanned photo; the duration, kilometres, estimated calories and world of a run; your weekly league result; the reason you gave when reporting a player; and the name of the TV you connected. Onboarding, paywall and purchase events also carry your install identifier and the onboarding version you saw. For each installation we also keep the onboarding version shown, the onboarding steps reached, the app version, platform and country. These events are sent only to our own servers, linked to your account identifier, and used only to run, understand and improve Cardi. They never contain data read from Apple Health. The app contains no third-party analytics, advertising or crash-reporting SDKs.

Pseudonymous usage statistics (PostHog). To understand which features keep people training, our servers also send a limited set of these events to PostHog:

• App: when the app is opened, which screens you visit, and whether you allowed camera and notification access.
• Onboarding: the steps you reach, which questions you answered or skipped, and your main goal (not your other answers).
• Subscriptions: paywall and offer screens you see or close, spins of the discount wheel, purchase steps and their outcome, the result of Restore purchases, subscription events (such as a trial starting, a renewal or a cancellation, with the product, price and cancellation reason), and when you open a Pro-only tab without Pro and whether you tap to unlock it.
• Play: when a TV connects (not its name), when you open the TV help or choose to play on your iPhone, when a run starts, ends and is saved (world, level, whether it was the tutorial, number of players, TV or phone, duration, whether it was finished, how long the camera lost sight of you, whether your iPhone was running hot), your weekly league result (whether you moved up, down or stayed, and your tier) and when you add a friend.
• Food: how a meal was logged (photo, barcode, search and so on), when you save a food, and which meal-logging errors occurred.

Each event carries your country, subscription status (free, trial or Pro, the product, days left and whether auto-renew is on), the onboarding version you saw, days since you joined and the app version. Instead of your account identifier, PostHog receives a keyed pseudonym: a code our servers compute from your account identifier with a secret key. It stays the same for your account, so we can see how use changes over time, but only our servers can link it back to your account. PostHog never receives your IP address, name, @handle, email, meal names, photos, calorie, weight or other body values, your other onboarding answers, the TV name or any Apple Health data.

3.9 Technical data

Our servers receive your IP address with each request. We use it for security and to rate-limit account creation and sign-in, and keep it for that purpose for no more than two days. Our hosting provider's request logs record the time, the requested path, the response status, your account identifier and the app's user-agent (which shows the app and system version), and may include your IP address; they are kept for seven days. We do not collect precise GPS location.

3.10 Communications

If you contact us, we keep your message and our reply so we can help you and meet record-keeping obligations. Our email is hosted by Google Workspace (Section 8).

3.11 Friends and invitations

When you add a friend by QR code, invite link or friend code, we store the connection between your two accounts. We do not upload your contacts list.

3.12 Reports and moderation

If you report a player, we store who reported whom, the reason, the note you add (if any), the reported player's @handle and a copy of their profile photo at the time of the report. Our moderation team receives an email alert with the reported player's @handle and account identifier, the reason and the beginning of your note; the alert does not include your @handle or account identifier. If another player reports you, the same data is stored about you. We also keep a record of moderation actions, such as hiding a player or resetting a handle. Section 10 says how long we keep these.

4. Camera and meal photos

Cardi uses your iPhone's camera in two ways:

• Playing the game. Where the game uses the camera to follow your movement, frames are analysed on your device in real time. No video, images or body-point data from gameplay are recorded, stored or sent to us or anyone else, and we do not use the camera to identify you, recognise faces or create biometric templates. The phone can show the camera picture so you can find your spot; the TV only shows a simple figure drawn from your movement. If a second person plays with you, the same applies to them, and we store nothing about them: the run is saved to your account. Only the results of a run (such as duration, moves, kilometres and estimated calories) are saved to your account.
• Logging a meal. When you photograph a meal or pick a photo from your library, the photo is uploaded to our servers. Before the first photo or description is analysed, the app asks for your consent; you can always enter a meal yourself instead. We send the photo or text to Edamam to recognise the food and estimate nutrition, without your name, handle or account identifier. The photo is stored in our cloud storage (Cloudflare) together with the meal so you can see it in your log, until you delete that meal (and any saved food that uses the photo) or your account. Photos of deleted meals, and photos you analyse but don't log, are deleted automatically within three days. Barcodes are read on your iPhone. Food search uses Edamam's food database. A barcode is looked up in Open Food Facts, directly from your iPhone (so Open Food Facts sees your IP address, as any website does), and in Edamam's food database through our servers. Only the barcode or the search text is sent, never your name or account.

You can turn camera access off at any time in your iPhone's Settings.

5. Apple Health and health data

Connecting Apple Health is optional. If you connect it, Cardi may, with your permission:

• read your active energy burned and step count, so your daily calorie totals are accurate;
• write your Cardi runs to Apple Health as workouts, with their active calories.

Cardi does not read heart rate, weight or any other Health data types. You choose what to share on Apple's permission screen and can change this at any time in the Health app or iOS Settings. Your step count stays on your iPhone: the app combines it with your active energy into one daily active-calorie total, and only that number is sent to our servers so your plan and progress work across sessions.

Where data protection law treats this information as health data (a special category under Article 9 GDPR), we process it on the basis of your explicit consent, which you give when you enter it or connect Apple Health and can withdraw at any time by deleting the data, disconnecting Apple Health or deleting your account.

6. How we use personal data and our legal basis (GDPR Art. 6 and 9)

7. Leaderboards, leagues and friends

Cardi's leaderboards rank players by kilometres run in the game this week. Other players can see only your @handle, your profile photo if you add one (otherwise a default avatar, which matches the gender you chose in the app, if any), your country flag, your league tier and your kilometres this week (and, through these, your league position). Your league board shows the players in your group, the global board shows the top players worldwide, and your friends see you on their friends board. Your name, weight, body data, calories, meals and Apple Health data are never shown to other players.

When you add a friend, they get a notification with your @handle. You can report or block another player in the app (see Section 3.12). You can remove a friend at any time. If you share an invite link on another platform, that platform's privacy practices apply to what you post there.

8. Service providers (sub-processors)

We use the following providers. Each may process personal data only on our instructions, or under its own terms for the service it provides to you, and must protect it appropriately.

• Cloudflare, Inc. (United States) — runs our servers and database (located in the eastern United States); stores meal photos, profile photos and the photo copies kept with player reports; sends our internal alert emails, including report alerts (Section 3.12); keeps our request logs for seven days; protects staff access to our admin tools; and hosts the website, with DDoS protection and CDN.
• Google LLC — two services. Firebase Authentication, only if you use Sign in with Apple: it verifies the sign-in and keeps your Apple user identifier, a Firebase user identifier and sign-in metadata (such as time and IP address). We do not request your email address. The Firebase user is deleted when you delete your account. Google Workspace hosts our email (admin@getcardi.app and our team's mailboxes), so it holds messages you send us and the report alerts described in Section 3.12. We do not use Google Cloud to host the Service.
• Apple Inc. — app distribution, Sign in with Apple, push notifications (your push token and the notification text), App Store payments and subscriptions. Apple Health (HealthKit) runs on your device.
• RevenueCat, Inc. (United States) — managing subscriptions and purchase status. It receives a random purchase identifier (separate from your account identifier), your App Store purchase information, and your install identifier and the onboarding version you saw, which we use to measure our offers.
• Edamam LLC (United States) — food recognition and nutrition database for meal photos, descriptions, food search and barcodes. Photos and text are sent without your name or account identity.
• Open Food Facts (France, non-profit) — open product database for barcode lookups. The app (and, if that fails, our server) sends only the barcode number.
• PostHog, Inc. (data hosted in the European Union, Frankfurt) — pseudonymous usage statistics described in Section 3. It receives the events listed there from our servers, under a keyed pseudonym, without your IP address or account identity.

We do not use advertising networks, data brokers or crash-reporting providers, and PostHog is our only analytics provider. Material changes to this list will be reflected in this Policy.

9. International data transfers

Cardi LLC is based in the United States, and most of our providers are too. Our database is located in the eastern United States. If you use the Service from the EEA, the UK or Switzerland, your personal data is transferred to and processed in the United States. For these transfers we rely, as applicable, on:

• adequacy decisions, such as the EU–U.S. Data Privacy Framework where the recipient is certified;
• the European Commission's Standard Contractual Clauses, with supplementary measures where needed;
• your explicit consent for occasional transfers under Article 49 GDPR.

You can request a copy of these safeguards by emailing admin@getcardi.app.

10. How long we keep data

• Gameplay camera frames — not kept. They are analysed in memory on your device and discarded.
• Meal photos and meal logs — until you delete the meal or your account. Photos of deleted meals, and photos you analyse but don't log, are deleted within three days.
• Account, profile, body, run, Apple Health totals and friends — while your account exists. Deleting your account removes them from our servers right away; backups roll over within 30 days.
• Product-interaction events (including the TV name) — while your account exists, then deleted with it.
• Pseudonymous usage statistics in PostHog — up to one year, then deleted by PostHog. When you delete your account, nothing links its pseudonym to you any more.
• Onboarding records per installation (install identifier, onboarding version, steps reached, app version, platform and country) — kept for statistics. When you delete your account they are unlinked from it, and the app starts a new install identifier.
• Player reports — the copy of a reported profile photo is deleted 180 days after the report is resolved. If either player has deleted their account, the whole report is deleted 180 days after it is resolved. Otherwise reports and moderation actions are kept while both accounts exist, so we can deal with repeated abuse.
• IP addresses used for rate limiting — up to two days. Request logs — seven days.
• Subscription and billing records — as long as required by applicable tax and accounting law (up to ten years), and as held by Apple and RevenueCat under their own terms. After you delete your account we keep them without your account identifier, with transaction identifiers stored only as one-way hashes.
• Deleted-account marker — one-way hashes of your account and purchase identifiers, kept for about 14 months (longer only until RevenueCat has deleted your record), so that late subscription notifications about a deleted account are discarded instead of stored.
• Communications, including report alert emails — up to three years from last contact.
• Legal and dispute records — for the relevant limitation period.

Anonymised or aggregated data that can no longer be linked to you may be kept indefinitely.

11. Account and data deletion

You can delete your Cardi account and its data at any time from inside the app: Profile → Account → Delete account. It is also available from the Account link on the subscription screen. Deletion permanently removes from our servers your profile, @handle, friends, leaderboard and league entries, runs, body data, Apple Health totals, meal log, meal photos, profile photo, push tokens and product-interaction events, revokes Sign in with Apple for Cardi (including the Firebase sign-in record) and deletes your customer record at RevenueCat. The app also erases the Cardi data stored on your iPhone. If a step with Apple, Google or RevenueCat fails, we retry it automatically and keep only the identifier it needs until it succeeds or we complete it by hand. It does not remove data already written to Apple Health, which you control in the Health app.

A few records are kept after deletion, as described in Section 10: billing records without your account identifier, onboarding records unlinked from your account, pseudonymous usage statistics in PostHog for up to one year, player reports, and the deleted-account marker.

Step-by-step instructions are on our account deletion page. If you no longer have the app, email admin@getcardi.app and we will help you delete it within 30 days. Deleting your account does not cancel an App Store subscription; see how to cancel.

12. Security

We use commercially reasonable technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest, access controls and least-privilege access for staff. Sign-in tokens are stored only as one-way hashes, and staff can reach our admin tools only through an access-controlled sign-in. No method of transmission or storage is perfectly secure. If we learn of a personal-data breach likely to put your rights at risk, we will notify you and the competent supervisory authority as required by law.

13. Children

Cardi is a general-audience fitness app. It is not directed at children under 13, and we do not knowingly collect personal data from children under 13 without verifiable parental consent. The app does not accept a year of birth that would make you younger than 13. For users under 18, plans only aim to maintain weight and custom calorie targets can't be set. If you are a parent or guardian and believe your child has given us personal data, contact admin@getcardi.app and we will delete it.

14. Your rights (EEA, UK and Switzerland)

Subject to local law, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data (you can do this yourself in the app, see Section 11);
• restrict or object to processing, including processing based on our legitimate interests;
• data portability: receive your data in a structured, machine-readable format;
• withdraw consent at any time, without affecting earlier lawful processing;
• complain to a data-protection authority. EEA, UK and Swiss residents may complain to the authority in their country.

To exercise any right, email admin@getcardi.app. Because accounts are anonymous by default, we may ask you for your @handle or friend code to find your account. We aim to respond within 30 days.

15. Notice to U.S. residents (including California)

The categories of personal information we collect are described in Section 3. We have not sold personal information and have not "shared" it for cross-context behavioural advertising as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We use sensitive personal information (health data) only to provide the Service you request. California residents have the right to know, delete and correct their personal information, to limit use of sensitive personal information, and not to be discriminated against for exercising these rights. Residents of other U.S. states with comprehensive privacy or consumer-health-data laws (including Washington's My Health My Data Act, Virginia, Colorado, Connecticut, Utah and Texas) have similar rights, which we honour through the same channel. To make a request, email admin@getcardi.app; authorised agents may act for you with proof of authorisation.

16. Cookies, identifiers and tracking

This website uses no cookies for advertising or tracking. The app uses its own account and device identifiers only to run the Service. Cardi contains no advertising and no third-party analytics or tracking SDKs (the usage statistics in Section 3 are sent by our servers, not by the app), and we do not track you across other companies' apps and websites, so the app does not show Apple's App Tracking Transparency prompt.

17. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you (Article 22 GDPR). Calorie estimates, plans, rankings and league promotions are calculated automatically but are not used to make decisions about you outside the Service. Runs that go beyond realistic limits for pace, distance, duration or calories are saved but automatically left out of leaderboards and leagues; if you think this was a mistake, email admin@getcardi.app.

18. Changes to this Policy

We may update this Policy from time to time. If a change is material, we will tell you in the app before it takes effect. The date at the top of this page shows when the current version took effect.

19. Contact

Questions, requests or complaints about this Policy or our processing of your data: