CardYeah
Privacy policy
In short: CardYeah does not collect personal data. Your passes, photos and details stay on your iPhone. There is no account, no analytics, no advertising and no tracking.
Who is responsible
CardYeah is made by Floris Kuijpers in the Netherlands. For questions about privacy, email [CONTACT EMAIL].
What stays on your iPhone
Everything you put into a pass stays on your device: text, barcodes, photos, logos, places, dates and tags. CardYeah stores it in the app's own storage. We never receive a copy.
Photos you pick, barcodes you scan and text read from a card photo are processed on your iPhone. Backups you export are files that you keep and share yourself.
Adding a pass to Wallet
Apple requires every Wallet pass to be signed with a certificate. To keep that certificate safe, CardYeah signs passes on its own server at cardyeah.floriskuijpers.nl. For each pass, the app sends only:
- a list of the file names in the pass, such as pass.json and icon.png, with a fingerprint (SHA-1 hash) of each file;
- a one-time code the server handed out, and a proof from Apple's App Attest that the request comes from a genuine copy of the app.
The server never receives the text, images or barcode of your pass, and it cannot reconstruct them from the fingerprints. It sends back only the signature.
App Attest gives each installation of the app a random key. The server keeps that key and a counter to recognise genuine requests. The key is not linked to your name, Apple ID or device details.
Server logs
The signing server and its web server record, per request, the time, the kind of request, the result and how long it took. They do not record request contents or IP addresses. Your IP address is kept in memory for at most one hour to prevent abuse (rate limiting) and is never written to disk.
Features that contact others
Some features connect directly from your iPhone to another service. CardYeah does not send anything else along, and we do not receive these requests.
- Link an app sends what you type to Apple's App Store search.
- Add place sends what you type to Apple Maps search. Use current location uses your location only at that moment, on your iPhone.
- Find logo from website asks the website you enter for its icon, as a browser would.
These services handle requests under their own privacy policies, such as Apple's.
Permissions
- Camera: only when you scan a barcode or card.
- Location: only when you tap Use current location.
- Photos: CardYeah uses the system photo picker and only sees the photos you choose.
You can change these at any time in the iPhone's Settings.
Apple Wallet
Passes you add are stored by Apple Wallet. Apple may sync them with iCloud according to your iCloud settings and Apple's privacy policy.
Your rights
Because we do not hold personal data about you, there is nothing for us to show, correct or delete. To remove your data, delete your passes in CardYeah or delete the app. Under the GDPR you can still contact us with any question, and you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Children
CardYeah does not collect data from anyone, including children.
Changes
If this policy changes, the new version is published on this page with a new date.