Privacy Policy

UriCard is operated by [YOUR FULL LEGAL NAME] (ABN [YOUR ABN]), trading as UriCard. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Privacy questions and requests: [YOUR SUPPORT EMAIL].

This matters for understanding the rest of this policy, so it’s worth being clear up front.

Your information— the account you create with us. We decide how that’s handled, and this policy governs it.

Your customers’ information— the names, addresses and contact details you enter when you record a sale or an invoice. We hold that on your behalf and act on your instructions. You decide what to collect and why; we just store it and show it back to you. If one of your customers wants their details corrected or removed, they should contact you, not us — though we’ll help you action it.

• Your email address — needed to create your account and to sign you in.
• Your business details — business name, location, ABN and payment details, where you choose to enter them for invoices.
• Your records — inventory, sales, expenses, receipts, notes and images you upload.
• Subscription information — your plan, its status, and a Stripe customer reference. We never receive or store your card number.
• Basic technical logs — IP address, browser type and timestamps, kept for security and debugging.

We don’t use advertising or analytics trackers, and we don’t set cookies beyond what’s needed to keep you signed in and remember your theme and layout preferences.

UriCard uses a one-time code emailed to you rather than a password. We store a hashed version of that code briefly while it’s valid, never the code itself in readable form. Your session is a signed token in your browser; signing out everywhere invalidates all of them.

We keep this list short on purpose. Each of these does a specific job:

• Stripe — payment processing for subscriptions. They receive your email and billing details directly; we receive back only a customer reference and your plan status.
• Resend — sends your login codes and invoice emails. Receives the recipient address and message content.
• Cloudflare R2 — stores images you upload (card photos, receipts). Receipt images are held in a private bucket and served only through short-lived signed links.
• Our hosting provider — runs the application and database.

We also fetch card catalogue data from public sources such as Scryfall, TCGdex, YGOPRODeck, Lorcast, Riftcodex and DigimonCard.io, and we link out to eBay for comparable sales. Those are outbound lookups and links — we don’t send your data to them.

We don’t sell your information, and we don’t use it to train machine-learning models.

Your data is stored on servers in the European Union, and image files on Cloudflare’s distributed storage. Stripe and Resend process data in the United States and elsewhere. That means your information may be handled outside Australia, and by using UriCard you consent to that transfer. We choose providers that commit to appropriate safeguards.

While your account is open, we keep your records so the service works — bookkeeping is only useful with history behind it.

After you close your account we keep your data for 30 days so it can be restored if the closure was a mistake, then delete it. Uploaded images are deleted on the same schedule. We may keep a minimal record of billing transactions for as long as Australian tax law requires, currently five years.

Traffic is encrypted in transit. Receipt images sit in a private bucket reachable only through expiring signed links. Access to production data is limited to what’s needed to operate and support the service.

No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.

You can access and correct most of your information directly in the app. You can also ask us to send you a copy of what we hold, correct something you can’t change yourself, or delete your account and its data.

Email [YOUR SUPPORT EMAIL]and we’ll respond within 30 days. If you’re unhappy with how we’ve handled a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

We’ll update this policy as UriCard changes. For material changes we’ll email you before they take effect. See also our Terms of Service.