Privacy Policy and Data Protection

Last updated: 5 November 2026

These policies may be updated from time to time as CardFlow SG grows. Please check this page for the latest version; continued use of CardFlow SG after changes means you accept the updated version.

1. Who we are

CardFlow SG operates cardflowsg.org and app.cardflowsg.org, a trading card community hub for Singapore. We handle personal data in line with Singapore’s Personal Data Protection Act 2012 (PDPA).

2. What we collect

• Account data: username, email address, chosen role (Buyer/Seller/Organiser). Passwords are handled by Supabase Auth and stored only as secure hashes — we never see them.
• Content you create: listings, booth details, wishlists, events, profile photos and card photos.
• Support data: messages and tickets you send us, including any optional photo you attach. Ticket details are emailed to the CardFlow SG team so we can respond.
• Usage data: aggregated app activity and basic technical data (device/browser type, pages visited) used for product analytics.
• Payment records for optional paid features (e.g. PayNow reference and amount) — we do not store card or bank login details.

3. Why we use it

• Create and secure your account, including email verification codes
• Show your listings, booths and wishlists to the community
• Respond to support requests and keep the platform safe
• Send essential service emails
• Understand usage to improve CardFlow SG

4. Consent and purpose

We collect, use and disclose personal data with your consent, given when you sign up and tick the agreement checkbox, or as otherwise permitted under the PDPA. We only use data for the purposes described here or notified to you.

5. Who we share it with

We do not sell personal data. We share it only with service providers that help run CardFlow SG:

• Supabase — authentication and database
• Cloudflare — hosting, security and Web Analytics
• Resend — sending emails such as verification codes and support ticket alerts to our team
• jsDelivr — content delivery network that serves app code libraries (it receives standard request data such as IP address)

Information you post publicly (e.g. username, listings, booth details) is visible to other users. We may also disclose data where required by law.

6. International transfers

Our providers may store or process data outside Singapore. Where this happens, we take reasonable steps to ensure a standard of protection comparable to the PDPA.

7. Retention

We keep personal data while your account is active and as needed for the purposes above or legal requirements. When you ask us to delete your account (email us or use Support in the app) or it is no longer needed, we delete or anonymise it within a reasonable time.

8. Security

We use reasonable safeguards including encrypted connections (HTTPS), hashed passwords, access controls and database row-level security. No system is completely secure, so please use a strong, unique password.

9. Your rights

Under the PDPA you may request access to or correction of your personal data, and withdraw consent (which may mean we can no longer provide your account), or ask us to delete your account. In the app, open your Profile and choose “request a copy, correction or account deletion”, use Support, or email [email protected]; we aim to respond within 30 days.

10. Cookies and analytics

We use essential browser storage to keep you signed in. For analytics we use Cloudflare Web Analytics, a privacy-first tool that does not use tracking cookies or fingerprint visitors. We do not use advertising trackers.

11. Children’s privacy

CardFlow SG is not intended for children under 13, and users under 18 should have a parent or guardian’s permission. At signup users confirm they are 13 or older. If you believe a child has given us personal data, contact us and we will delete it.

12. Data Protection contact

For privacy questions or requests, contact our Data Protection contact at [email protected].