Last updated: July 16, 2026
Cardcastr is published by Loïc Massotte. This page explains what data we collect, why, and how to exercise your rights.
Account: email, name, password (hashed, never stored in plain text), Google ID if you sign in with Google. Streamer profile (optional): display name, bio, profile picture. Stream sessions: date, duration, and the details of items sold during your lives (including the buyer's Whatnot username — public third-party data, nothing else about them). Crash reports: technical context, error message, stack trace, app version — sent automatically if the app hits a bug. Waitlist: email address only.
Account, profile, and stream sessions: necessary to provide the service you asked for (showing your history, managing your subscription). Crash reports: legitimate interest in improving the app's reliability. Waitlist: only to notify you when a beta spot opens up, based on your consent (signing up).
Your data is kept for as long as your account exists. You can request the complete and immediate deletion of your account at any time (see "Your rights" below).
No one but Cardcastr, except for the technical providers strictly necessary to run the service: Stripe (payments), Cloudflare R2 (hosting your profile picture), Resend (sending transactional emails such as password resets). No data is ever sold or shared for advertising purposes.
The site only uses a session cookie strictly necessary for sign-in (authentication token). No analytics or third-party advertising cookies are set.
You can access and correct your data at any time (Profile view in the app, or the site dashboard), or request its complete deletion — a "Delete my account" button is available directly in the app (Profile view) and on the site dashboard. For any other question or request, email us at contact@cardcastr.com.
Passwords are hashed (never stored in plain text) and all communication with our servers is encrypted (HTTPS).
Don't have an account yet?
Create account