Privacy notice

This notice describes what Stonewing Cards actually does. It is not a certification of legal compliance.

Public profile pages

When you open a profile page (a link starting with /c/ or /p/), the server records an anonymous view event for the card owner's company: the profile, the card (if you came from a physical card), the link origin (NFC, QR or direct) and the time. When you tap a contact button we record a click event of the same kind. Downloading a contact file records a download event.

• We do not store your IP address, your location, your device identifiers, or your browser details.
• A random cookie (swc_v) that is not linked to you is set for 24 hours so repeat views from the same browser are not double-counted. Your IP address is used only transiently, in hashed form, for rate limiting.
• Events are automatically deleted after 90 days.
• "NFC" and "QR" are labels describing the link that was opened, not proof of a physical tap.

Sharing your details with a card owner

The "Share your details" form is optional. If you submit it, the name, email, phone and message you enter are stored for the card owner's company together with the consent text you agreed to and the time. Only authorised members of that company can read them. We do not add you to any marketing list; the company you contacted is responsible for how it uses your details.

Account holders

Team members sign in with an email address and password managed by our authentication provider (Supabase, hosted in Canada). Profile details you publish are public by design; draft changes stay private until you publish. Uploaded images are stored in a public bucket under an unguessable address: an image can remain reachable at that address after a profile is unpublished until it is deleted. Administrator actions are logged in an audit trail visible to company administrators.

Contact

Questions about this notice can be sent to the company that issued the card you received.

Stonewing Cards · Home