Privacy Policy

CardTogether is built to work without collecting more than it needs. This page describes what actually happens with your data.

No accounts, no email collection

There is no sign up and no login. Creating a card, adding a message, or viewing a card never asks for your email address, and CardTogether does not collect one. Access to a card, or to a message you added, is controlled entirely by the private link generated for you: whoever holds that link can view or edit, and it is never emailed to you because you already have it in your browser the moment it's created.

Cards auto-expire after 60 days

Every card and its messages are automatically deleted 60 days after the card was created. The clock starts at creation, not at the last message, so a card made on 1 March is deleted on 30 April whether anyone signed it or not. This is not a manual cleanup: it's a fixed rule the app enforces on every card, without exception. If you want to keep a card, download it as a PDF from the card management view before it expires.

What we store

While a card is active, CardTogether stores the card title, the messages and names contributors enter, and any GIF you attach, so the card can be displayed to people with the link. That's the whole record. It is deleted automatically at the 60-day mark described above.

A single message can hold up to 2,000 characters, and a card holds an unlimited number of messages, so there is no cap on how many people can sign. Both limits are listed with every other product fact on the CardTogether facts page.

No tracking cookies

CardTogether does not use advertising or cross-site tracking cookies. A short-lived session cookie and a CSRF token cookie are used only to keep the create-a-card and add-a-message forms working correctly and to protect them from cross-site request forgery; neither is used to track you across sites or build a profile.

Analytics

CardTogether uses a self-hosted, cookieless analytics tool (Umami) to see coarse, aggregate traffic patterns, such as how many people visit a page. It does not use cookies, does not fingerprint individual visitors, and does not tie page views to a card, a message, or a name.

The CardTogether assistant plugin

CardTogether can also be used from an AI assistant through a plugin, which talks to the same app over a published endpoint at /mcp. Nothing new is collected. A card created or signed that way stores exactly what the website stores: the card title, the name and message text the person asked to add, an optional GIF URL, and the card's own id. There are still no accounts, no email address, and no sign-in, and the card is deleted 60 days after it is created on the same fixed schedule.

The plugin records one flag on cards created through it so we can count how many cards come from an assistant rather than the website. It records no conversation, no prompt, and nothing about who was talking. The assistant platform that forwards the request is the only recipient of the links the plugin returns, and the platform's own privacy policy covers what it does with the conversation. A card's messages are never read back to an assistant unless the person supplies the private owner link for that card.

The CardTogether app for Microsoft Teams

The CardTogether app for Microsoft Teams does two things: it previews cardtogether.com card links pasted into a chat, and it creates a new card from the title you type. Microsoft Teams sends the app the pasted link or the title, along with standard request details such as tenant and conversation identifiers. CardTogether uses the link or title to answer and stores none of those identifiers. A card created from Teams stores exactly what the website stores, plus one flag saying it came from Teams so we can count those cards. The preview shows the card's title, how many people have signed, and a preview image, which Teams then shows to the people in that chat. It never shows message text or the private owner link, and the owner link for a card you create is shown only to you. The card is deleted 60 days after it is created, on the same fixed schedule.

Third-party services

GIF search is powered by Giphy: a search query you type is sent to Giphy's API to return results. A GIF you select is embedded by its Giphy URL. No other third-party service receives your card content.

Questions

CardTogether is built by Urban Algorithm LLC. For any question about this policy, contact us through Urban Algorithm.