Privacy

This policy explains what happens to your data on cardpolish.com and when you join the waitlist. The app itself does not exist yet; this policy will be extended before it launches.

Who is responsible

Visiting the website

This website sets no cookies, uses no tracking or analytics, and loads no content from third parties. Fonts are served from our own server.

When you open a page, the hosting provider automatically processes technical data your browser sends: IP address, date and time, the page requested, browser and operating system. This is needed to deliver the website and keep it secure (Art. 6 (1) (f) GDPR). The website is hosted by Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA, on servers in the EU (Amsterdam, Netherlands), under a data processing agreement (Art. 28 GDPR). Railway is a US company, so data may be transferred to the United States; the transfer is based on the EU Standard Contractual Clauses that are part of that agreement (Art. 46 (2) (c) GDPR). Railway keeps these logs for at most 30 days and then deletes them.

Joining the waitlist

When you join, we collect your email address and, if you fill them in, the language you are learning and whether you teach languages. We use this only to email you once when the first version of Card Polish is ready and, if you ticked the box, to tell you about tools for tutors. The legal basis is your consent (Art. 6 (1) (a) GDPR).

Joining takes two steps (double opt-in): we first send you an email with a confirmation link. Only when you click it are you added to the waitlist. If you do not click it, you are not added; the link expires after 7 days.

You can withdraw your consent at any time, without giving a reason, by writing to hello@cardpolish.com or through the unsubscribe link in our email. Withdrawal does not affect anything processed before it.

We keep your waitlist data only until the launch: once the launch email has been sent, we delete it. If you withdraw your consent earlier, we delete it then.

Our email service

The sign-up form and the confirmation step run on our own small service, hosted by Railway as described above. To prevent abuse it counts requests per IP address for ten minutes, in memory only; it does not store your IP address.

Emails are sent, and the confirmed waitlist is stored, by Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA), under a data processing agreement (Art. 28 GDPR). Resend processes data in the United States. The transfer is based on the EU–US Data Privacy Framework (Art. 45 GDPR), under which Resend is certified, and on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Email to hello@cardpolish.com is received through Resend as well. Spam is filtered with a hidden form field; no third-party captcha is used.

Contact form and email

The contact form asks for your name, your email address and your message. Our email service delivers it to our inbox through Resend, as described above.

If you write to us through the form or by email, we use your email address and message only to answer you (Art. 6 (1) (f) GDPR) and delete them once the matter is settled, unless we are required by law to keep them.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on Art. 6 (1) (f) GDPR. To use any of these rights, email hello@cardpolish.com.

You also have the right to complain to a data protection supervisory authority, in particular in the EU member state where you live or work.

As of November 2026