Privacy

Information Code Card handles

• Account information: username/handle, display name, email address, verification state, authentication credentials stored in protected form, sessions, and account-security records.
• Code and community content: Code Cards, revisions, titles, descriptions, tags, source information, publication state, collections, saves, contributor-profile settings, ideas, comments, bug reports, and card reports.
• Moderation and administration records: review decisions, report status, staff replies, role changes, reasons supplied for staff actions, and audit history.
• Security and operational information: authentication attempts, rate-limit events, transactional-email delivery events and suppression status, service logs, monitoring information, and backup records. Network information such as an IP address may be processed for abuse prevention; application IP-rate-limit records use keyed digests rather than storing a raw IP-address column.
• Product-usage analytics: Code Card records first-party events such as page views, searches and zero-result searches, card opens, saves, forks, collection views, registrations, and card publication. Analytics can include a random browser identifier stored on your device; the server stores a SHA-256 digest of that identifier rather than the identifier itself. The analytics event table does not include a raw IP-address field.
• Billing information: when paid plans are enabled, Code Card stores payment-provider customer and subscription references, selected plan, subscription status, renewal-period information, and billing-webhook records needed to grant or remove paid entitlements. Code Card does not store full card numbers in its application database.
• Creator Support information: when Creator Support is available, Code Card stores the creator payout-account reference supplied by Stripe, support transaction identifiers, amounts, Code Card/creator split amounts, payment/refund/dispute status, Stripe event references, payout-risk and administrative-review state, and audit records needed to reconcile support activity. Code Card does not store creator bank-account numbers, identity documents, or Stripe KYC verification documents in its application database.
• Browser-local information: some preferences, local drafts, themes, the random analytics visitor identifier, and other browser-only state may remain on the device where they were created.

How information is used

Code Card uses this information to authenticate accounts, deliver verification and recovery messages, save and publish content, provide collections and contributor profiles, understand which library features and searches are useful, identify searches that return no results, respond to bug reports and community feedback, moderate reported material, prevent abuse, investigate security problems, maintain audit records, monitor production health, and restore the service after a failure.

What becomes public

Published Code Cards and public collections are visible to visitors. Contributor-profile information is private by default and becomes public only according to the profile controls you enable. Private drafts, private collections, private bug reports, account email addresses, sessions, and administrator records are not intended to be public.

Service providers

Code Card relies on infrastructure and service providers for hosting, transactional email, monitoring, security, encrypted backup storage, and payment services. Stripe provides hosted billing for paid plans and, when Creator Support is available, connected-account onboarding, identity/KYC checks, bank-account collection, payment processing, transfers, payouts, refunds, and dispute handling. Stripe may retain information it is required to keep for compliance, fraud prevention, financial reporting, or legal obligations even after a Code Card payout relationship ends. Code Card does not sell personal information.

Retention and backups

Information may be retained while needed to operate the service, secure accounts, resolve moderation or support issues, maintain audit history, and meet recovery requirements. Raw first-party product-analytics events are configured for a 90-day retention window; retention jobs delete older raw events. Deleted or changed information can remain temporarily in encrypted backups until those backups expire under the backup-retention schedule.

Your choices

You can control whether supported contributor-profile information is public, manage active sessions, publish or unpublish your Code Cards and collections, and use the account-security controls for verification and recovery. The first-party analytics client also respects supported browser Global Privacy Control and Do Not Track signals. For privacy questions or requests, see the Support page.