Privacy: what is stored, where and for how long

Where it is kept

Your business details, cards, visits and customer requests are kept in one Cloudflare D1 database that belongs to this site, until you delete them. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

What is stored for an owner

• A random account id, the account name you chose for your passkey manager (or Mendcard owner), and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use, counted a day at a time).
• Your email address, only if you add one, whether it is confirmed, and a scrambled form of the one confirmation link sent to it (which works for 24 hours). It is used only for visit request emails to you, and it is the one place an email address of yours is stored.
• Your business: its name, trade, phone number, website and time zone, and a scrambled form of your due feed link.
• Your cards: kind, title, make, model, serial number, registration plate (vehicles only), install month, customer label, note about the customer, how the due shows, the date the customer sees visits from, the next due, and when the card was made, changed, archived, deleted, restored or given a new link. The customer card shows the last two as dates.
• Your visits: date, work done, parts, the next due choice and the date it set, whether the customer sees it, your note on it, and when it was saved.
• Notices for you, such as a visit request email, kept 90 days, and a record of each email sent (who, when, which kind; no text), kept 30 days.

Your customers' details

You decide what goes in a customer label and a note about the customer; they are your own business records about your customers and are never shown on a customer card. When a customer asks for a visit, the request keeps the card it came from, the phone number or email address they typed, when suits them, and when it arrived. Customers have no account, get no cookie and are never sent email. Their requests, with their contact details, are deleted 90 days after they arrive.

Your due feed includes your customer labels. A calendar app that subscribes fetches it from its own servers, so those labels then sit with your calendar provider too. Make a new feed link to stop an old subscription.

Links

• For each card: a scrambled form (SHA-256) of its link secret, plus a sealed copy that only this server can open with its own secret key, so you can see the link again.
• When you make a new link for a card, or a deleted card is removed for good, only the scrambled form of the old secret is kept, so an old sticker can say the card has moved or is no longer kept. It goes when your account does.

Limits on how fast requests come

To stop a card being flooded, the server counts visit requests per network address in hourly buckets, and your own saves per account. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• Your account, business details, cards and visits: until you delete them.
• A deleted visit or a deleted card: 7 days, while it can be restored, then deleted for good.
• Customer visit requests and their contact details: 90 days after they arrive, then deleted for good, along with any email that listed them.
• A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
• Sessions: until 90 days after the last visit on that device, or until you sign out.
• Passkey sign in requests: 5 minutes. Rate limit buckets: 2 hours. Email records: 30 days.

What stays on your device

A visit or a visit request you are typing is kept in your browser's local storage under keys beginning with servicecard until the server confirms it, so a dropped connection loses nothing. The secret part of a card link sits after the # sign, which browsers do not send to any server in the address.

How to see and delete it

On your account page, Download everything gives one JSON file with all of it. Delete my account stops every customer link at once and removes everything after the 7 days above; you can also delete single visits, cards and requests. Requests by email go to [email protected].

Cookies

One cookie, and only for owners who sign in: a session cookie that keeps you signed in. It cannot be read by page scripts and is never sent to another site. Customers get no cookie.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only owners can receive email: first one confirmation link, then, once confirmed, visit request emails. Customers are never emailed. Emails carry no tracking images.

Typeface

Headings are set in Barlow Semi Condensed by The Barlow Project Authors, under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].