Cookie Notice

1. Scope

This Cookie Notice applies to Cardberry websites, applications, and related services that link to it (collectively, the “Services”). It should be read with our Privacy Policy and Terms of Use.

2. What cookies are

Cookies are small text files stored by a website in your browser. Session cookies usually expire when a browsing session ends. Persistent cookies remain until their configured expiry or until you delete them. First-party cookies are set for the Cardberry site you visit; third-party technology may be provided from another domain.

Browser local storage and session storage are not cookies, but they can remember information in similar ways. Section 4 describes Cardberry’s use of them.

3. Technology we use

Marketing analytics

Google Analytics measures visits to public marketing pages and clicks to the Shopify App Store. It also processes technical and session information, including cookie identifiers and browser information. Your browser sends network information to Google when using its service. An App Store click does not tell us whether you installed Cardberry.

These analytics cookies use the cbmarketing prefix and are limited to the marketing host. They are configured to expire after 90 days. Google may refresh the session cookie during use. We do not use this feature to join marketing visitors to Cardberry accounts, stores, slabs or Shopify installations. Google's Privacy Policy describes its processing. Cookie expiration is separate from retention of data already received by Google.

Merchant application analytics

Google Analytics on app.cardberry.ai measures general page types and coarse import, card-match acceptance and reviewed listing-sync outcomes after sign-in. It uses separate analytics cookies with the cbapp prefix, limited to that application host. They are configured to expire after 90 days; Google may refresh its session cookie during use. Cookie expiration does not determine how long Google retains data it has already received.

Application events exclude names, emails, certificate numbers, card titles, prices, inventory/shop/account identifiers, credentials, query strings, fragments and referring addresses. Google still receives its own cookie identifiers, browser/session information and network information when the browser contacts its service. The feature does not link marketing visits to accounts or installations, use advertising features or Google Signals, or measure authentication pages, support impersonation or Cardberry App Home inside Shopify.

Account and security cookies

The merchant application uses first-party, necessary cookies to create and maintain authenticated sessions, remember whether a session should persist, prevent misuse, and support secure account actions. These cookies are host-only and are not used to track you across unrelated sites.

Cloudflare Turnstile

Account creation, sign-in, and password-recovery forms use Cloudflare Turnstile to distinguish legitimate requests from automated abuse. Turnstile may process request, browser, device, and interaction information and may use necessary cookies or similar storage. Cloudflare handles that information under its Privacy Policy.

Shopify connection state

When an authorized merchant connects Shopify, Cardberry sets a short-lived, first-party security cookie that binds the connection callback to the browser and account that started it. It expires after approximately 10 minutes and is cleared when the callback completes.

Authorized support sessions

If a Cardberry platform operator starts an authorized support session at a merchant’s request or for legitimate support and security purposes, a necessary first-party cookie may preserve the merchant’s prior session so it can be restored when support ends. It is not used for advertising or cross-site tracking.

4. Browser storage

App analytics duplicate checks

App analytics uses optional session storage under cardberry:app-analytics-receipts to remember up to 500 observed workflow outcomes and first-observed event markers within the current signed-in session and workspace. The local keys can contain internal identifiers needed to separate sessions and avoid duplicates; those keys are not sent to Google. This is not a record of your account's first-ever import, match or sync.

Signing out or an active Global Privacy Control signal clears this app analytics storage. The browser also clears session storage according to its tab-session behavior. Blocking storage leaves a temporary duplicate check in memory; deleting storage or using another device could allow the same outcome to be counted again. Once the history is full, further workflow observations are skipped for that session.

Former analytics preference

The marketing site no longer reads or saves the analytics choices used by its former cookie prompt. A previously saved choice does not control the current analytics feature. Global Privacy Control is checked before Google Analytics loads. Your browser's site-data controls can remove old local storage values.

Theme preference

Cardberry stores your light or dark theme choice in local storage under a Cardberry-specific key. This preference remains until you change it or clear local site data.

Active workflow state

The merchant application uses session storage to remember the identifier and status of an active import or Shopify sync while you move between application pages or reload a tab. This data is limited to workflow state and is cleared as the task completes, when Cardberry no longer needs it, or when the browser clears the tab’s session storage.

5. Duration and providers

Necessary cookies last only as long as required for their function. Some expire with the browser session, some expire within minutes after a security flow, and an authenticated session may persist for the period selected or configured for that account. Cardberry may adjust exact cookie names and durations as security and service behavior evolve without changing the purposes described here.

Cardberry’s hosting and security providers may process ordinary network request logs. Request logs are not cookies, but related information is described in our Privacy Policy.

6. Your choices

Most browsers let you view, delete, or block cookies and clear local or session storage. Browser controls vary by provider and device. Blocking necessary cookies or storage may prevent you from signing in, connecting Shopify, restoring a support session, remembering a preference, or completing an active workflow.

To prevent marketing analytics, use a browser that sends Global Privacy Control or a browser tool that blocks Google Analytics. Global Privacy Control stops this feature from loading and removes its existing marketing cookies from this browser. Blocking cookies alone may not stop all analytics requests. These controls do not erase data already sent to Google. Cardberry does not sell or share personal information for cross-context behavioral advertising.

App analytics is also on by default, without a cookie prompt or on-site preference control, and respects Global Privacy Control and an existing Google Analytics opt-out. Global Privacy Control prevents loading, stops further app analytics and clears its app cookies and receipt storage. Browser tools can block Google Analytics without preventing sign-in or inventory use. These controls do not erase data already sent to Google, and blocking cookies alone may not stop all analytics requests.

7. Changes and contact

We may update this notice when the technology used by the Services changes. We will post the updated notice here, revise the effective date, and provide additional notice or choices where required.

Questions about this notice can be sent to Cardberry at privacy@cardberry.ai.