CardPetal
Make a card

Privacy policy

Last updated: October 28, 2026.

The short version

Cards sent by short link

When you create your card, it is compressed in your browser and sent to our server, which stores it under a random 8-character code and gives you the short link. What we store: the compressed card (recipient and sender names as you typed them, the message, the design, handwriting, ink, music setting and, if you added one, the small thumbnail photo) and the date it was created. We don’t store your IP address with the card or link cards to each other or to any person. To limit abuse, creating links is rate limited using a short-lived, salted hash of your IP address that is kept in memory only and discarded daily.

How long: we keep cards for at least two years from the day they were created so that links you send keep working; we may delete older cards after that. Every night the card and ticket database is backed up; the backups are encrypted with age and kept off our web server in Google Cloud Storage in Frankfurt (EU, europe-west3), where a lifecycle rule deletes each one after 60 days (Google’s soft-delete protection keeps it for about 7 more days).

Deleting a card: write to support@cardpetal.com with the card link (the address that starts with cardpetal.com/c/). We delete it, usually within a few days, and the link stops working; its code is never reused for another card. It also disappears from our backups as they expire, within about two months at the latest.

Older links: links created before short links existed (and the rare fallback link if our server can’t be reached) carry the whole card after the # sign, which browsers never send to a web server — those cards are not stored by us at all.

Gift-exchange draws and advent calendars

A gift-exchange draw (Secret Santa, Wichteln, amigo invisible and the like) gives each person a private link to their ticket, cardpetal.com/t/…. A ticket holds only what that one draw needs: the giver’s and the receiver’s names as the organizer typed them, the receiver’s wishes, the budget, the exchange date and the organizer’s note. It is used for that draw only.

Tickets are deleted automatically 30 days after the exchange date, and no later than the January 31 that follows (at least 30 days after the draw is made); every ticket stays at least 7 days. After that, the link stops working. It also disappears from our backups as they expire, within about two months at the latest. The organizer gets a private status view that shows only whether each person has opened their ticket — never names, pairs, wishes or times. Ticket pages load no ads, no analytics and no other third-party code.

Advent calendars are kept like other cards, but their doors stay locked on our server: when a calendar is opened, our server sends only the doors whose day has come in the recipient’s time zone, so later doors never reach the browser early.

What stays on your device

While you write, the card maker keeps a draft (without the photo) in your browser’s local storage so you don’t lose it if the page reloads. Photos are resized in your browser; the original file never leaves your device. Videos and images you download are created in your browser too.

Server logs

Our web server, hosted in the European Union, keeps standard access logs (IP address, time, requested page — for short links this includes the card code — and browser type) for security and troubleshooting, for up to 14 days.

Analytics

We use Google Analytics 4 with IP anonymisation to count visits to our pages and see which ones are useful. It uses cookies and records information such as the pages you view, how you arrived, your approximate region and your type of device. It never receives the contents of your cards. You can opt out with the Google Analytics opt-out browser add-on.

Advertising

We use Google AdSense and Adsterra to show clearly labelled ads on information pages, such as occasion guides and the home page. Ads never appear inside a card or on card links (cardpetal.com/c/…).

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.

Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info or, in Europe, at youronlinechoices.eu.

To learn how Google uses information from sites that use its services, see How Google uses information from sites or apps that use our services.

Adsterra, our second ad network, and its advertisers may also use cookies or similar technologies to show ads and measure them. See Adsterra’s privacy policy.

Consent in Europe

If you visit from the European Economic Area, the United Kingdom or Switzerland, Google shows you a consent message from its certified consent management platform before personalised Google ads use cookies on your device. Clearing this site’s cookies shows the message again, so you can change your choice at any time.

Children

CardPetal is a general-audience site and doesn’t knowingly collect personal information from children.

Your rights and contact

We don’t have accounts, so the only personal data we may hold is what you put in a card or what an organizer puts in a draw ticket. To access or delete a card or a ticket, send us its link. For any privacy question, write to support@cardpetal.com — Novpix LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Changes to this policy

When this policy changes, we update the date at the top of the page. The policy is also available in the other languages of the site; if a translation differs from this English version, the English version applies.