CardPouch Privacy Policy

Revised: October 15, 2026 Effective: upon publication of this revision and completion of applicable notice requirements Developer/operator: CoderChan Privacy contact: coderchan.support@icloud.com

CardPouch organizes personal documents, bank cards, loyalty cards, coupons and their photos. No developer account is required. Entry, text recognition and search take place primarily on your device. You may optionally enable encrypted iCloud sync. Creating an Apple Wallet pass sends the selected pass content to our signing service. We do not use advertising or cross-app tracking SDKs.

1. Information processed on your device

The app processes photos you take or select; information you enter or recognize, such as names, document numbers, addresses, card numbers, dates, notes and codes; member names and card assignments; categories, ordering, timestamps, archive/deletion status, watermark settings and reminder preferences. These support the features you request.

Credit-card settings include statement dates, fixed repayment dates or days after a statement, reminder timing and paid status. Credit-card notifications can show the card title and last four digits, such as “Bank card (0079)”. They do not contain the full card number, CVV or original photo. General expiry reminders use generic text. You can manage notification previews in iOS settings.

Custom backgrounds include images, editable layers and design names. Wallet appearance settings include selected text, images, colors and pass associations. Settings and migration records support local preferences and device transfers. Available device storage may be checked before writing imported data.

Only store information you are entitled to handle, particularly another person’s identity, financial information or a child’s records. Verify recognition results against the original.

2. Permissions and authentication

Camera access supports capture and migration pairing. The system photo picker provides only selected images; the app does not request the entire photo library simply to import a photo. Notification permission supports local reminders. Local-network permission supports device-to-device migration. Live Activities support optional Lock Screen code display.

Face ID, Touch ID and device-passcode verification are performed by Apple. We receive the verification result, not your biometric templates or passcode. A device passcode is required for the app’s protection features. Declining a permission affects the related feature, not unrelated local functions. Revoking permission does not erase saved records. Sharing and saving to other apps are also subject to their permissions and policies.

3. Storage, encryption and visible copies

Card titles, fields and saved images are encrypted locally, with keys managed through the system Keychain. Some management metadata, categories, timestamps, status, settings and background-design names are not separately encrypted at the application layer. Avoid sensitive text in design names. Viewing, copying and exporting necessarily uses readable content in memory or at the destination.

Home Screen widgets, Control Center entries and Live Activities operate outside the app lock. After you enable the relevant display option, eligible loyalty-card or coupon names, numbers and codes are stored unencrypted in a private shared app directory for system display. This directory is excluded from system backup and becomes readable after the first device unlock following a restart, including while the device is subsequently locked. Other people with access to the screen may see or scan the code. Cards requiring additional authentication, identity documents, bank cards and general cards are not eligible.

Widget and Lock Screen options are separate. Disabling one does not necessarily disable the other. Deleting a card, making it private or making a coupon ineligible removes the relevant shared content; iOS may temporarily retain a rendered image. Live Activities are managed by iOS, can be removed by you and are not remotely updated through our servers.

Local data keys are device-bound. iCloud sync uses a separate sync key made available through iCloud Keychain. We do not keep a developer-held key copy that can remotely unlock your wallet. Missing keys, an unavailable device or incomplete Keychain sync can prevent recovery. Whole-device iCloud/computer backups are not equivalent to the app’s sync or migration: image directories are excluded from system backup and device-local keys do not migrate through an ordinary backup. Verify readable data on the new device before clearing the old one.

4. When information leaves the device

Copying places selected content on the system clipboard. Sensitive-copy paths use local-only content with an expiry of approximately 60 seconds; ordinary text may use different settings. Expiry cannot recall copies already obtained. Exported images and shared files are readable and no longer protected by the app’s lock or encryption. Watermarks do not prevent copying or redistribution. Receiving apps may upload their own copies.

Local migration

Migration transfers card information and images over an encrypted local-network connection between paired devices, without our server. It uses pairing, verification and system authentication. Transfer only to a device you control or authorize. Migration does not erase the source. Widget and Lock Screen permissions must be enabled separately on the destination.

Widgets and Lock Screen display

Names and codes can be visible without unlocking after you opt in. Screenshots, recordings and screen sharing can expose them. Eligible names and numbers also appear when selecting a card for a widget or shortcut. Control Center and shortcut actions start the Lock Screen display rather than exporting card contents to a third-party shortcut.

Apple Wallet signing

When you request a pass, the app sends selected pass titles, brand text, barcode format/content, display text, colors, resized selected images, selected field labels/values, template version and a random pass serial number. This does not upload your entire wallet or unselected original photos and fields. Sensitive text or images you explicitly include in the pass are included in the request.

Our service also processes App Attest key identifiers, public keys, attestations, assertions, challenges and replay counters; a random app UUID; device model, OS/app/build/language/channel information; request identifiers, timing, endpoint, status, error codes, validation field names and rate-limit information. These support authentication, pass ownership, abuse prevention and diagnostics. App Attest private keys stay on the device. The app UUID is not a hardware serial number or advertising identifier; it may remain in Keychain after reinstall and can link multiple requests.

Pass content is processed for signing, not maintained as a long-term pass-content database. Proxies may use temporary buffering. Routine diagnostic logs do not record full bodies, barcode values, field values, images or authentication proofs. Developer logs record diagnostic sizes and statuses rather than full card contents.

The signing infrastructure and Alibaba Cloud SLS logging use Guangzhou, mainland China. SLS diagnostic logs are retained for 30 days; local server logs also follow rotation/capacity rules. IP addresses are processed for connectivity and ingress abuse protection; routine Wallet access logs are disabled and client IP is not a Wallet SLS field. SLS runs on the server, not as an in-app behavior-tracking SDK.

Separate authentication/ownership state includes public keys, identifiers, UUID associations, pass serial ownership, replay protection, quotas and necessary exceptions. These records are not subject to the 30-day SLS retention and are not automatically erased by uninstalling or removing a pass. Expired challenges and rate-limit records are cleaned during subsequent processing. You may request access or deletion by email, subject to necessary identity checks, security and legal obligations. Deleting ownership records may prevent future updates to existing passes.

Apple asks you to confirm adding a generated pass. Wallet stores an independent copy governed by its settings. The app checks its own associated passes, not your payment-card list. Editing or deleting a local card does not automatically update/remove its Wallet copy. The signing service is not a card-backup service.

Support and TestFlight

If you contact us, we receive the details and attachments you submit, for support and issue resolution. Use fictional/redacted examples, not full identity documents, card details, passcodes or verification codes. Access is limited to support needs; copies are retained only as reasonably necessary, then deleted or anonymized unless legally required. You may request access, correction or deletion. Email providers apply their own policies.

Apple processes TestFlight usage, crash and feedback information under its rules and may provide developers with device/build information, sessions, crashes, text and screenshots. We use these to run tests and improve the app. See TestFlight and Apple’s Privacy Policy.

Optional iCloud sync

After you enable and confirm sync, card information, member names/assignments, order, original photos, applied flattened backgrounds and related sync information are encrypted on device and uploaded to your private CloudKit database. CloudKit also processes random record identifiers, types and change metadata. Editable background libraries/layers do not sync. Member/category browsing preferences stay local; widget and Lock Screen consent are device-specific.

Sync requires a usable iCloud account, iCloud Keychain, network and storage. Sync keys are not sent to our Wallet signing server, which does not store synced wallet copies. Apple’s processing is governed by its Privacy Policy and iCloud Terms.

Sync propagates edits and deletions; it is not a historical backup. Turning it off or uninstalling does not automatically erase cloud copies. Use available iCloud storage-management controls to manage cloud data, considering other devices and pending uploads before deletion. Cloud deletion does not promise removal of every platform record retained under Apple’s rules. Background scheduling, locking, conflicts or network conditions may delay updates.

Purchases and subscriptions

Apple handles payments and refunds. StoreKit supplies product and transaction identifiers, original transaction identifiers, purchase/expiry times, revocation status and verified entitlement results for activation, restoration and management. Necessary entitlement state is kept locally for the app and extensions. We do not receive your Apple Account password, full payment-card number or verification codes, and do not attach card contents to purchases.

Legacy-user grant eligibility and dates are stored locally; a grant does not start a paid subscription. Uninstalling or deleting cards does not cancel a subscription. See our purchase terms and auto-renewal notice.

5. Recipients and international processing

We do not sell personal information or provide card contents to advertisers. Transfers occur for the optional features described above. Apple, email providers and recipients you choose may process information in different jurisdictions under their rules. Lawful disclosure requests for data we actually hold are assessed and limited to what is necessary; notice is provided where permitted. We cannot provide local plaintext card contents that we do not hold.

6. Retention, deletion and your choices

You may view and correct records. Deleted cards normally remain in Recently Deleted for 30 days and are cleared when the app performs cleanup, not necessarily at an exact background deadline. You may permanently delete them earlier. Saving a deletion of an individual original photo removes that attachment rather than placing it in a separate photo recycle bin. Synced deletion changes propagate to participating devices.

Design-library items and applied card backgrounds are separate copies; manage both if needed. Deleting the app removes local app data; offloading may preserve documents. Keychain items, system copies, cloud records, exports, source photos and Wallet passes have separate lifecycles. Manage them separately. Closing sync retains existing local/cloud data; removing server ownership data is also a separate request.

You can stop sharing/migration, revoke permissions and contact us regarding access, correction, deletion, withdrawal of consent or other applicable rights over information we actually hold. We respond within applicable legal periods and request only necessary verification, not complete card contents. No developer account exists to close. We cannot remotely inspect, delete or recover your device’s cards.

7. Children, changes and contact

The app is not primarily directed at children. Minors should use it with guardian guidance and any legally required consent. Guardians storing children’s information should assess necessity and sharing carefully. Contact us if you believe we improperly received a child’s information.

We update the revision date when this policy changes and provide appropriate notice of material changes. Where new consent is required, publication alone does not replace it. Questions and privacy requests: coderchan.support@icloud.com.