Privacy Policy — Card Master

Last updated: October 6, 2026

Card Master (the "App") is a tool for managing MikroTik networks, generating internet vouchers, and managing subscribers. This policy explains what data we collect, how we use it, and how we protect it.

1. Data We Collect

• Account data: your email address (via Google or email/password sign-in) to create your account and authenticate you.
• Subscriptions and payments: plan, expiry, transaction identifiers and records for activation and reconciliation. Payments use Google Play or the provider displayed when another method is selected. Never send card details to support.
• Router data: address, identity, serial, credentials and subscriber, voucher and sales data as required by the features you use. Local credentials use secure storage. Cloud, sync and bot features also process related data and connection credentials through Firebase and our backend; not all data remains on your device.
• Usage and diagnostics: feature events, performance and crash reports, potentially linked to account/device identifiers and app version. The app uses PostHog, Sentry and Firebase Crashlytics, plus backend diagnostics. We redact known secrets but do not claim all diagnostic data is anonymous.

2. How We Use Data

• To operate the App: connect to your router, generate vouchers, manage subscribers.
• To authenticate you and manage your subscription and trial.
• To send notifications related to your account or router (if enabled).
• To improve the App and fix crashes.

3. Third-Party Services

• Google Play Billing: Google handles Google Play purchases and subscriptions; we retain subscription status and transaction identifiers/records for verification and activation. Other selected payment methods display their provider.
• Google Firebase (authentication, database, notifications, crash reporting) — governed by Google's privacy policy.
• PostHog and Sentry: usage analytics and error reports. They receive the diagnostic data sent to them; contact us about processing and retention.
• Brevo: delivers account-related email and receives the recipient address and message content needed for delivery.
• Telegram (optional): if you connect a Telegram bot, the bot token you provide is sent to Telegram's servers to enable notifications. You control and can disable this.
• Cloud backend: relays connections and processes ownership, tunnel and connection data for monitoring and synchronization. It may retain router-data caches, related records and backups. Closing the app does not delete these records.

4. Data Security

Local credentials use secure storage; requests to our service gateway use HTTPS. Router and tunnel encryption depends on RouterOS and configuration. We do not claim every LAN or L2TP connection is encrypted. No protection is 100% secure.

5. Data Retention & Account Deletion

Request deletion through Settings → Delete account or the email below. Recent sign-in is required. Backend, team, tunnel or financial records, or unavailable verification, stop automatic deletion and require support review. Automatic deletion has a defined Firebase scope, not guaranteed erasure across every service or backup. Device/serial anti-abuse records are not automatically erased. Financial/shared records, backups and external processors require separate review; we explain applicable scope and retention when reviewing your request. Account deletion does not automatically cancel a Google Play subscription; cancel it in Google Play.

6. Children

The App is intended for business owners and internet service providers, not for children under 13, and we do not knowingly collect their data.

7. Changes

We may update this policy; changes will be posted on this page with the date above updated.

8. Contact

For privacy questions: bidroali@gmail.com