1. Who we are
Fantasy Card Creator is operated by Appetent Ltd, a New Zealand company. Questions about privacy, access, deletion, or parental requests can be sent to admin@fantasycardcreator.app. GST number: 133-796-517.
2. A short explanation for parents
Fantasy Card Creator is designed for children and families. A parent or guardian should create and control the account, supervise use, and decide whether a child may create and share cards. Cards are private by default. We do not use children's information for targeted advertising, and we do not ask children for their name, address, phone number, or photograph to use the core card creator.
Parents can contact admin@fantasycardcreator.app to ask what information is held, request deletion, withdraw consent, report a safety concern, or ask a question about the service.
3. What the service does
Fantasy Card Creator is a child-directed web app for creating AI-generated fantasy creature trading cards. Users can choose or describe creatures, generate card art and text, save cards to a private gallery, and download, print, or share cards.
4. Information we handle
Depending on how the service is used, we may handle an email address, authentication and account identifiers, optional Google account identity, prompts and card choices, generated creature images and card text, gallery and draft metadata, feedback and support messages, and payment status and transaction details. Stripe handles payment-card numbers; Appetent Ltd does not store full card numbers.
We may also receive technical information needed for security and operation, such as IP address, browser and device characteristics, request information, and service logs. The current customer-facing experience does not provide a photo-upload feature. Do not enter sensitive personal information or another person's private information in a prompt unless you have a lawful reason and permission to do so.
An email address is needed for magic-link sign-in. Google account information is optional and is used only when Google sign-in is chosen. Prompts and card choices are needed to generate a card, while feedback and support details are optional. Payment-card details are entered into Stripe Checkout rather than stored by Appetent Ltd. If required information is not provided, the related feature may not work.
Feedback is only available to signed-in accounts that have completed parent verification. When you send feedback, we store the type of feedback you chose (an idea, a bug or problem, a concern or safety issue, or something else), your message (up to 2,000 characters), the page you sent it from, which version of the service you were using, the date and time, and the internal account id it came from. We do not copy your email address into the feedback record. Our team may add a status (for example New, Planned, or In Progress) and private notes while we look at it. Closed feedback is deleted automatically 12 months after it's closed. Please do not put names, contact details, photos, locations, or other private information in feedback, about yourself or anyone else.
We may receive limited information from third parties: Google provides account identity when Google sign-in is used, Stripe provides payment status and transaction details, and our infrastructure and AI providers process information sent to them to provide their services. We do not buy personal information from data brokers.
5. How we use information
We use information to provide authentication, generate and save cards, process credit purchases, send magic-link and service emails, provide support, respond to access or deletion requests, maintain security, prevent fraud and abuse, operate the service, and comply with legal obligations.
We use feedback to understand what families like, fix bugs, look into safety concerns, and decide what to improve next. Feedback is private. It is read only by the Appetent Ltd team running the service. We do not show it publicly or on a public roadmap, and we do not use it for advertising.
Weekly team summary. Each week our team gets a private summary of how the service is being used, mostly totals such as visits, sign-ups, cards and purchases. New accounts show only a partly hidden email (for example j***@gmail.com), sign-up date, cards made, credits bought and an internal account id. It never includes prompts, pictures, card text, feedback, parent verification or payment-card details.
Product analytics (PostHog). For a child, PostHog does not load until a parent or guardian completes Kids Web Services Parent Verification. Before then, we count only three anonymous steps (Welcome page opened, first four card-builder steps, market card QR opened), never linked to an account. After verification, we record feature use, steps of the sign-up and parent-consent process, and whether a family first came from a market event, linked to an internal account id. We never send email addresses, prompts, pictures or card text. Autocapture, session replay and surveys are off, and PostHog discards IP addresses. A cookie banner is not parental consent. Withdrawing consent or deleting the account stops analytics.
Neither is used for advertising or to build a profile of any child.
6. Legal bases and children
Depending on the jurisdiction and purpose, we may rely on consent, providing the service requested, steps taken before a contract, legitimate interests such as security and service reliability, and legal obligations. We will not use legitimate interests to override rights that require consent under applicable law.
This is a child-directed service. A parent or guardian must agree for a child and control the account. Fantasy Card Creator collects the prompts and pictures. Those prompts and pictures are sent to the AI vendors to make the card.
A parent or guardian must confirm consent through our parent-verification email flow before card creation. Email or Google sign-in authenticates an account but does not by itself prove parental consent. Kids Web Services provides the verification service we use, but using it does not by itself determine whether Fantasy Card Creator complies with COPPA or other privacy laws. Email or Google sign-in alone does not prove parental consent.
If we learn that personal information from a child was collected or used without the consent required by applicable law, we will stop the relevant processing, investigate the situation, and take reasonable steps to notify the parent or delete the information unless a legal or security reason requires limited retention.
7. Providers we use
We share information with service providers only for the purposes described in this policy. These currently include OpenAI for card generation and, as a backup, creature images; Apiframe for creature images; Apify as an automatic backup for creature images if Apiframe is unavailable; Vercel for application hosting and Blob storage; Supabase for authentication and application records; Google OAuth for optional sign-in; Stripe for Checkout and payment status; Resend for transactional email and private service emails to our team; ImprovMX, which forwards email sent to admin@fantasycardcreator.app; Google (Gmail), which hosts our team mailbox where support emails and our private service emails are kept; and PostHog for product analytics only after the consent described above. Feedback is stored in our Supabase database with other application records and is not shared with our AI providers.
Cards and galleries are private by default. A user may create a shareable card link or download or print a card. Anyone who receives a shareable link may be able to view that card without signing in.
When a market card is saved to a family account, the operator may keep the original copy for the market record; that original remains private.
Providers may process information under their own terms and privacy notices. We do not opt in to using children's prompts or images to train our own models. We use provider settings and contractual terms that prohibit training on customer content where available; we do not claim that every provider has identical terms.
8. International transfers
Our providers may process information outside New Zealand, including in the United States and Singapore. Apify may involve the Czech Republic when it is used as a backup. Google, Stripe, and other providers may also use global infrastructure. We rely on applicable provider data-processing terms and transfer safeguards where available, and will provide further details on request.
9. Cookies and analytics
The service currently uses strictly necessary session and authentication cookies. These support sign-in, security, and core functionality. Product analytics is described above. A same-tab note may remember that a page was already counted, so one visit is not counted twice. That note is not an analytics id and is not sent. We may keep the word market in this browser so a later sign-in can record that the family first came from a market event. That word is not an account id and it is not linked to those anonymous counts.
10. Retention
Account and authentication data is kept while an account is active. When a user requests account deletion, we use the account-deletion process to remove account data within 30 days, except information that must be retained by law. Prompts and card choices are processed to generate cards. Some card choices, generated cards, creature images, gallery data, and temporary drafts may be retained while the account exists and are removed through that process. The exact final generation prompt is not saved in completed card metadata, and temporary drafts may expire sooner. We do not guarantee that every prompt can be retrieved after generation, deletion, or expiry. Automatic deletion solely because of inactivity is not currently a live product control.
Open feedback is kept while we are still looking at it. Closed feedback is deleted automatically 12 months after it's closed. If an account is deleted, its feedback is deleted with it.
Our private weekly usage summaries are kept in our team mailbox for about 3 months and then deleted. Our email provider keeps its copy of sent emails for about 30 days.
Stripe transaction records such as transaction IDs, amounts, pack details, and timestamps may be retained for seven years for New Zealand GST, tax, accounting, and other legal obligations. Support emails are kept as needed to handle the request and then follow normal mailbox practices. Confirmed mailing-list emails remain until unsubscribe or deletion; unconfirmed records expire after about 30 days.
11. Safety and user reports
AI providers may reject prompts or images under their safety systems. We do not proactively review every private card, but we may review or restrict content that is reported, detected by our systems, or brought to our attention. Contact admin@fantasycardcreator.app to report unlawful, unsafe, abusive, infringing, or otherwise inappropriate content or behaviour. We may preserve limited information needed to investigate a report or protect users and the service.
12. Security
We use reasonable organisational and technical safeguards appropriate to the service. No internet transmission or storage system can be guaranteed completely secure. If we become aware of a relevant security incident, we will handle notifications as required by law.
13. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, withdraw consent, request portability, or complain to a privacy regulator. Parents may request access to or deletion of a child's information and may withdraw consent by emailing admin@fantasycardcreator.app.
These rights include feedback. You or your parent or guardian can email admin@fantasycardcreator.app to ask for a copy of feedback sent from your account, or to have it deleted. Deleting your account also deletes its feedback.
We aim to respond within 30 days, while observing any shorter or otherwise applicable legal deadline. We may need to verify the requester and may retain limited information where the law permits or requires it.
14. United States and other regional rights
We intend this policy to address relevant privacy requirements in New Zealand, Australia, the UK, the United States, and other places where the service may be accessed. Additional rights or consent requirements may apply based on location, age, and the applicable law, including COPPA for eligible US child users and children's privacy rules in other regions. We do not sell personal information or use it for targeted advertising.
15. Do-not-track and global signals
The service does not currently treat browser Do Not Track or Global Privacy Control signals as a separate consent mechanism. We will review this position if non-essential tracking is enabled or applicable law requires a different response.
16. Updates
We may update this Privacy Policy when the service, providers, or law changes. We will publish the updated version and its effective date. This policy describes parent verification as the path that works today.
17. Contact and requests
Contact admin@fantasycardcreator.app for privacy questions, parent access or deletion requests, consent withdrawal, support, or complaints. This policy does not publish a residential address.