Privacy Policy

Last updated November 9, 2026

This page says what WildCard collects, why, who it is shared with, and how to delete it.

What we collect

• Account. Your email address and, if you use one, a password (stored only as a one-way hash).
• Sign in with Apple or Google. The account identifier and email address Apple or Google share with us, and your name if you choose to share it. With Apple's Hide My Email we only ever see the relay address.
• About you. Your legal name, date of birth and home address, which you enter during setup. We use them to confirm you are 18 or older, to check that WildCard is available where you live, and to ship bottles to you.
• Activity. Deposits, pack purchases, the bottles you pull, sales and balance history.
• Device and connection. Your IP address, the approximate region it maps to, and your device's app version string, recorded when you sign in. We use these for security and to apply state availability rules.

We do not collect contacts, photos, precise location or advertising identifiers. The app has no ads and no third-party analytics or tracking.

How we use it

• To run your account, balance, vault and orders.
• To email you sign-in codes.
• To meet legal duties: age limits, state availability, fraud prevention and financial record keeping.

We do not sell your personal information or share it for advertising.

Who we share it with

Only companies that help us run the service, and only what each needs:

• Apple and Google, when you choose to sign in with them.
• Railway, which hosts our servers and database.
• Cloudflare, which routes traffic to our servers.
• Resend, which delivers sign-in emails.

We may also disclose information when the law requires it.

Deleting your account

You can delete your account at any time in the app: Profile, then Delete account. This is permanent and takes effect immediately:

• Your email, password, name, date of birth, home address, sign-in links and session records are erased.
• If you signed in with Apple, we revoke WildCard's access to your Apple ID. If you signed in with Google, the app disconnects from your Google account.
• Any remaining balance and any bottles still in your vault are given up. The app shows you exactly what before you confirm.
• Records of past transactions are kept, with nothing in them that identifies you, because financial records must be retained.

If you cannot use the app, email [email protected] from your account's address and we will delete it for you.

Keeping it safe

Data is encrypted in transit. Passwords are hashed, session tokens are stored only as hashes, and sign-in tokens from Apple are encrypted at rest.

Your choices

You can see and change your address in the app, and you can ask us for a copy of your data or to correct it by emailing us. Depending on where you live you may have further rights under state privacy law; we honor those requests the same way.

Children

WildCard is for adults 18 and over. We do not knowingly collect information from anyone younger, and we delete it if we find it.

Changes and contact

If this policy changes in a way that matters we will tell you in the app before it takes effect. Questions: [email protected].