1. Who we are
Fantasy Card Creator is operated by Appetent Ltd, a New Zealand company. Questions about privacy, access, deletion, or parental requests can be sent to admin@fantasycardcreator.app. GST number: 133-796-517.
2. A short explanation for parents
Fantasy Card Creator is designed for children and families. A parent or guardian should create and control the account, supervise use, and decide whether a child may create and share cards. Cards are private by default. We do not use children's information for targeted advertising, and we do not ask children for their name, address, phone number, or photograph to use the core card creator.
Parents can contact admin@fantasycardcreator.app to ask what information is held, request deletion, withdraw consent, report a safety concern, or ask a question about the service.
3. What the service does
Fantasy Card Creator is a child-directed web app for creating AI-generated fantasy creature trading cards. Users can choose or describe creatures, generate card art and text, save cards to a private gallery, and download, print, or share cards.
4. Information we handle
Depending on how the service is used, we may handle an email address, authentication and account identifiers, optional Google account identity, prompts and card choices, generated creature images and card text, gallery and draft metadata, feedback and support messages, and payment status and transaction details. Stripe handles payment-card numbers; Appetent Ltd does not store full card numbers.
We may also receive technical information needed for security and operation, such as IP address, browser and device characteristics, request information, and service logs. The current customer-facing experience does not provide a photo-upload feature. Do not enter sensitive personal information or another person's private information in a prompt unless you have a lawful reason and permission to do so.
An email address is needed for magic-link sign-in. Google account information is optional and is used only when Google sign-in is chosen. Prompts and card choices are needed to generate a card, while feedback and support details are optional. Payment-card details are entered into Stripe Checkout rather than stored by Appetent Ltd. If required information is not provided, the related feature may not work.
We may receive limited information from third parties: Google provides account identity when Google sign-in is used, Stripe provides payment status and transaction details, and our infrastructure and AI providers process information sent to them to provide their services. We do not buy personal information from data brokers.
5. How we use information
We use information to provide authentication, generate and save cards, process credit purchases, send magic-link and service emails, provide support, respond to access or deletion requests, maintain security, prevent fraud and abuse, operate the service, and comply with legal obligations.
PostHog product analytics is used for feature-usage events. For a child, PostHog does not load and no other events are sent until a parent or guardian completes Kids Web Services Parent Verification. Before that verification, we count only two anonymous steps: that the Welcome page was opened and which of the first four card-builder steps (body shape, personality, type, colour) was shown. Those counts use a random id that lasts only for that page visit, are never linked to an account, and include no names, emails, card content, or web addresses. Accepting a cookie banner is not parental consent and does not start that analytics. We send feature-usage events, an environment label, and an internal account id. Feature-usage events may include a coarse wait-time bucket and a numeric free-card count. We do not send email addresses, parent email addresses, card prompts, card pictures, or card text. Autocapture, session replay, and surveys stay off. PostHog is set to discard the client IP address. Withdrawing consent or deleting the account stops analytics for that browser.
When analytics is allowed, consent-journey events record that the consent gate was shown, which sign-in button was used, that the wizard returned to step 5 after that sign-in, that parent verification started, that consent was granted, that the waiting-for-parent screen was shown, and that resend was tapped. They do not include an email address or the card being made.
6. Legal bases and children
Depending on the jurisdiction and purpose, we may rely on consent, providing the service requested, steps taken before a contract, legitimate interests such as security and service reliability, and legal obligations. We will not use legitimate interests to override rights that require consent under applicable law.
This is a child-directed service. A parent or guardian must agree for a child and control the account. Fantasy Card Creator collects the prompts and pictures. Those prompts and pictures are sent to the AI vendors to make the card.
A parent or guardian must confirm consent through our parent-verification email flow before card creation. Email or Google sign-in authenticates an account but does not by itself prove parental consent. Kids Web Services provides the verification service we use, but using it does not by itself determine whether Fantasy Card Creator complies with COPPA or other privacy laws. Email or Google sign-in alone does not prove parental consent.
If we learn that personal information from a child was collected or used without the consent required by applicable law, we will stop the relevant processing, investigate the situation, and take reasonable steps to notify the parent or delete the information unless a legal or security reason requires limited retention.
7. Providers we use
We share information with service providers only for the purposes described in this policy. These currently include OpenAI for card generation and, as a backup, creature images; Apiframe for creature images; Apify as an automatic backup for creature images if Apiframe is unavailable; Vercel for application hosting and Blob storage; Supabase for authentication and application records; Google OAuth for optional sign-in; Stripe for Checkout and payment status; Resend for transactional email; and PostHog for product analytics only after the consent described above.
Cards and galleries are private by default. A user may create a shareable card link or download or print a card. Anyone who receives a shareable link may be able to view that card without signing in.
Providers may process information under their own terms and privacy notices. We do not opt in to using children's prompts or images to train our own models. We use provider settings and contractual terms that prohibit training on customer content where available; we do not claim that every provider has identical terms.
8. International transfers
Our providers may process information outside New Zealand, including in the United States and Singapore. Apify may involve the Czech Republic when it is used as a backup. Google, Stripe, and other providers may also use global infrastructure. We rely on applicable provider data-processing terms and transfer safeguards where available, and will provide further details on request.
9. Cookies and analytics
The service currently uses strictly necessary session and authentication cookies. These support sign-in, security, and core functionality. Product analytics does not treat a cookie banner as parental consent. For a child, PostHog does not load until Kids Web Services Parent Verification is complete; before that only the anonymous step counts described above are sent, with no cookie or stored id.
10. Retention
Account and authentication data is kept while an account is active. When a user requests account deletion, we use the account-deletion process to remove account data within 30 days, except information that must be retained by law. Prompts and card choices are processed to generate cards. Some card choices, generated cards, creature images, gallery data, and temporary drafts may be retained while the account exists and are removed through that process. The exact final generation prompt is not saved in completed card metadata, and temporary drafts may expire sooner. We do not guarantee that every prompt can be retrieved after generation, deletion, or expiry. Automatic deletion solely because of inactivity is not currently a live product control.
Stripe transaction records such as transaction IDs, amounts, pack details, and timestamps may be retained for seven years for New Zealand GST, tax, accounting, and other legal obligations. Support emails are kept as needed to handle the request and then follow normal mailbox practices. Confirmed mailing-list emails remain until unsubscribe or deletion; unconfirmed records expire after about 30 days.
11. Safety and user reports
AI providers may reject prompts or images under their safety systems. We do not proactively review every private card, but we may review or restrict content that is reported, detected by our systems, or brought to our attention. Contact admin@fantasycardcreator.app to report unlawful, unsafe, abusive, infringing, or otherwise inappropriate content or behaviour. We may preserve limited information needed to investigate a report or protect users and the service.
12. Security
We use reasonable organisational and technical safeguards appropriate to the service. No internet transmission or storage system can be guaranteed completely secure. If we become aware of a relevant security incident, we will handle notifications as required by law.
13. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, withdraw consent, request portability, or complain to a privacy regulator. Parents may request access to or deletion of a child's information and may withdraw consent by emailing admin@fantasycardcreator.app.
We aim to respond within 30 days, while observing any shorter or otherwise applicable legal deadline. We may need to verify the requester and may retain limited information where the law permits or requires it.
14. United States and other regional rights
We intend this policy to address relevant privacy requirements in New Zealand, Australia, the UK, the United States, and other places where the service may be accessed. Additional rights or consent requirements may apply based on location, age, and the applicable law, including COPPA for eligible US child users and children's privacy rules in other regions. We do not sell personal information or use it for targeted advertising.
15. Do-not-track and global signals
The service does not currently treat browser Do Not Track or Global Privacy Control signals as a separate consent mechanism. We will review this position if non-essential tracking is enabled or applicable law requires a different response.
16. Updates
We may update this Privacy Policy when the service, providers, or law changes. We will publish the updated version and its effective date. This policy describes parent verification as the path that works today.
17. Contact and requests
Contact admin@fantasycardcreator.app for privacy questions, parent access or deletion requests, consent withdrawal, support, or complaints. This policy does not publish a residential address.