Etukortit
Privacy policy
Updated: 26 August 2026 (draft)
In short
Etukortit works without an account. Your card names, numbers, and barcodes stay on your iPhone and, if you choose, in the private iCloud storage of your own Apple Account; we never see them. We do not sell data, show ads, or use the advertising identifier or your location.
This policy covers the Etukortit app and the etukortit.com website.
Data controller
The controller is Northmade Oy (business ID 3646088-5), Finland. Privacy questions and requests: tuki@etukortit.com.
What we process, why, and on what basis
The card name, barcode, type, group, appearance, and usage data are stored on your iPhone. The barcode is recognised on your device and the original image is discarded as soon as detection completes. We do not store card contents on our servers. The basis is performance of a contract.
If you enable iCloud sync, cards are also stored in the private iCloud storage of your Apple Account, which we cannot access; Apple is its own controller there. You can turn sync off in the settings, which deletes the iCloud copies.
We collect limited usage data, such as how many cards you have and which features are used, to see what works and where the app fails. It is linked to a random identifier stored on your device; that identifier is not an advertising identifier and no profile is built from it. Card contents, location, and the advertising identifier are not collected, and the data is processed in an analytics service whose servers are in the EU. The basis is our legitimate interest in improving the app; you may object to this processing at any time.
When you export to Apple Wallet, the card is built on your device. Only technical checksum and verification data authorising the export are sent to our service — not the card name, number, barcode, or the finished Wallet card, and what is sent cannot be turned back into the card's contents. We retain those technical identifiers to prevent unauthorised use of our service; the basis is performance of a contract and our legitimate interest in protecting it.
We answer your email using the details you provide in it. The app purchase is sold by Apple through the App Store: we receive the transaction result and settlement data, not your payment card details. We keep accounting records under our legal obligation.
Etukortit.com is a static site: it sets no cookies, tracks no visitors, and loads no external scripts or fonts. The host records ordinary server logs, such as the IP address, timestamp, and requested path, to deliver the site and prevent abuse under our legitimate interest.
Providing data to us is neither a statutory nor a contractual requirement: adding, storing, and displaying cards works without an account and without a network connection. We do not collect special categories of personal data.
Retention periods
Cards on your device and in your iCloud remain until you delete the card or the app. Usage data is kept for at most 12 months, technical identifiers for Apple Wallet export for at most 12 months after last use and their logs for 90 days, support messages for at most 24 months, and server logs for at most 30 days. Accounting records are kept for the period required by the Finnish Accounting Act.
Recipients and transfers
We do not sell personal data and do not disclose it for advertising or to data brokers. Data is processed on our behalf by Apple (iCloud, Apple Wallet, and the App Store), our analytics service, and our hosting and email providers. We require from them at least the level of protection described in this policy and have agreed that they process the data only on our instructions and not for their own purposes. We will name the current providers on request. We disclose data to an authority only where the law requires it.
Analytics, the website, and our own services run within the EU. Apple, as its own controller, may process data outside the EEA. If one of our providers transfers data outside the EEA, the transfer relies on the European Commission's standard contractual clauses or another equivalent safeguard.
Security and children
Your card data is protected by your device's own protection and passcode, and connections to our services are encrypted. The strongest protection is still the data never collected: your card contents never pass through our services. The app is not directed at children under 13.
Your rights
You have the right to access your data, to have it corrected and erased, to restrict and object to processing, and to have the data you provided ported between systems. We make no automated decisions about you and do not profile you.
You delete cards yourself in the app. For other requests, contact tuki@etukortit.com; we respond within one month. Because there are no user accounts and usage data is not tied to a name, we may be unable to connect an event to you, and we do not collect extra data solely to identify people. You may lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, P.O. Box 800, FI-00531 Helsinki, Finland, tietosuoja.fi.
Changes
We update this policy as the service and the law change. The version in force is always on this page with its update date at the top; we announce a material change a reasonable time before it takes effect.
Publisher
Northmade Oy (business ID 3646088-5), Finland