Etukortit
Privacy policy
Updated: 13 October 2026
In short
Etukortit works without an account. Your card names, numbers, and barcodes are stored on your device. Cloud backups, iCloud sync, and Wallet exports you choose are described below. We do not sell data, show ads, or use the advertising identifier or your location.
This policy covers the Etukortit app and the etukortit.com website. The controller is Northmade Oy (business ID 3646088-5), Finland. Privacy questions and requests: tuki@etukortit.com.
What we process and on what basis
The card name, barcode, type, group, appearance, and usage data are stored on your device. Barcodes are recognised on your device. Barcode source images are not retained. When you add an image card, its images and crop settings are saved with the card. The screenshot-sharing extension only extracts card details and does not retain the source image. We do not store card contents on our servers.
In the iOS version, if you enable iCloud sync, cards are also stored in the private iCloud storage of your Apple Account. Apple processes the card data stored in iCloud on our behalf as the cloud service provider. Northmade Oy cannot access the contents of a user's private iCloud database. When you delete a card in the app, it is also deleted from iCloud. If you turn off sync, the cards remain on your iPhone, and deletion of the iCloud copies is completed when the app is reopened and an iCloud connection is available.
On Android, system backup may save card data and app settings to a backup service, such as your Google Account backup, or transfer them to a new device according to your device settings. Card images are excluded from cloud backups. You manage backups in your device settings; this is not cloud sync provided by the app.
We collect limited usage data to improve the app. The data is linked to a random identifier stored on your device; it is not an advertising identifier and is not used to create a profile. Card contents, location, and the advertising identifier are not collected for analytics, and the data is processed by an analytics service whose servers are in the EU. You can disable analytics at any time in the app's Privacy screen.
When you export to Apple Wallet, the card is built on your device. Only the technical checksum and verification data required by Apple to authorise the export are sent to our service — not the card name, number, barcode, or the finished Wallet card, and the card's contents cannot be inferred from the data sent. We retain these identifiers to prevent unauthorised use of the service.
When you choose Google Wallet export on Android and confirm the addition, the card name, number, barcode, and appearance data are sent to Google to save the card in Google Wallet under Northmade Oy’s issuer account. The data does not pass through our own servers. Google processes it under its own terms and privacy policy. Export applies only to cards you individually select.
We answer your email using the details you provide in the message. Purchases are handled by Apple App Store in the iOS version and Google Play in the Android version. The app processes purchase information provided by the store to check and restore access. We receive the transaction result and settlement data, not your payment card details.
Etukortit.com is a static website: it sets no cookies, tracks no visitors, and loads no external scripts or fonts. The hosting provider records ordinary server logs, such as the IP address, timestamp, and requested address, to deliver the website and prevent abuse.
The legal bases for processing are performance of a contract (cards, Wallet export, and purchase), our legitimate interest (analytics, protecting the service, and server logs), and a legal obligation (accounting). Providing data is neither a statutory nor a contractual requirement: adding, storing, and displaying cards works without an account and without a network connection. We do not collect special categories of personal data.
Retention periods
Cards on your device remain until you delete the card or the app. Deleting the app does not delete copies stored in iCloud. The iCloud copies remain until you delete the card in the app or turn off iCloud sync and deletion has been completed. Retention and deletion of Android backups are governed by the system backup service. Changes or deletions in Etukortit are not reflected in Google Wallet; you manage removal of the Wallet copy in Google Wallet, and Google determines retention of data stored in its service under its own policies.
We retain other personal data only for as long as necessary for the purpose of processing. Product analytics usage data is retained for as long as it is needed to evaluate use of the app and the effects of development work. Technical identifiers and log data relating to Apple Wallet export are retained for as long as they are needed to protect the service and to detect, investigate, and prevent abuse. Support messages are retained for as long as necessary to handle the matter and any potential legal claims. Server logs are retained for as long as they are needed to deliver the website, maintain security, and investigate abuse. Data is deleted or anonymised when there is no longer a basis for retaining it. Accounting records are retained for the period required by the Finnish Accounting Act.
Recipients and transfers
We do not sell personal data or disclose it for advertising or to data brokers. Data is processed on our behalf by Apple as the iCloud service provider, our analytics service, and our hosting and email service providers. When you add a card to Apple Wallet, the card name, number, barcode, and other Wallet card content are transferred to Apple Wallet, where Apple processes them under its own terms and privacy policy. Apple and Google also process purchase data from their respective app stores in their own roles. Data exported to Google Wallet and Android cloud backups are processed as described above in Google’s service or by the provider of your chosen backup service. We disclose data to an authority only where required by law.
Analytics, the website, and our own services run within the EU. Apple and Google may process data relating to their own services outside the EEA under their own privacy policies. If a service provider acting on our behalf transfers personal data outside the EEA, the transfer is based on a European Commission adequacy decision or appropriate safeguards such as the European Commission's standard contractual clauses.
Security and children
Your card data is protected by your device's own security and passcode, and connections to our services are encrypted. The app is not directed at children under 13.
Your rights
Depending on the processing in question, you have the right to access your data, to have it corrected and erased, to restrict and object to processing, and to have the data you provided transferred between systems. We make no automated decisions about you and do not profile you.
You delete cards yourself in the app. For other requests, contact tuki@etukortit.com; we respond within one month and may extend the time limit as permitted by law if the request is complex. Because there are no user accounts and usage data is not tied to a name, we may be unable to connect an event to you, and we do not collect additional data solely to identify people. You may lodge a complaint with the supervisory authority: Office of the Data Protection Ombudsman, P.O. Box 800, FI-00531 Helsinki, Finland, tietosuoja.fi.
Changes
We update this policy as the service and the law change. The version in force is always on this page with its update date at the top; we announce a material change a reasonable time before it takes effect.
Publisher
Northmade Oy (business ID 3646088-5), Finland