CardflareSecurity and data
Specific claims only. Each one below is something Cardflare either does or does not do, not a promise about how safe anything is.
Card numbers
When you add a card through the plastic form, the card number and CVV are validated on your device and discarded straight away. What Cardflare keeps is the last four digits, the expiry, an optional name on the card, and which catalog card it matches.
Nothing else about the card is stored, and the full number is never sent anywhere after that check.
Payments
Cardflare never moves money. It does not intercept, tokenize or route a payment, and it is not a bank, a lender or a payment processor. It tells you which card to use; you tap the card yourself. The only money Cardflare charges is the optional subscription, billed by Google Play.
Bank connection
Connecting a bank is optional and only available on the paid tier. It runs throughPlaid, which handles the login with your bank directly — Cardflare never receives your banking credentials.
Cardflare requests only Plaid's Transactions product. Its server calls exactly two Plaid endpoints, /accounts/get and/transactions/sync. It requests no payment product, no transfer product and no account-number product, so the connection can read accounts and transactions and cannot be used to move money.
Plaid access tokens are held on Cardflare's server and are never sent to the app.
Disconnecting a bank from inside the app is not available yet. To have a connection removed, email support.
Location
Location is used to work out which place you are at and which spend category that is. You can deny the permission and keep using Cardflare with manual categories and saved pins; automatic store detection is the part that needs it. Saved pins and the last known coordinates are kept in your wallet data. Location is not shared for advertising.
Selling and advertising
- Your data is not sold to anyone
- Nothing is used to build advertising profiles
- The app ships with no analytics and no advertising SDK
- This website has no analytics, no cookies and no third-party trackers
Where data goes
| Service | What it receives | When |
|---|---|---|
| Plaid | Bank accounts and transactions | Only if you connect a bank (paid tier) |
| Google Sign-In | Email address, display name, Google account ID | Only if you sign in to back up your wallet |
| Google Places | Location, for a nearby-place lookup | Only with automatic store detection (paid tier) |
| Geoapify | Location, for map points of interest | When the map is used |
| Google Play billing | Subscription status | Only if you subscribe |
| Cardflare's own server | Your wallet snapshot and account ID; Plaid tokens | Cloud backup, and the bank connection |
Full detail, including retention, is in the privacy policy.
What we do not claim
Network requests between the app and Cardflare's server use TLS. Beyond that, we are not going to tell you the app is "bank-level secure": one thing we would rather you hear from us is that the session token the app holds is kept in ordinary app preferences, not in the device's secure storage. Tightening that is on the list.
No method of transmission or storage is completely secure, and Cardflare does not guarantee otherwise.
Want your server-side data removed? See deleting your account.