WILDCARDPrivacy Policy
Last updated: October 23, 2026
This policy explains what Tracy Meng, an individual in New York, USA, who develops Wildcard (外卡) ("we") collects when you use the Wildcard app (the "App"), how we use it, who we share it with, and the choices you have. The Simplified Chinese, Traditional Chinese and English versions say the same thing; if they differ, the English version controls.
In one line: your check-ins are seen only by your squad; we don't sell your data, show ads or track you across apps; and you can delete your account and everything in it from inside the App at any time.
1. What we collect
Account: the Apple user identifier from Sign in with Apple and, if you allow it, your name and email address (the email can be Apple's private relay address). We never receive your Apple password.
Profile: nickname, the character and outfit you pick, your catchphrase, the sports you do, your weekly plan, and your phone's time zone (to work out "today" and "this week").
Check-ins: the kind (trained, healthy meal, honest cheat meal, daily leave note), sport and minutes, text, up to 3 photos, and date and time.
Squads and interactions: squads you create or join, invite codes, your emoji reactions to teammates' check-ins and your replies to leave notes.
AI: when you choose to have AI draft a leave note, the reason you type and the drafts generated. Every Sunday, to write the squad's awards and weekly recap, the check-in captions and leave-note text (never photos) of squad members who agreed to AI use for that week.
Push: your device's push token if you turn on notifications, and your notification switches.
Technical logs: IP address, time, request outcome and errors, recorded by our servers for security and troubleshooting.
We do not collect weight, calories or other body metrics, and we do not read your contacts, location or Health app data. Photos are chosen with the system photo picker, so we only receive the photos you select. We currently use no third-party analytics or advertising SDKs.
2. How we use it
- To run the App: sign-in, saving check-ins, showing your squad's feed, weekly progress and recaps, and sending notifications you turned on.
- To draft AI leave notes when you ask for one, and to write your squad's weekly awards and recap every Sunday.
- For safety: preventing abuse, handling reports, fixing problems.
- To contact you about the service only (for example, changes to these terms). No marketing email.
We do not sell your personal information, share it for cross-context behavioral advertising, build advertising profiles, or use your content to train AI models. We will ask for your consent before using it for any purpose not described here.
3. Who can see your content
Members of your squad see your nickname, character, the check-ins and photos you post to that squad, and your weekly progress. A squad has at most 8 members.
People outside your squad cannot. The App has no public profiles. If you save or share a weekly poster to another platform yourself, that platform's rules apply to it.
4. Service providers
We share only what each function needs with the providers below, which process data only on our behalf.
| Provider | Purpose | Data involved |
|---|---|---|
| Apple | Sign-in, push notifications | Apple user ID, name and email, push token and notification content |
| Supabase | Database, sign-in sessions, photo storage | All account, profile, check-in and photo data above |
| Google Cloud | Runs our servers | Requests passing through our servers, technical logs |
| OpenAI (currently used), Anthropic (alternative) | Drafting AI leave notes; weekly awards and recap | Leave notes: the reason you type. Weekly awards: captions, leave-note text and nicknames of squad members who agreed to AI use for the week. Never photos or email |
AI providers receive text only, to generate a reply. Before we move to another AI provider or add a purpose, we ask for your consent again. Apart from these providers, we disclose information only when the law requires it, to protect users or the public, or in a merger or acquisition where this policy keeps applying.
5. Where data is stored
Data is stored in the United States. If you are in Canada or elsewhere, your information is transferred to and processed in the United States, where courts, law enforcement and national security authorities may be able to access it under US law.
6. Retention and deletion
While your account exists we keep your content; you can delete individual check-ins at any time.
Deleting your account: start it in the App under Me → Delete account (注销账号) and confirm again with Apple. It takes effect at once: we delete your account, profile, check-ins, photos, squad memberships, reactions and AI consent record, and revoke the link to your Apple ID. Teammates stop seeing anything of yours. Routine database backups, if any, are overwritten within 30 days at most. If the law requires us to keep any record, we keep only that and tell you what was kept.
Technical logs are kept for at most 30 days.
A squad you created stays if it has other members, but your content in it is deleted.
7. Your rights and choices
Access, correction and deletion: most of it can be done in the App; you can also email support@wildcardsquad.com for a copy of your data. We reply within 30 days (45 days for California residents).
Withdrawing consent: turn off notifications or photo access in system Settings, skip AI leave notes (write your own or roll the dice instead), or delete your account. Consent to AI processing (the weekly awards and AI leave notes) covers your whole account and cannot be withdrawn on its own; if you no longer agree, delete your account and we stop sending and delete your data as described in section 6.
California residents have the right to know the categories of personal information we collect, their sources and purposes; to delete and correct it; and not to be discriminated against for exercising these rights. We do not sell or share personal information.
Canadian residents may access and correct their information, withdraw consent, and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
8. Consumer health data
In some states (for example Washington and Nevada), workout and meal check-ins may count as "consumer health data". We collect and use it only for the features above, show it only in the squads you choose, share it only with the providers in section 4, and never sell it. You can access and delete it and withdraw your consent.
9. Children
The App is not directed to children under 13, and they may not sign up. If we learn an account belongs to a child under 13 we delete it promptly. Parents can reach us at support@wildcardsquad.com.
10. Security
All traffic is encrypted in transit. The App cannot reach the database directly; only our servers can, and they check permissions on every request. Photos sit in private storage and are reached through short-lived upload and download links. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and regulators as the law requires.
11. Changes
We will announce material changes in the App at least 14 days before they take effect, and ask for consent again for any new purpose.