Privacy policy
This policy explains what happens to information when you browse Card Tomorrow or contact us.
Who is responsible
Card Tomorrow is operated by Yikusiel Oestreicher. Use the Contact page for privacy questions or requests about information you have sent us.
Browsing the website
You can read our pages without creating an account. We do not collect credit-card applications, credit scores, income information or answers to personal financial questionnaires. The site has no advertising pixel.
Vercel hosts the website. Delivering pages and protecting the service can involve your IP address, browser and device information, requested pages, request times and security or error logs. Vercel also processes service-generated information under its own privacy notice. This technical processing can occur even if you do not send a contact message.
The question guide and page narration
The question guide is a searchable library of reviewed explanations. Search terms stay in your browser; they are not sent to a chat provider or saved by us. Do not enter names, contact details, account numbers or other sensitive information. Reloading the page clears the current search and selected explanation.
Reading aloud starts only when you choose it. When a saved recording matches the current reading text, the website’s hosting service delivers that computer-generated audio. Otherwise, you can use an available browser or device voice. Voice labels distinguish a service on your device from an online service; an online voice may send the public reading text to its provider. Voice availability and processing depend on your browser and operating system. We do not record your voice. The reading text excludes calculator inputs and results, contact fields and question searches.
Website measurement
We use Vercel Web Analytics to understand which educational pages visitors use. It processes pageview counts, referring websites, device and browser information, and approximate location. Network requests involve an IP address. Vercel describes a request-derived visitor hash with a session discarded after 24 hours, rather than a permanent cross-site identifier. Its reports provide aggregate statistics; it does not use third-party analytics cookies.
Our integration sends only known public page paths, removing URL queries and fragments. Contact, privacy, terms, review and unknown pages are excluded. We count a small set of actions, once per page visit: using a calculator, opening the question guide, selecting a topic, viewing a card category, following an offer link or starting page audio. These events contain fixed action names and the public page path, with no custom properties. We do not send calculator inputs or results, questions, form fields, email addresses or offer destinations. Measurement is suppressed in embedded previews and when the browser exposes Do Not Track or Global Privacy Control as enabled. We also skip measurement when a referring URL contains a query, fragment or unrecognized page path. These filters mean analytics will not count every visit. They do not stop hosting and security processing described above.
When you contact us
The form asks for your email address, a topic and a message; your name is optional. Your browser sends these details to the Card Tomorrow server hosted by Vercel. That server validates the submission and sends it through Resend to the site operator’s Gmail inbox. You may instead use the email-app link, which sends a message through your email provider without Resend.
We use the information in your message to respond, check corrections and handle privacy or business inquiries. Our website does not store messages in an application database. A message does not subscribe you to marketing. Please do not send account numbers, Social Security numbers, passwords, card details or other sensitive financial information.
Our form delivery provider
Resend processes the sender address, recipient address, reply address and message content to deliver contact messages. The website sends plain-text messages and does not add contacts to a marketing list. Delivery acceptance does not guarantee that a message appears in an inbox.
To limit misuse, our server also checks submission timing, a hidden spam field and short-lived request counters. The counters use a keyed digest of the requesting IP address rather than storing the raw address. Application code does not log message content or reply addresses; hosting and delivery providers still process service records under their own policies.
Earlier Web3Forms submissions
Messages previously submitted through the hosted form were processed by Web3Forms. Its practices below apply to those submissions and to any future use of an enabled Web3Forms form; they do not apply to the Resend or email-app routes.
Web3Forms uses AWS, Cloudflare and Hetzner to operate its service. Its policy says submitter IP and email addresses may also be sent to CleanTalk or Akismet for spam prevention. It operates from India and uses infrastructure in multiple regions.
How long information stays
The Resend free plan lists 30 days of email data retention. Provider security records, backups and other service data follow its privacy policy. This is separate from the copy delivered to our inbox. Our application’s request counters expire after ten minutes and are removed on a later request or when the server instance stops. They contain no message text.
For messages submitted through Web3Forms, the provider states that it keeps submissions for up to three years, unless a shorter period applies or they are deleted earlier. A shorter retention setting has not been verified for those submissions.
Delivered messages remain in the operator’s Gmail inbox until deleted. No automatic mailbox deletion schedule is configured. Messages may be kept to answer an inquiry, follow up on a correction, resolve a dispute or meet a legal obligation. You can ask us to delete a message through the Contact page.
Hosting and service records follow the providers’ retention practices; we have not configured a separate shorter period for those records. Deleting an inbox copy does not necessarily remove every provider log or backup immediately. Google describes possible delays between deletion and removal from active and backup systems in its privacy policy.
External links and advertising
Commercial links can take you through an affiliate network to an external offer page. These websites handle their own data collection, cookies, applications and privacy policies. Read their notices before sharing information.
We do not send your contact message as part of an offer link. This website does not receive or decide credit-card applications. The advertising disclosure explains how commercial links may support Card Tomorrow.
Cookies and your choices
The website application does not set advertising or audience-analytics cookies. Hosting, security and external services may use their own cookies or similar technologies as described in their notices. You can manage cookies in your browser; blocking some service features may affect how they work.
You can browse without sending a message or ask a privacy question before sharing information. The Website measurement section describes whether analytics is enabled and the browser choices our integration honors. We update this policy when we change how information is used.
Privacy requests and security
Use the Contact page to request access to, correction of or deletion of a message you sent. Include enough information to identify the message, but do not send identification documents or sensitive account details. We may need to confirm that a request relates to your information. Available rights and any exceptions depend on applicable law.
The website uses HTTPS. Your email provider handles delivery when you use the email-app link. No website or email service can promise absolute security. If you believe a message exposed sensitive information, contact us and identify the message without repeating those details.
This website is not directed to children under 13. If you believe a child has sent personal information through it, contact us so we can address the request.
Policy updates
The date at the top identifies the latest substantive policy update. This policy covers Card Tomorrow; linked websites have their own policies.