Privacy Policy

Who we are

Face Value Press is run by David Mitenko, a sole proprietor in Nanaimo, British Columbia, Canada. Mailing address: PO Box 861 Stn A, Nanaimo BC V9R 5N2. We are responsible for the personal information described here. For any privacy question or request, write to support@facevaluepress.com.

What we collect

• Your account: your email address. If you sign in with Google, Google shares your email address and basic profile details (such as your name and picture) with us. They are stored with your account, but we use only your email address.
• Photos you upload: photos of you, of other people (often family) and of pets, the crop you choose, and custom card backs.
• What you make: deck names, card names, the item each person holds, the skin-tone setting, and the card art generated from your photos.
• Sharing: the email addresses you invite to a deck, and whether each invite was sent.
• Orders: the email, shipping name, address and phone number you give at checkout, what you ordered and what you paid. Card details go to Stripe and never reach us.
• Try It (one free card without an account): a temporary anonymous account, and a one-way hash of your internet connection's address (an IPv6 address counts by its network prefix), used only to limit free cards. We never store the address itself.
• Visits from the QR code on a printed deck: the same kind of one-way hash, which deck was opened and when.
• Reports you send about a card, with your optional note.
• Error reports, if turned on: technical details of a crash, with emails, addresses and keys removed before sending.

Cookies and browser storage

We use only what the site needs to work. We have no advertising or analytics cookies.

• Sign-in cookies, which keep you signed in (from our database provider, Supabase).
• fv-locale, which remembers the language you picked.
• fc_link_signin, which lasts two minutes and shows which account an email link signed you into.
• Your light or dark theme, saved in your browser's own storage.

Cloudflare Turnstile, our check that you're a person, runs when you sign in or try a free card. Stripe's checkout page sets its own cookies under Stripe's policy.

How we use it

• To make your card art and show your decks to you and the people you share them with.
• To print and ship your order, and to email you about it.
• To send sign-in links and deck invitations.
• To prevent abuse: limits on free cards, failed draws and sign-ups, and reviewing reported cards.
• To fix errors and keep the site secure.

We don't sell your personal information, we don't use it for advertising, and we don't send marketing email.

Photos, AI and consent

To draw a card, we send the photos for that card, with written instructions, to Google's Gemini API, which returns the art. We also send the finished card back to Gemini to check its quality. Photos are sent with each request; we don't put them in a Google account or a public place. Our Gemini account is on Google's paid tier, under which Google does not use prompts or images to improve its products.

Before a card is made, the person making it confirms they have permission to use the photos and agrees they can be sent to our AI image service. We record this per person: the deck owner's consent on the deck, and each editor's on their own membership. Revoking consent in the card editor stops new art being made from your photos; delete the photos to remove them.

Only upload photos of people who have agreed to it. For a child, you must be their parent or legal guardian, or have that person's agreement.

Who can see your decks

Every deck has an owner. The owner can share it by email with editors, who can change cards and upload photos, or with printers, who can see only the finished cards chosen for the deck, never the photos.

Each deck also has a visibility:

• Private: only the owner and the people it is shared with.
• QR code can view: anyone who scans the Ace of Spades in a printed deck, and anyone they pass the address on to.
• Public: anyone with the link. Once all 12 court cards are made, a public deck can also appear in the Face Value Press gallery and in search results.

People outside a deck see only its finished cards, never the photos they were made from.

To print orders, answer you, review reported cards and prevent abuse, the Face Value Press team can see decks, card art and orders.

Who helps us

These companies process personal information for us, each only for its part of the service:

• Supabase: our database, sign-in and file storage, where your photos and art are kept.
• Google (Gemini API): draws and checks the card art.
• Google sign-in: only if you choose Continue with Google.
• Stripe: payments and the checkout page.
• QPMN: prints and ships your deck; it receives the card art and your shipping details.
• Resend: sends our emails.
• Cloudflare Turnstile: tells people from bots.
• Inngest: runs our background jobs, such as drawing cards and building print files; it receives the ids of the records a job works on.
• Sentry: error reports, only if we turn it on, with personal details removed first.
• DigitalOcean: our web host, which runs our web server in the United States.

Some of them store data outside Canada, mostly in the United States, where it may be accessible to the authorities there. Our database and your photos are stored in the western United States (California).

How long we keep it

• Your photos, decks and card art: until you delete them, the deck or your account.
• Try It: an anonymous account is deleted with its deck after 7 days without a visit. The connection hashes used to limit free cards are deleted after 48 hours.
• Print copies of an order's cards: 90 days after the order ships, for reprints, then deleted.
• Copies kept for a reported card: 90 days after the report is decided.
• Paid orders: the date, amount and shipping address are kept for tax purposes, for 7 years, even after you delete your account, but without your email or any link to you.
• QR visit records and the invitation log: 12 months, then deleted.
• Backups: we keep no backups of our own. Our database provider may keep short-term copies for its own recovery, which expire on its schedule.

Deleting your account

You can delete your account yourself on your account page. This deletes, for good, the decks you own with their cards, photos and versions, your access to decks others shared with you (their decks stay), and your credits. Orders never paid for are deleted. Paid orders are kept as described above, without your email. While an order is on its way, you can delete your account once it has arrived.

Your rights

Wherever you live, you can ask us for a copy of your personal information, ask us to correct it, ask us to delete it, and withdraw your consent. Write to support@facevaluepress.com. We answer within 30 days and may need to confirm it's you first.

Canada (PIPEDA): we handle personal information under the Personal Information Protection and Electronic Documents Act. If you aren't satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).

European Economic Area and United Kingdom (GDPR): we rely on our contract with you to run your account and orders, on your consent to make card art from photos, on our legitimate interest in preventing abuse and fixing errors, and on legal obligations for tax records. You also have the right to object, to restrict processing and to data portability, and to complain to your data protection authority.

United States: residents of states with privacy laws, such as California, Colorado, Connecticut, Virginia and others, have the rights to know, access, correct and delete their personal information, and to opt out of its sale or use for targeted advertising. We don't sell or share personal information, or use it for targeted advertising. We won't treat you differently for using your rights.

Children

Face Value Press is not for children under 13, and they may not have an account. Parents and guardians are welcome to upload photos of their own children to make cards for the family; they are responsible for those photos. If you believe a child under 13 has an account, write to us and we'll delete it.

Security

Photos, art and print files are stored privately and are reached only through our server, after it checks who you are and your role on the deck. Connections are encrypted. No system is perfectly secure; if a breach puts you at risk, we'll tell you and the authorities as the law requires.

Changes

If we change this policy, we'll update the date at the top, and for important changes we'll tell account holders by email before they apply.