Privacy Policy

Last updated: October 21, 2026

This policy explains what Washicard (the iPhone, Android and web apps, and the washicard.com website) collects, why, and what choices you have. Washicard is a Washi app, operated by SoriStory LLC (“Washicard,” “we,” “us”).

Our starting point is to collect as little as possible. Washicard never asks for a bank login and never asks for a card number. Your wallet lives on your device, and reaches our servers only if you choose to sign in to Washicard Cloud.

1. Information we collect

Your wallet

Your wallet is the list of cards you pick from Washicard’s catalog, the month each was opened, the last four digits if you choose to add them (only to tell two of the same card apart), the credits you stamp as used or missed, any cards you add yourself, and the values you give to perks such as free nights. It also holds your profile for Next card: a credit score band, an income band, whether you have a business, and whether you bank with Bank of America. These are rough ranges you choose. We never check your credit.

On iPhone, the wallet is stored on your device and backed up through your own private iCloud, which we cannot read. On Android, it is stored on your device and included in your own Google backup.

If you sign in to Washicard Cloud, a copy of your wallet is stored on our servers in Google Firebase (Cloud Firestore), tied to your account, so the same wallet appears on iPhone, Android and the web app at app.washicard.com. Only your signed-in account can read it. It is encrypted in transit and at rest by Google, but it is not end-to-end encrypted. The web app shows this copy and keeps no wallet of its own; the demo in the web app keeps a sample wallet only in your browser.

Washicard never connects to your bank, never sees your transactions or balances, and never stores a full card number.

Account information

Washicard Cloud is optional. If you use it, you can sign in with Apple or with Google, through Firebase Authentication. From Apple we receive a stable, app-specific user identifier and, only if you choose to share it, an email address (which may be Apple’s private relay address). From Google we receive your Google account identifier, name and email address. We never receive your Apple or Google password.

Reminders

The phone apps schedule reminders (credits about to expire, fees coming up, when you’re under 5/24 again) on your device. They are not sent through our servers. The web app sends no notifications.

Card news and the catalog

The apps download card news from washicard.web.app at most a few times a day with a plain request that carries nothing about you or your wallet.

Advertising and analytics

Washicard shows no ads and contains no analytics, advertising or tracking SDKs. The apps do not use your device’s advertising identifier.

This website

washicard.com is a static page with no cookies, no analytics and no third-party scripts or fonts. It is served by Cloudflare, which processes standard request data (such as IP address and browser type) to deliver the page and protect it from abuse.

2. How we use information

To show your wallet, stamp your credits and calculate what’s left, your reports and your Next card odds. These calculations run on your device or in your browser.
If you sign in, to sync your wallet between your devices.
To answer you when you contact us.

We do not sell your information, and we do not use it for advertising.

Google Firebase stores Washicard Cloud wallets and handles sign-in, as our service provider.
Apple (iCloud) and Google (Android backup) store your device backups under your own accounts, under their privacy policies.
Cloudflare serves washicard.com and app.washicard.com.

We may disclose information if the law requires it.

4. Paid links

Some Apply buttons are labeled “Paid link”. If a bank approves you through one, it pays Washicard a referral fee, at no cost to you. When you tap one, the bank’s page opens with an anonymous, random id for that tap, so the bank can credit Washicard. The id is not linked to your wallet or your account. What you do on the bank’s site is governed by the bank’s privacy policy. Offers without a paid link go to the bank’s public page.

5. How long we keep information

Your Washicard Cloud wallet stays until you delete it or delete your account. Signing out does not delete it. Data on your device stays until you remove the app or its data.

6. Your rights & choices

You can use Washicard without an account. You can export your wallet as a file at any time from Profile → Backup & sync, and import it again on any device. Depending on where you live, you may have rights to access, correct, delete or port your information; contact us to use them.

7. Deleting your data

In any of the apps, Profile → Backup & sync → Delete account removes every record of your wallet from our servers and deletes your Washicard Cloud account. The wallet on your phones is not touched. You can also ask us to delete your data by contacting us.

8. Security

Data in transit is protected with TLS. Each Washicard Cloud wallet can be read and written only by its own signed-in account, enforced by our database rules. No system is perfectly secure, but we keep what we hold small: there are no card numbers or bank credentials to lose.

9. Children

Washicard is meant for adults who hold credit cards. It is not directed to children under 13, and we do not knowingly collect information from them.

10. Changes to this policy

If we change this policy, we will update the date above, and for significant changes we will tell you in the apps.

11. Contact us

Questions or requests about this policy or your data:
SoriStory LLC
30 N Gould St Ste R
Sheridan, WY 82801, USA
support@washicard.com