Privacy Notice
Last updated: October 24, 2026
In short: our apps have no accounts, ads or tracking, and your photos and the contents of your cards never pass through us. We only handle personal data when you buy from us or write to us. This website uses no cookies and no analytics.
1. Who is responsible
The controller of your personal data is Jabuti Labs, São Paulo, SP, Brazil. For anything about privacy, write to contato@jabutilabs.app.br. This notice follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and, for people in the European Economic Area and the United Kingdom, the GDPR and UK GDPR.
2. What stays on your devices
Photos on TV keeps the links of the albums you add, your settings and the unlock on the TV itself. The TV loads photos and videos directly from Google's servers, and Google handles that under its own privacy policy. Videos are stored temporarily on the TV while they play. The page you open on your phone to add albums is served by the TV over your home network and doesn't pass through us. We never receive your photos, your album links or your Google account.
Veracard runs its checks on your Mac. Your files and the contents of your cards never leave it, and your check history and settings stay on the Mac; deleting the app deletes them. Only if you choose to share a result with the Community does Veracard publish to Apple's CloudKit public database: the store name, platform and country, optionally the city and price, the card's claimed and real capacity, the verdict and the chip's manufacturer ID. These reports aren't linked to your identity; CloudKit only keeps an anonymous identifier per app, used so other people can hide or report entries. To remove a report you shared, write to us.
3. What we handle, why, and for how long
| When | Data | Why, and legal basis | How long |
|---|---|---|---|
| You visit this website | IP address and browser details, in the logs of our hosting provider (Cloudflare) | To deliver the site and protect it against abuse. Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) | Kept briefly by Cloudflare under its policies. We keep no logs of our own. |
| You buy an unlock or a licence from us | A random purchase code created by the TV or Mac (not linked to your identity or to the device's serial number), the payment reference and the date; your email, to send you the Veracard licence key; and the CPF used with Pix, in scrambled (hashed) form. For Veracard, also the licence key and a scrambled identifier of each Mac you activate, derived from the Mac's hardware ID, which itself never leaves the Mac | To unlock the app once the payment is confirmed, to let you restore it later or activate it on another of your Macs, and, for Veracard, to check about once a week that the licence wasn't refunded. Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) | As long as we offer the app, so you can restore the unlock. You can ask us to delete it sooner, but then you can't restore. |
| You pay outside Brazil (Paddle) | Paddle collects your payment details, name, email and country as Merchant of Record. We receive the order number, email, country, product, amount and date. | To deliver the unlock, answer support requests, handle refunds and keep accounting records. Contract and legal obligation (LGPD art. 7, II and V; GDPR art. 6(1)(b) and (c)) | 5 years, as required by Brazilian tax law |
| You pay in Brazil (Pix) | Mercado Pago processes the payment. We receive the payment reference, amount, date and status, and the payer's name and CPF as provided by Pix. | As above | 5 years, as required by Brazilian tax law |
| You share a Veracard result | The Community report described in section 2, and CloudKit's anonymous identifier | To show other buyers which stores sell fake cards, and to let people hide or report entries. Your consent, given when you choose to share (LGPD art. 7, I; GDPR art. 6(1)(a)) | Until you ask us to remove it |
| You write to us | Your email address and whatever you choose to tell us | To answer you. Legitimate interest or contract (LGPD art. 7, V and IX; GDPR art. 6(1)(b) and (f)) | Up to 2 years after our last exchange |
When the TV asks our payment service whether a purchase went through, the request carries your IP address, as any internet request does. Cloudflare uses it to deliver the request. We don't store it.
We don't sell personal data, we don't use it for advertising, and we don't make automated decisions about you.
4. Who receives data
- Paddle (Paddle.com Market Ltd, United Kingdom), Merchant of Record for purchases outside Brazil, under its privacy policy.
- Mercado Pago (Brazil), which processes Pix payments, under its privacy policy.
- Apple (Apple Inc., United States, and Apple Distribution International, Ireland), which sells Veracard on the Mac App Store and stores the Community reports in CloudKit, under its privacy policy. From App Store sales we receive only totals, never your name or payment details.
- Cloudflare, Inc. (United States), which hosts this website and our payment service and forwards our email.
- Our email provider, which stores the messages you send us.
- Our accountant, and public authorities when the law requires it.
5. International transfers
Some of these providers process data outside Brazil and outside your country, for example in the United States and the United Kingdom. These transfers rely on the safeguards the providers offer, such as standard contractual clauses (LGPD art. 33; GDPR art. 46), or on an adequacy decision where one exists.
6. Your rights
You can ask us to:
- confirm whether we hold data about you, and give you access to it;
- correct data that is incomplete, wrong or out of date;
- delete data, or anonymise or block data that is unnecessary or handled unlawfully;
- restrict how we use your data, or object to a use based on legitimate interest;
- give you your data in a portable format;
- tell you who we have shared it with;
- withdraw any consent you gave.
Write to contato@jabutilabs.app.br. We reply within 15 days. We may need to keep some data even after a request when the law requires it, such as accounting records. You can also complain to a data protection authority: in Brazil, the ANPD (gov.br/anpd); in the EEA or the UK, the authority where you live.
7. Security
We keep as little data as we can. Everything travels over encrypted connections (HTTPS). The keys to the payment providers are kept only in the encrypted settings of our payment service, never in the apps. CPFs are stored only in hashed form, and only we have access to our accounts with these providers.
8. Cookies
This website sets no cookies and uses no analytics or third-party scripts. If you choose a language, your browser remembers that choice locally; it is never sent to us. The apps keep their settings on your TV or Mac only.
9. Children
Our apps aren't aimed at children, and we don't knowingly collect children's personal data. Payments must be made by an adult or with a parent's permission.
10. Changes
If we change how we handle data, we'll update this notice and the date at the top. If a change is significant, we'll also say so on our website.