Trust starts with clarity.

Kardora respects your privacy and processes personal information only for clearly defined purposes. We may collect account details, device and security information, customer-support communications, gift card submission information and payout details when you use the Kardora app or website.

We use this information to provide quotes and app services, verify submitted gift cards, prevent fraud, process payouts, respond to support requests, maintain security and meet applicable legal obligations. We do not sell personal information.

Information may be shared with service providers that support hosting, verification, analytics, fraud prevention, customer support and payment processing. These providers may use information only to provide contracted services and must protect it appropriately.

We retain information only for as long as required for the purposes described above, dispute handling, fraud prevention and legal compliance. You may request access, correction or deletion of eligible personal information by contacting pdgiftcard@gmail.com. Certain records may need to be retained where required by law or for legitimate security purposes.

Kardora uses reasonable administrative, technical and organisational safeguards, but no digital service can guarantee absolute security. Never share your password or verification code with anyone.

Operator and privacy contact

Kardora is operated by CyberSellX Limited. For questions about this policy or requests concerning your personal data, contact pdgiftcard@gmail.com or in-app Support. Requests may require identity verification. Access, correction, objection and deletion requests are handled subject to applicable requirements and the existing financial-record provisions.

App usage analytics and technical diagnostics

We use Google Analytics for Firebase to understand app use, including first opens, successful registrations and successfully credited gift-card trades. We separately use Firebase Crashlytics and Firebase Performance Monitoring to identify crashes, technical errors and slow operations. These services are provided by Google. Analytics and technical reporting have separate settings and are independent of marketing messages, notification permissions, trading eligibility and rewards.

Optional settings and your choices

App analytics and Crash & performance reports are optional and off by default in the current public-release configuration. To enable either, make a separate choice in Settings → Notifications & Privacy. Opening or closing an explanation does not enable reporting. Existing explicit choices are respected during updates; an old default-enabled marker is not treated as affirmative consent. Your ability to log in, trade, receive eligible rewards or contact support does not depend on enabling either setting.

Turning analytics off stops new SDK collection and resets local analytics data. Server-side withdrawal of your analytics choice takes effect when your device reconnects. Native crash reports may be stored locally while reporting is off; we request deletion of pending reports when you turn reporting off. On a new diagnostics opt-in, earlier nonconsented pending reports are deleted. Reports from a previously verified opt-in can be sent on a subsequent verified start of that installation. Turning reporting off does not erase information previously sent to Google or cancel an upload already in progress. Contact us regarding information already collected.

Usage information and event measurement

When analytics is enabled, Google processes app-instance and session identifiers, app and device information, usage events and approximate location derived from network information. For successful registration and trade events, Kardora's server uses an internal association between your account and the app instance. Event information sent to Google includes the market, registration method where applicable, event time and a coded trade reference used to reduce duplicate counting. A coded identifier is pseudonymous, not a guarantee of anonymity.

Kardora's custom analytics payloads do not include your name, phone number, email address, gift-card code or images, wallet balance or trade payout amount. SDK-generated app and device information is separate from these custom fields. A transaction event describes an actual successfully credited trade, not a button press, failed order or payout estimate. We do not treat customer payouts as company revenue.

Campaign measurement

We link the Kardora Analytics property to our Google Ads account to evaluate campaign performance. App analytics remains optional and off by default. On Android, Advertising measurement has a separate switch inside the existing App analytics settings. It starts off, requires App analytics to be enabled, and is enabled only by a separate explicit choice. There is no advertising-measurement prompt on startup. Existing analytics choices are not treated as consent to this additional purpose.

When you enable Advertising measurement, Google may use the app-instance identifier, supported ad-click information and future eligible analytics events to measure advertising results. Kardora's server sends an advertising-user-data permission only for eligible new events captured with that permission and while the permission remains active. Personalized advertising, remarketing use and phone advertising-ID collection remain disabled. Advertising storage remains denied. Turning off Advertising measurement leaves ordinary App analytics available; turning off App analytics also turns off Advertising measurement.

After this explicit choice, the Android app may read Google Play installation-source information. Kardora's custom API retains only processed campaign labels, click and installation timestamps, and whether a Google click identifier was observed, associated internally with an account and installation. It does not retain or export the raw referrer or click identifier through that custom API. Google Analytics for Firebase can process supported campaign information through its own SDK. Kardora's custom Google event payloads still exclude names, phone numbers, email addresses, card details, wallet balances and payout amounts.

The internal campaign report compares these observed sources with existing account-registration facts and subsequently credited orders with matching positive wallet-credit records. It does not fabricate an earlier Google registration event or resend historical conversions. An observed campaign label, including one in a shared download link, is not proof that a paid Google ad caused a registration or trade. Unknown sources, permission choices, old app versions, unavailable Play services and account switching can limit coverage. The source observation and the actual Google Ads attribution must be verified separately.

Turning off either applicable permission stops new SDK collection or advertising use as appropriate. Pending server-side events are cancelled when the revised choice reaches the server. A withdrawal cannot retract information already sent or an upload already in progress; server-side withdrawal is applied when the device reconnects. The existing retention, international-processing, access and deletion provisions continue to apply. Source observations older than the supported 90-day measurement window are not accepted for new source binding. This window does not promise immediate deletion from all live tables, Google systems or backups.

On iOS, the Android Advertising measurement switch is not available, and advertising-user-data remains denied.

On iOS, aggregate campaign measurement is subject to the supported Apple mechanisms, measurement windows, privacy thresholds and delayed reporting. Individual cross-app tracking is not enabled in this configuration. We do not claim that every registration or trade is attributed to an advertisement, or that post-install SKAdNetwork conversion reporting has been fully validated. Any later feature requiring tracking permission must respect the platform permission and applicable choices.

Technical reports

Technical reporting can include crash stacks and code locations, app state, app and operating-system information, device information, installation identifiers, operation duration and result categories. Google's SDKs may process network information, including IP addresses for geographic performance grouping, and usage breadcrumbs associated with diagnostics.

Kardora's custom Dart error reports use fixed error categories and filtered code locations instead of original error messages. Custom performance measurements use fixed operation names, elapsed time and result categories rather than request bodies, response contents or real request URLs. We do not deliberately attach customer contact details, card details or wallet amounts to custom reports. This does not guarantee that every SDK-generated native crash report is free of identifying information.

Recipients, international processing and retention

Google processes information under the applicable Analytics and Firebase service terms, and information may be processed outside Nigeria and Ghana. Transmission uses encrypted connections. We limit developer-added fields to measurement and product reliability. Telemetry is not described as completely anonymous or exclusively processed in Nigeria or Ghana.

Google Analytics event and user-data retention depends on the property configuration and applicable service terms; these settings do not impose the same time limit on all aggregated reports. Google documents removal beginning after 90 days for Crashlytics crash traces and associated identifiers; for Performance Monitoring, it documents 30 days for IP-associated events and 60 days for installation-associated and de-identified performance data. Removal from every live and backup system is not promised on those exact dates. Provider information: https://firebase.google.com/support/privacy and https://support.google.com/analytics/answer/7667196.

When Kardora's 90-day internal retention process is enabled, analytics event and delivery records become eligible for automated deletion 90 days after creation. Account-to-Firebase-instance associations become eligible 90 days after their last refresh once expired and no retained event depends on them. Deletion uses bounded batches and may take additional processing time. This rule is distinct from the shorter event-delivery eligibility period.

We keep a separate minimal privacy-preference and replay-protection record to prevent older requests or a default setting from reversing your choice. It contains an installation identifier, internal account identifier, revision, enabled state and choice source, but no Firebase instance or session identifier, event content or delivery history. It is not used for activity or advertising measurement and is scheduled for deletion when account deletion is completed. Financial-account rows can remain under existing record-retention requirements. Backup expiry and restoration controls are separate from live-table cleanup. Existing account, fraud prevention, transaction audit and dispute provisions continue to apply to business records.

These Terms govern access to the Kardora website and mobile app. By using Kardora, you confirm that you are legally able to enter into these Terms and that the information you provide is accurate.

Gift card values shown on the website are estimates only. A transaction is not confirmed until the card has been submitted through the Kardora app, reviewed and accepted. Rates and availability may change before final confirmation.

You may submit only gift cards that you legally own and that have not been redeemed, altered or obtained unlawfully. Invalid, previously redeemed, unverifiable or suspicious cards may be rejected. Kardora may restrict activity or request additional verification where necessary to protect customers and the service.

Payout timing depends on successful verification, the selected payout method and external payment providers. Kardora is not responsible for delays caused by inaccurate payout information, third-party outages or events outside reasonable control.

Rewards, missions, VIP benefits and referral programs are subject to eligibility, market availability and the live rules displayed in the app. Abuse, duplicate accounts, self-referrals or fraudulent activity may result in reward cancellation or account restriction.

Kardora may update these Terms to reflect product, operational or legal changes. The effective date and current version will be displayed on this page. Continued use after an update means you accept the revised Terms.