Privacy Policy

Effective October 10, 2026

Firsthand ("we", "us") is operated by Benjamin 23 Blue Enterprise LLC, Dallas, Texas. This policy explains what the Firsthand app and website collect, why, and what we never do with it.

What the app collects, and why

• Camera and microphone, to take the photos and 15-second videos that become your cards. Capture happens only when you press the shutter. We never record in the background.
• Location (GPS), captured at the moment of your shot to verify you were inside the venue during the event. This is the product's core proof. Background location, if you enable arrival alerts, is used only to notice when you reach a venue and never to track you between events.
• Time, a network-verified clock stamp at capture, used for the same verification.
• Your photos and videos. Your vault lives in the app's own storage on your phone. When you share a card, your phone sends the image to whichever app you pick, exactly as it would any other photo. Videos always stay on your phone.
• Your handle and email, only if you claim a handle. The email receives a six-digit code that proves the address is yours, and the handle is the name your cards carry. Claiming is optional.
• Card backups, only with a claimed handle. Each card's photo and its details (serial, venue, town, date, and where the shot was taken) are kept on the Firsthand ledger, so your cards come back on a new phone and can be sent or traded.

What is not built yet

Printing partners are described below because they are coming, and because we would rather tell you now how they will work. They are not live today, and we will update this policy and the app's Data safety listing before they turn on.

What we never do

• We never sell your personal data.
• We never use your photos to train AI models or for advertising.
• We never track your location outside of capture and arrival detection.
• We never edit a card's verification stamp, not for you, not for anyone.

Share counts on the website

On the home page, a Share button is counted, with no name attached, by our own counter at growth.grademyhabits.com. If you arrive from a link someone shared, a cookie keeps that link's random code for 30 days so the person who shared can be credited. We never send photos or anything about you. Browsers that send Do Not Track or Global Privacy Control are not counted.

Share and install counts in the app

In the Android app, when you share a card, or install the app from a link someone shared, we count it, with no name attached, in our own counter at growth.grademyhabits.com, together with a random code the app keeps on your phone. The counts carry no photos, no location and nothing about your cards, and none of this is used for advertising. Google Play may also ask you for a rating after a few cards are in your vault; that request and your answer are handled by Google.

Children and school teams

Team cards created through a school or program account are visible only to that school's own community through its private share link. Cards of minors are never listed publicly, never tradeable, and never appear in marketing without a parent's or guardian's written consent. Coaches and program directors control their roster; parents may request removal of their child's card at any time via the contact below.

Sending, trading and the chain of ownership

When you send or trade a card, your handle and the date become part of that card's ownership record. That record is the product, and it is visible to anyone who scans the card's QR code. Personal information beyond your handle is never included.

Data you can take or delete

Your cards, photos, and videos are yours. You may export or delete any of them at any time from within the app, and deleting the app removes everything on your phone.

If you claimed a handle, you can delete your account from inside the app: on My Vault, tap the person icon, then Delete my account. That deletes your handle, your email, and every card the handle holds on the ledger with its photo and backup, right away. Cards you already sent or traded to other people stay theirs, and in their history your handle becomes "a deleted member". No phone with the app? Email hello@firsthandcards.com from the address you claimed with, and we delete the account within 7 days. See Delete your account.

Third-party services

Event detection uses Ticketmaster's public event data. Your coordinates are sent to Ticketmaster to look up what is happening near you, and nothing that identifies you goes with them, and only when the app looks for an event.

The ledger and card backups run on Cloudflare. The sign-in code email is sent through Brevo. Neither uses your data for anything else.

Print orders, when printing partners are connected, will send them only the card file and the shipping address you provide for that order. That is not live yet.

Contact

Questions or removal requests: hello@firsthandcards.com