CardSorted (cardsorted.com) is published by Two Cores Operations Ltd, a company registered in England and Wales. Two Cores Operations Ltd is the data controller for the personal information described in this policy. The site is written for readers in the United States, so this policy covers both UK data protection law (which applies to us as the publisher) and California privacy law (which matters to many of our readers).

Very little, because there is very little to collect. There are no reader accounts on CardSorted. You cannot register, there are no profiles, and we never ask for financial details. Card applications happen on the issuer’s own site, never on ours. The personal information we handle is limited to:

• Contact form letters. If you write to us through the contact page we receive the name, email address, subject, and message you type. The letter is delivered to our editorial inbox by email using Resend, an email delivery service, and we use it only to read and answer your correspondence.
• Newsletter signups. If you subscribe to the newsletter we collect your email address, along with a note of which site and form it came from. Signups are stored using Netlify Forms, a service of our hosting provider, and used only to send you the newsletter.
• Usage data. We use Google Analytics 4 to understand how the site is read: pages visited, approximate location, device and browser type, and how you arrived. This data is aggregated and does not identify you to us by name.

We do not sell your personal information, and we do not buy lists, enrich profiles, or run third-party advertising on the site.

CardSorted is funded by affiliate compensation. When you click an “Apply Now” or card link, you leave our site and travel to the issuer through an affiliate network, including CJ Affiliate. Those networks set their own cookies and tracking so that an approved application can be attributed to us.

That tracking belongs to the networks and issuers, not to us. We never receive your application details, and the networks’ handling of your data is governed by their own privacy policies, which we encourage you to read before applying.

CardSorted itself does not require cookies to read. Cookies on or around the site come from two places:

• Google Analytics 4 sets cookies in your browser to measure how the site is used
• Affiliate networks such as CJ Affiliate set cookies when you click a card link, to attribute any resulting application

You can block or delete cookies in your browser settings, and Google offers a browser add-on that opts you out of Google Analytics entirely. The site remains fully readable with cookies disabled.

Because our publisher is a UK company, the UK General Data Protection Regulation applies to the personal data we hold. Under it you can ask us for a copy of the information we hold about you (in practice, your letters and newsletter signup), ask us to correct it, or ask us to delete it. You can also complain to the UK Information Commissioner’s Office if you think we have handled your data badly.

If you are a California resident, the California Consumer Privacy Act gives you equivalent rights: to know what personal information we have collected about you, to access it, and to have it deleted. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.

To exercise any of these rights, write to us through the contact page and we will respond promptly. Unsubscribing from the newsletter is simpler still: use the link in any issue, or ask us and we will remove you.

Contact letters are kept only as long as needed to deal with your correspondence. Newsletter addresses are kept until you unsubscribe or ask to be removed. Analytics data is retained on the schedule set in Google Analytics.

If this policy changes, the new version will be published here with a revised date. This version was last updated on 4 July 2026.