← cardwarden.app

How I Built CardWarden.

By Bruce Mok · · Part 2 of 2 · 12 min read

← Read Part 1: Klarna Killed Stocard. So I Built CardWarden.

In Part 1, I covered the Stocard story, the gap I kept hitting in existing apps, and the personal friction that led me to start building. This part is about the decisions underneath CardWarden - design philosophy, the day-one foundations that are painful to retrofit later, security architecture, what is in the app today, and why monetization is structured the way it is.

Simple, Lovable, Complete

In the startup world, there is a well-known concept called the MVP - the Minimum Viable Product. Ship the absolute bare minimum, see if anyone cares, iterate from there. The problem with MVPs is that "minimum" and "viable" often end up at war with each other. You launch something that technically works but that nobody actually enjoys using. Users try it, shrug, and leave. You never get the signal you were looking for.

I prefer a different framework: the SLC - Simple, Lovable, and Complete. Instead of stripping features to the bone, you choose a focused scope and execute it well enough that someone would genuinely recommend it to a friend. Not because it has every feature under the sun, but because the features it does have feel finished, cohesive, and pleasant to use.

Stocard already validated the core idea - millions of people clearly want a digital card manager. The question I needed to answer was whether people would pay for one that also handles encryption, cloud sync, and family sharing. An SLC was the right vehicle: build enough to be genuinely useful, make it feel polished, and put it in front of people to find out.

A few principles guided every decision from there:

Keep the UI dead simple

CardWarden is a utility, not a social media app. Nobody opens a card manager to admire the animations. I deliberately use standard, out-of-the-box UI components wherever possible - no custom scroll behaviors, no bespoke transitions, no visual experiments. The interface should be invisible: you open the app, find your card, scan it, and close the app. Anything that adds friction to that flow gets cut.

Don't reinvent the wheel

As an indie developer, every hour spent building something that already exists is an hour not spent on the hard parts unique to this problem. The backend runs on Supabase instead of self-hosted infrastructure - no servers to babysit, no scaling nightmares at 2 AM. The apps use Kotlin Multiplatform so Android and iOS share one codebase (more on that below). Where a battle-tested open-source library exists, I use it rather than rolling my own.

Data belongs to the user

This is the principle that ties everything together. Every design decision - from how encryption works to how export is implemented to how the business model is structured - flows from a single conviction: your data is yours, and you should never be locked in or held hostage. More on that below.

Foundations That Are Cheap on Day One

Besides the usual features and security work, years of shipping mobile apps taught me that a few unglamorous choices are easy to put in place at the start and increasingly painful to retrofit once the product is established. They are not strictly required for a demo. Plenty of companies skip them. I spent time making sure they were baked in anyway.

Same logic (and UI) on Android and iOS

When two platforms are built by two teams, drift is almost inevitable: features that exist on one side only, bugs that never appear on the other, docs that try to track the differences, and the perpetual release question of whether to wait for both or ship one first. React Native is still the default cross-platform bet for many teams, and it is fine. I enjoyed working with Kotlin Multiplatform on my last job enough to pick it here - as native as cross-platform usually gets, with more support landing as we speak. For CardWarden, that means shared business logic and shared UI, not dual roadmaps pretending to be one product.

Landscape, foldables, and tablets

A huge number of apps still lock to portrait and treat the inner screen of a foldable as an afterthought. I have a Samsung Z Fold 5 and still love it - stylus and all - which makes it especially frustrating when even big corporate apps look broken unfolded. CardWarden does not have totally separate wide layouts yet. I did the minimum so it does not look embarrassing on a wider screen, and the codebase can grow into real adaptive designs later. Features come first for now; fancy multi-pane UI is not the current focus.

Reactive UI (and no pull-to-refresh)

This is easier to announce than to deliver. Plenty of apps - including ones from large companies - leave stale UI on screen until you navigate away and back, or sometimes until you relaunch. I am aiming for roughly 90% reactive: when important data changes, card details or a balance update from another family member should appear immediately, even if you are already looking at that screen. No pull-to-refresh. No sync button. No “please come back later.” Some values still cannot update live when an SDK offers no listener, and polling for mundane data is not worth the battery; those are the exceptions. The rest of the app treats the database as the source of truth, so backend changes flow to local storage and then to the UI.

That choice was also a deliberate improvement over Bitwarden’s mobile experience, which I otherwise admire. If Bitwarden is already open when someone else changes a shared item, you often still need a manual sync tap. In CardWarden, the number just changes.

Dark theme

Not glamorous, and not the reason anyone will choose a card vault - but my last two jobs shipped light-theme-only apps, and staring at them for hours was murder on the eyes. CardWarden supports dark theme from day one.

Localization-ready

The app is prepared for other languages even though translations are still ahead of me. User-facing text lives in one organized place, ready to hand off. Dates, times, and currencies follow the user’s locale. Easy on day one; awkward if you discover string soup six months later.

Security Without Compromise

CardWarden is built on a zero-knowledge architecture. That means I, as the developer and operator of the backend, cannot read your data. Not your card numbers, not your balances, not your PINs. Your cards are encrypted on your device before they ever touch the network, and they can only be decrypted with your master password - which never leaves your device either.

One important caveat that applies to any zero-knowledge system: the security of your data is only as strong as your master password. If you use a weak or reused password, or if that password is leaked in a breach from another service, the encryption cannot protect you. A strong, unique password is the foundation of everything. Treat it the same way you would treat your banking password - because the encryption relies on it.

The technical foundation uses industry-standard, well-audited cryptographic algorithms:

The full technical details - including the key hierarchy, the derivation process, and the family sharing protocol - are documented in the Security White Paper, which I publish because I believe transparency about security architecture should not be optional.

When you create an account, a 12-word recovery phrase is generated using the BIP-39 standard (the same standard used for cryptocurrency wallet recovery). This phrase is your safety net. If you forget your master password, the recovery phrase is the only way to regain access to your data. The backend has no reset button, no admin override, no "forgot password" email that magically unlocks your vault. That is the entire point of zero-knowledge: even if someone puts a legal order on my desk, I physically cannot hand over your data in a readable form.

Built Around Household Sync

This is the part of the design that drove most of the hard technical work. Cloud sync and selective family sharing are not bolted on - they are why I bothered with a network-backed model at all. The gift-card friction in Part 1 was specifically a multi-device household problem.

Selective Sharing with Role-Based Access

You do not share your entire card collection with your family. Instead, you create a shared "pocket" (think of it as a folder), place the cards you want to share inside it, and invite family members. Each member gets a role:

This mirrors the permissions model in Google Sheets, and for good reason - it is intuitive and granular enough for real-world family dynamics. Give your teenager "User" access to the family grocery cards. Give your spouse "Editor" access. Keep your personal loyalty cards in a private pocket that nobody else sees.

Family Sharing With End-to-End Encryption

Here is the part that most "offline-only" apps claim is impossible: sharing cards between family members while maintaining zero-knowledge encryption. CardWarden does this using ECDH (Elliptic Curve Diffie-Hellman) key exchange. When you invite a family member, your devices negotiate a shared secret using public-key cryptography. The server facilitates the handshake but never has access to the resulting key. Shared cards are encrypted with a per-pocket key that only family members can derive.

No plaintext ever hits the server. Not during sync, not during sharing, not ever.

Kids Mode

Kids Mode exists because households with children needed a path that does not require a child to create an account. A child can join a family group without email, password, or personal data collected. They get read-only access to shared family pockets. Want to share a Steam gift card with your kid as a reward? Drop it in the shared pocket and they will see it on their device. It is a small feature, but it reflects a simple requirement: if the app supports family sharing, it should accommodate how families actually work.

What Else Is in the App

Beyond security and household sync, CardWarden also includes the day-to-day card-manager pieces I needed myself:

Balance Checking Built-in browser that opens the retailer's balance check page, pre-fills your card number and PIN, and tries to detect the updated balance automatically. If a retailer changes their balance check URL before I get a chance to update the app, you can override the URL yourself - no waiting for an app update.
Card Sharing Generate a passphrase-protected share link to send a card over chat or SMS - far more secure than a screenshot. Communicate the passphrase separately, in person or by other means. For someone standing right next to you, just display a QR code and let them scan it.
Push Notifications Get notified when a family member spends on a shared card, adds a new card, or tops up a balance.
Home Screen Widgets Single-card and grid widgets on both Android and iOS for quick access without opening the app.
Biometric & PIN Lock Protect the app with fingerprint, face recognition, or a PIN code.
Expiry Reminders Configurable notifications for card expiry dates and credit card payment due dates - as few or as many reminders as you want.
Multiple Card Types Loyalty cards, gift cards, credit cards, and debit cards - each with type-specific fields and workflows.
Data Export Export your data as an Excel-compatible spreadsheet to take elsewhere, or as an encrypted backup protected by a passphrase you set. Your data is never held hostage.
Batch Import from Screenshots Migrating from another card app? Take screenshots of your cards and import them all in one go. On-device OCR matches each card to the right template; if no template exists, it picks up the dominant color and card name automatically. No data leaves your device.
Undo Delete Deleting a card shows no confirmation dialog - the card disappears instantly with a snackbar and an Undo button, Gmail-style. One tap to undo if it was a mistake.
Batch Operations Select multiple cards to delete, move between pockets, pin, or unpin in one action.
Gift Card Insights See your total gift card value at a glance, with a breakdown across cards.

While the primary focus of CardWarden is loyalty and gift cards, the app does support credit and debit cards as well - currently with basic fields like statement due date reminders, emergency hotline numbers, and cardholder details. Over time, I plan to migrate the full feature set from my existing Credit Card Manager app (the one I published over a decade ago and is still on the Play Store) into CardWarden, including transaction recording and spend tracking. One app to rule them all, eventually.

A few more details worth calling out: the export feature exists because I believe your data should belong to you. If you ever want to leave, you can export everything to an Excel-compatible spreadsheet and take it elsewhere - or keep it in a spreadsheet. No lock-in, no hostage data, no "please contact support to download your information." And if you want to delete your account, you can do it from within the app or through the website - it is a true cascading delete of your account and all associated data, not a soft delete, not a "deleted" flag in a database somewhere. Everything is wiped.

Cross-platform family sync also means it does not matter if half your household uses Android and the other half uses iPhone. The sync works across both. Dark theme is supported. Strings are centralized for localization whenever translations catch up.

Small things add up, too. When you tap the edit-balance button, the current balance is already highlighted - you can start typing the new amount immediately without selecting the old value first. Minor details like this are easy to overlook, but they make day-to-day use feel noticeably smoother.

On the security side, screen capture is blocked on Android when sensitive information is displayed - your recovery phrase, your PIN, a shared QR code. iOS does not offer native screenshot prevention at the OS level, so building a custom solution for that is on the backlog.

Privacy as a Design Constraint, Not a Marketing Checkbox

Privacy is easy to claim and hard to practice. Here is what it actually looks like in CardWarden, aligned with the privacy policy:

The goal is to collect only the absolute minimum needed for the mode you choose, and to avoid any advertising or tracking identifiers that can profile you across apps. Card numbers, balances, PINs, and similar card details are encrypted on device before sync. In concrete terms:

CardWarden does not collect Google Advertising ID (GAID), Apple's IDFA, Android ID, IMEI, or MAC address - not from the app, and not from third-party SDKs used by the app.

EU-hosted infrastructure. The backend runs in Frankfurt, Germany - central EU - to align with GDPR expectations from day one. Building for the stricter privacy standard early is easier than retrofitting it later.

Why Monetization Looks Like This

There is an old saying in tech: if the product is free, you are the product. That is not always true - open-source offline apps and platform wallets can be free for different reasons - but it was the pattern that played out with Stocard. When a free app has investors to answer to and no durable way to pay for itself without advertising or data leverage, users eventually become the funnel.

I wanted CardWarden's incentives to be boring and aligned: people who use cloud features help cover the servers those features need, and that same revenue funds continued development and improvement. People who do not want cloud, or who dislike subscriptions, should not be forced into that model. Free wallets and free offline apps remain reasonable answers for many people; a client-encrypted cloud option that declines ad tracking still has hosting costs, so it usually has to charge something to stay sustainable.

So there is a free tier and three paid tiers, structured as a choice rather than a single path:

The free tier is there so you can try the app, poke around, and see if the design clicks for you. It has a card limit and is not meant for everyday use - think of it as a test drive. If you want to experience the full product, the yearly Cloud and Family plans include a free trial, which is a better way to see everything before you commit.

I am as tired of subscription fatigue as anyone. Cloud and Family stay on subscription only because encrypted multi-device sync actually costs money every month. Offline is one-off precisely because it does not. Pricing is set at a level I myself would be willing to pay for a product like this - not at whatever the market will briefly tolerate under urgency tactics.

Where Approaches Differ

For reference, here is a factual snapshot of the capabilities I cared about while designing CardWarden, compared with the apps I evaluated most closely. It is not a claim that every row matters equally for every person.

Feature CardWarden SuperCards Catima Klarna Google/Apple Wallet
Works offline Yes Yes Yes Unreliable Yes
Cloud backup Yes Manual transfer No Yes Yes
Multi-device auto sync Yes No No Yes Yes
Zero-knowledge E2E encryption Yes Unknown N/A (offline) No No
Family sharing Yes No No No No
Balance checking Yes No No No No
Role-based access Yes No No No No
Kids mode Yes No No No No
Cross-platform Android & iOS Android & iOS Android only Android & iOS Platform-locked
Home screen widgets Yes Yes No No No
Data export Yes No Yes No No
No ad tracking Yes Yes Yes No No

Note: Google Wallet and Apple Wallet use encryption in transit and at rest on their servers, but this is standard server-side encryption - the provider holds the keys and can access your data. This is fundamentally different from zero-knowledge end-to-end encryption, where only you hold the decryption key. Klarna does not implement zero-knowledge encryption either. I honestly do not know how SuperCards implements its backup and transfer feature under the hood, so I have marked it as unknown in the table above.

What Comes Next

CardWarden is actively developed. The Apple Watch companion app is already integrated and ready for beta testing - though I will be honest, I am an Android user and don't own an Apple Watch, so it has only been tested on the simulator. If you have one and want to help test, I would love to hear from you. Android Wear OS support is coming soon.

Also on the roadmap: credit card transaction recording for basic spend tracking, continued expansion of the built-in card template catalog, and quality-of-life improvements driven by whatever people run into once they can try the app.

The technical through-line has not changed since Part 1. Cloud sync and real security are not mutually exclusive if the cryptography is done properly - password managers already showed that. The rest is mostly continuity: keep building, keep the incentives boring, and keep the server unable to read what it stores.

• • •

The app is not publicly released yet. A beta is opening soon; if you want to try it when seats become available, you can register at cardwarden.app.