Privacy

Information we store

When you create an account, we store your name, email, account identifiers, and sign-in information. Email accounts use a password hash. Google sign-in provides basic profile information, such as your name, email, and profile image.

When you fill in an invitation, we store the contact details you choose to share, which may include your name, email, phone number, address, birthday, pronouns, company, website, notes, and photo. We also store invitation labels, status, expiration dates, and submission dates.

Session cookies keep you signed in. A temporary cookie can link a submitted contact card to an account you create. Our hosting and authentication services may process technical information such as IP addresses and browser details to operate and protect the service.

How information is used and shared

We use this information to sign you in, deliver invitations and contact cards, display your address book, prevent repeated submissions, and provide exports. Your page name and note are public. Collected contact cards are available to the person whose invitation you used, who can download them or export them to other apps. An invitation can be forwarded, so share links only with the intended recipient.

Vercel hosts the application, and Turso stores application data. These providers process data to deliver the service. Connecting Google Contacts sends the cards you choose to export to Google. Information may also be disclosed when required by law or necessary to protect the service and its users.

Google account access

Basic Google sign-in uses your identity information. Connecting Google Contacts separately requests permission to manage contacts. The app uses this permission only when you request an export. To avoid duplicates, it then reads your Google contacts and matches each card by email, phone number, or name. Unmatched cards are added as new contacts. For a match, the app adds details the Google contact is missing, such as an address, birthday, or photo. If the Google contact has a different value for a detail, the app shows both versions and changes it only as you choose before exporting. It never deletes contacts.

We store encrypted Google access and refresh tokens to maintain your connection, along with identifiers and export status for contacts the app created or updated, to avoid repeating exports. Other information read from Google is used only during the export and is not stored. We do not sell Google user data, use it for advertising, or use it to train AI models.

Contacts Exchange’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

How we protect your information

All traffic to Contacts Exchange is encrypted with HTTPS, and browsers are told to always use HTTPS. Google access and refresh tokens are encrypted before they are stored, using a secret key that is kept outside the database. Passwords are stored only as one-way hashes. Session cookies are secure and HTTP-only, so they are sent only over HTTPS and cannot be read by scripts on the page.

Contact cards and Google connection data are available only to the signed-in owner of the address book, and the server checks this on every request. Application secrets and API keys are stored in our hosting provider’s environment settings, not in source code. Contact information read from Google during an export is used only for that export and is not stored.

Retention and deletion

Account and contact information stays stored until it is deleted. Invitation expiry stops submissions but does not delete the invitation record or a previously submitted card. Address book owners can remove collected contacts in the app. You can request deletion of your account, saved card, or other personal data by emailing us; we may need to verify your identity.

You can revoke Google access in your Google Account connections. Revoking access prevents further authorized exports but does not delete information already stored here or contacts already added to Google. Deleting a card here does not remove copies downloaded or exported by its recipient. Contact the recipient to remove those copies.

Changes

Changes to this policy will appear on this page with an updated date.