Card Contacts privacy policy
Effective 13 September 2026 · last updated 14 September 2026
Card Contacts is an iOS and Android app published by System Sync LLC, a Florida limited liability company ("System Sync", "we"). This policy covers the app and the shared card pages it produces at system-sync.com/card/.... Questions and deletion requests go to admin@system-sync.com.
The short version. The app stores the contacts you save, the card photos you keep, and your own card. It is readable by your account only. Scanning a card sends that one cropped image to our reader service so the fields come back typed, and only if you agreed when the app asked. There is no advertising, no tracking kit, and nothing is sold. You can delete the whole account from inside the app.
1. What the app stores
| What | Why it exists |
|---|---|
| Your email address | It is your account. You sign in with an emailed link, with Sign in with Apple, or with Google. If you use Sign in with Apple and choose to hide your address, we only ever see the private relay address Apple gives us. |
| Your own card | Name, job title, company, phone, email, LinkedIn address and the photo you choose. This is what a share link hands out. |
| Contacts you save | The fields read off a card or typed in by you: name, title, company, phone numbers, email, website, address, links and your own notes. |
| Card images | The photo of a card, and any photo you attach to a contact. Stored in private storage under your account only. |
| Share links | For each link you create we keep a one way hash of it, when it was made, and whether you revoked it. The link itself is not stored in a form we can read back. |
We do not ask for your date of birth, your location, your address book as a whole, or any payment details. The app has no in app purchases.
2. Where it is stored
On our Supabase project hosted in the United States (AWS us-east-1). Every table enforces row level security, so a signed in account reads and writes its own rows and nothing else. Card images live in a private storage bucket whose keys begin with your own account id; another account cannot list or open them.
3. What leaves your phone when you scan a card
Text recognition runs on the phone, using the operating system's own text recognition. To turn that loose text into typed fields, the app can then send the cropped card image and the recognized text to our own server function, which passes it to the Claude API operated by Anthropic, and returns the fields to your phone.
We ask you first, and you can say no. The app puts the question before your first capture, naming what is sent and who receives it, and does not send anything until you agree. Decline and the phone reads cards on its own: the fields come back rougher and you correct more by hand, but nothing about the card leaves the device. You can change the answer at any time with the Assisted card reading switch on My Card.
- Only the cropped card is sent. Nothing else from your library or your contact list.
- Anthropic processes it to produce the answer and, under its commercial terms, does not use it to train its models. Their handling is described in Anthropic's privacy policy.
- The key for that service stays on our server. It is never shipped inside the app.
- If the reader is unavailable, the app falls back to the on-device read and hands you an editable draft. It never invents a field.
4. Sharing your card
A share link is a long random token. Whoever holds the link can open your card page, so treat it like a business card you have handed over: it is meant to be passed around, and it is not a secret.
- The page shows name, title, company, one primary phone, email, LinkedIn and your photo. Nothing else in your account is reachable through it.
- The photo is served through a link that expires within minutes of the page being opened.
- Revoke a link in the app and the next request gets a "no longer available" page. You can hold several links at once and revoke them separately.
- Card pages are served with no indexing headers, so search engines are asked not to list them.
5. Permissions the app asks for
| Permission | What it is used for |
|---|---|
| Camera | Photographing a business card, and scanning a QR code shared with you. |
| Photo library | Picking a card photo you already took, or a photo for your own card. The app reads the image you choose and no others. |
| Contacts | Writing a card you saved into your phone's own address book, only when you tap to do it. The app does not read or upload your existing address book. |
6. What we do not do
- No advertising, and no advertising identifiers.
- No analytics, attribution or tracking kits are built into the app.
- We do not sell or share personal information for money, advertising or marketing.
- We do not track you across other companies' apps or websites.
- We do not email you anything except the sign in link you asked for and, rarely, a notice about the service itself.
7. Who else touches the data
Only the suppliers that make the app run, each handling data on our instructions: Supabase (database, authentication and file storage, United States), Anthropic (the card reading described in section 3), Cloudflare (serving the shared card pages), and Apple and Google for app distribution and, if you choose it, sign in. We hand data to no one else unless the law requires it of us.
8. Keeping it, and deleting it
- Your contacts and card images stay until you delete them or delete your account.
- Deleting a contact in the app removes its record and its images.
- You can delete your whole account from inside the app: My Card, then Delete account. It removes your card, every contact, every stored image and every share link you have handed out, immediately and for good. There is no grace period and no archived copy. Backups roll off within 30 days.
- If you would rather we did it, write to admin@system-sync.com from the address you signed up with and we action it within 30 days.
- A copy of your data, in a readable file, is available on the same request.
9. Your rights
Depending on where you live you may have the right to see the personal data we hold about you, correct it, have it deleted, or receive a copy. The app itself covers most of that: your contacts and your card are editable and deletable in the app at any time. For anything the app does not cover, write to admin@system-sync.com and we will answer within 30 days. We do not charge for this and we will not treat you differently for asking.
10. Contacts you save are other people's data
When you scan someone's card you become responsible for the personal data on it. Keep business cards for the reason they were handed to you, and delete a contact when you no longer have a reason to keep it. If someone asks you to remove their details, do it in the app; if they write to us instead, we will pass the request to the account holding it.
11. Children
Card Contacts is a business tool and is not directed at children. We do not knowingly collect data from anyone under 13. If you believe a child has created an account, write to us and we will remove it.
12. Changes to this policy
If this policy changes we update the date at the top of the page, and for a change that materially affects what we do with your data we tell you in the app before it takes effect.
13. Contact
System Sync LLC, Florida, USA
admin@system-sync.com