Privacy policy

identro is a digital business card service operated by Ibrahim Chiha, who is the data controller for the information described here. This policy explains what we collect, why, and the choices you have. The short version: we store the information you put on your cards so we can show it to the people you choose to share it with, and we do not sell your data or use it for advertising.

What we collect

• Account data:when you sign in with Apple we receive a stable account identifier and, if you approve it, your name and email address. We also keep, encrypted, a token Apple issues at sign-in, used only to withdraw identro's access to your Apple account when you delete your identro account.
• Card content:the details you add to a card (name, role, company, country, phone, WhatsApp number, email, website, social handles, extra links, brand colour, photo, and logo). This content exists to be shared: anyone with your card link or QR code can see it while your card is live, and your Apple Wallet pass contains it too. If you use identro on Apple Watch, your iPhone sends your cards' QR codes directly to your watch.
• Exchanged contacts and connections:when someone fills the "share your details back" form on your card, we store what they submitted so we can show it to you; it stays with your account even if you later delete the card that collected it. When you add another identro card as a connection, we store that link.
• Contacts you capture: the scanner reads business cards, badges, and QR codes with your camera. The camera is used only while the scanner is open, recognition happens on your iPhone, and the image is never uploaded. We store only the details you review and save (such as name, role, company, email, phone, and website).
• Your notes: notes, tags, and follow-up dates you add to your contacts. They are visible only to you; follow-up reminders are scheduled on your device.
• Notifications:if you turn on notifications, we store your device's push token to alert you when someone shares their details with you. It is removed when you sign out.
• Usage counters: per-card counts of page views, contact saves, exchanges, and Wallet-pass downloads. These are aggregate numbers; we do not build profiles of the people who view your card.
• App analytics:the iOS app sends usage events to Google Analytics for Firebase so we can understand which features are used and where the app falls short — things like screens viewed, cards created, tags written, and purchase steps completed — along with a per-install identifier, your account identifier, and basic device information. These events are never used for advertising, and the app does not access your device's advertising identifier. If the app crashes, Firebase Crashlytics receives a crash report (what went wrong, device model, and system version) that is not linked to your account.
• Technical data: to keep the service running and secure we process basic technical information such as IP address and request details, used for security, abuse prevention, and rate limiting, and kept only briefly.
• Subscription state:your purchase is processed by Apple, and RevenueCat manages the subscription on our behalf using Apple's purchase records and your account identifier. We store only your entitlement status and its expiry date. We never see your card or payment details.

Why we use it, and our legal bases

We use your information to provide identro and the features you ask for (to perform our contract with you), to keep the service secure and prevent abuse (our legitimate interest), to understand how the app is used so we can improve it (our legitimate interest), to process your subscription through Apple (to perform our contract), and to answer your support messages. Where the law requires consent, such as for optional data you choose to add, we rely on that consent, which you can withdraw at any time by editing or deleting the data.

The living address book

If you enable contact sync, we generate a separate CardDAV password for each device you set up, and keep its name (such as "iPhone"), when it was added, and when it last synced, so you can remove any one of them. Your device then fetches your identro contacts directly from our server over an encrypted connection. Contacts you receive are visible only to you.

When you receive someone's details

Contact details other people share with you through identro are provided to you by them. Once you receive them, you decide how they are used, and for that use you act as their controller under any privacy law that applies to you. Please treat them lawfully and respect requests to stop.

Sharing

We share data only with the service providers that run identro: our cloud hosting provider (Google Cloud, for the website, API, and database), Google Analytics for Firebase and Firebase Crashlytics (which process the app-usage events and crash reports described above on our behalf), Apple (for sign-in, payments, and notifications), RevenueCat (which manages subscriptions), and Google Fonts (which supplies typefaces for the characters in your card's text when we render an image of it, such as your video-call background). Each receives only what it needs to operate, under contract. We do not sell personal data, we do not use it for advertising, and we disclose it to authorities only when legally required.

Where your data is stored

Your data is hosted on Google Cloud infrastructure in the European Union. If you use identro from outside that region, your information is transferred to and stored there, protected by the safeguards our providers offer. App analytics events are processed by Google and may be stored in other regions under Google's data-transfer safeguards, including standard contractual clauses.

Security

We protect your data with encryption in transit, access controls, and reputable infrastructure. No online service can be perfectly secure, but we take reasonable steps to safeguard your information and to limit who can access it.

Cookies and local storage

The app and website use only the storage needed to keep you signed in and to remember basic preferences, such as which feature requests you have voted for on the roadmap. We do not use advertising or cross-site tracking cookies.

Retention and deletion

We keep your data while your account exists. Deleting your account (Settings, then Delete account, in the app) permanently removes your cards, photos, logos, contacts (including the ones you captured), notes, connections, contact-sync passwords, notification tokens, and usage counters, with residual copies purged from routine backups within a short period. Technical logs are kept only briefly. If your subscription lapses, your cards are paused but not deleted, so everything returns if you resubscribe. App analytics data is retained by Google Analytics for at most 14 months and is kept separate from your cards and contacts.

Your rights

You can access, correct, or delete your data at any time in the app. Depending on where you live, you may also have the right to export your data, to object to or restrict certain processing, and to withdraw consent. To make any of these requests, contact us at support@identro.app and we will respond within 30 days. If you are in the EU or UK and believe we have mishandled your data, you may also complain to your local data protection authority.

Children

identro is not directed to children. You must be at least 16, or the age of digital consent where you live, to use it. We do not knowingly collect data from children below that age.

Changes

If we make material changes to this policy we will update this page and the date above, and notify you where appropriate.

Contact

The data controller is Ibrahim Chiha. For any privacy question or request, reach us at support@identro.app.