Privacy Policy

Cardenius is an AI-powered business card scanner and contact management application for Android and iOS, developed and operated by Milan Nai ("we", "us", "our"). Our registered base of operations is Ahmedabad, Gujarat, India; the App is available to users worldwide.

This Privacy Policy explains how we collect, use, and protect information when you use the Cardenius mobile application ("the App"). By using the App, you agree to the practices described here.

Information you provide directly

Information collected automatically

Optional features (only if you enable them)

• Cloud backup — if you enable backup, your encrypted contact database is uploaded to your chosen provider (Google Drive, Dropbox, or Firebase Storage). It is encrypted on your device before upload.
• Phone contacts import — if you grant contacts permission, Cardenius reads your phone's address book to import contacts. This data is processed locally and not sent to our servers.
• Google Contacts import — if you enable this feature, Cardenius uses the contacts.readonly Google API scope to read your Google contacts and display them in the import picker. Selected contacts are saved to your device's local SQLite database only. See Section 12 for our Limited Use commitment.
• Location — the Map view uses your device location (if granted) to show contacts on a map. Location data is not stored or transmitted.

Advertising attribution (Meta, Android only)

On Android, Cardenius includes the Meta App Events SDK, provided by Meta Platforms, Inc. We use it for one purpose: to measure how many people install the app after seeing one of our advertisements, so we can tell which advertising is worth paying for.

When you open the app on an Android device, this SDK sends Meta a record that the app was launched, together with your device's advertising identifier (Google Advertising ID), your device and operating-system details, and the Google Play install referrer. Meta uses this to match the install to an advertisement and, in line with its own terms, for its advertising and analytics purposes. This means the data is shared with a third party.

We do not send Meta your name, phone number, email address, contacts, scanned business cards, card images, or the contents of anything you scan or save. Automatic event logging is disabled in the app, and we do not send Meta any purchase or subscription events.

On iOS, automatic event logging and advertising-identifier collection are switched off, and the app does not send any events to Meta.

You can limit this on Android through your device settings: Settings > Privacy > Ads, where you can delete or opt out of your advertising ID. Meta's own handling of this data is described in the Meta Privacy Policy.

Camera and microphone

The App requests camera permission to photograph business cards for scanning. No images are transmitted to our servers. Images shared with the Google Gemini Vision API for AI extraction are governed by Google's Privacy Policy.

• Provide and operate the App's features
• Authenticate your account via phone OTP
• Sync your subscription/tier status so premium features work across reinstalls
• Detect and fix crashes via Crashlytics
• Understand feature usage to prioritise improvements via Analytics
• Serve non-personalised ads to free-tier users via AdMob
• Send push notifications for reminders and daily digests (only if you grant notification permission)

We do not use your data for profiling, targeted advertising beyond AdMob's standard serving, or any automated decision-making that produces legal effects.

We do not sell your personal data. We share data only in these limited circumstances:

• Google (Firebase, Gemini, Cloud Vision, Maps, AdMob) — necessary to operate core features. See Section 8 for details.
• Your chosen backup provider — if you enable cloud backup, your encrypted backup is sent to Google Drive, Dropbox, or Firebase Storage using your own account credentials. We act only as a conduit; the data is encrypted before it leaves your device.
• Legal requirements — if required by law, court order, or to protect the rights and safety of users.

All contact data, card images, and personal card designs are stored in your device's private app storage (SQLite database and local file system). This data is not accessible to other apps.

Cloud backups are encrypted before leaving your device.

Authentication data (phone number, tier status) is stored in Firebase with access restricted by Firestore security rules — only you can read or write your own document.

• Local data — retained on your device until you uninstall the app or clear app data.
• Firebase Auth record — retained until you request account deletion.
• Firestore user document — retained until you request deletion.
• Crashlytics and Analytics data — retained for 90 days per Google's default retention settings.
• Cloud backups — stored in your own cloud storage account; you control retention.

You have the following rights regarding your personal data:

• Access — you can export your saved contacts as CSV, Excel or vCard.
• Correction — you can edit any contact directly in the App.
• Deletion — you can delete individual contacts or all data via Settings → Delete account. Deleting the app or clearing app data removes all local data immediately.
• Account deletion — to delete your Firebase Auth record and Firestore data, email us at privacy@cardenius.com with the subject "Delete my account". We will process requests within 30 days.
• Portability — export your saved contacts in standard formats (CSV, Excel, vCard).
• Opt out of Analytics — you can disable analytics collection from Settings → Privacy (coming in a future update).

If you are in the European Economic Area or United Kingdom, you have additional rights under GDPR/UK GDPR including the right to lodge a complaint with your local supervisory authority.

Cardenius is designed for working professionals and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us at privacy@cardenius.com and we will delete it promptly.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the App. Your continued use of the App after the effective date constitutes acceptance of the updated policy.

For privacy-related questions, data deletion requests, or any concerns about this policy: