Privacy Policy

Last updated: October 26, 2026

cardlio is built so that your contacts stay yours. This policy describes what the app and this website do with data — which is very little, by design.

What cardlio processes on your device

Scanning, text recognition, card parsing, and organizing all run locally on your iPhone or Mac. Card images and contact details are stored on your device and in your personal iCloud (see below). We operate no servers that receive, store, or analyze your contacts.

Permissions cardlio asks for

Every one of these is requested only at the moment you use the feature it belongs to, and each can be refused without stopping the rest of the app working.

• Camera — to scan a card. Images stay on your device.
• Photos — only the images you pick to import.
• Microphone and speech recognition — for a voice note after a scan. The transcription happens on your device.
• Contacts — only when you tap Save to Contacts. cardlio does not read your address book.
• Location — only while the map is open, to show where you are among your contacts. It is never stored or sent.
• Reminders — only when you tap Add to Reminders. cardlio writes one reminder and nothing else: it does not read, edit, or delete your reminders.

Caller ID (iPhone)

If you switch it on, cardlio gives the phone numbers already in your card library to iOS so an incoming call from someone whose card you scanned shows their name. The numbers go into a system database on your iPhone. Nothing is uploaded, iOS never tells cardlio that a call happened or who called, and the app is not running when the call arrives. Numbers already saved in your Contacts always take precedence. Switching it off clears the list.

Crash reports

If cardlio crashes or freezes, the system hands the app a technical report. Those reports stay on your device — you can read them under Help, and they leave only if you choose to share or email them to us. There is no analytics service in cardlio and nothing is uploaded on its own.

iCloud sync

Your card library syncs between your devices through Apple's iCloud (CloudKit), in a private database tied to your Apple ID. Only you can access it; we cannot. Apple's own privacy terms govern iCloud.

Each card also carries a small preview image, a reduced copy of its photo made on your device, so your cards can be shown in a web browser (see “cardlio on the web” below). If you bought the unlock, the app also keeps a small “unlocked” marker in the same private database, so the web page can offer downloads. Both stay in your own iCloud; neither reaches us, and the purchase itself stays between you and Apple.

Team library

A team is optional and exists only if you create one or accept an invite. A team lives in the iCloud account of the person who created it and is shared, through Apple’s iCloud, only with the people they invite by Apple ID. A card reaches a team only when someone deliberately shares it there; the team then holds a copy of that card’s details and a reduced photo of it, visible to everyone on the team. Claiming a card records the claimer’s name on it for the team to see. We operate no server for teams and cannot see them. When the creator deletes a team, its cards and everyone’s access go with it; cards people already added to their own library stay there.

Address verification

To verify and pin addresses, the app queries Apple Maps with the address text from a card. This request goes to Apple, not to us, under Apple's privacy terms.

Optional on-device models

Two features use a model you can choose to download in Settings: meaning search for Ask your network (iPhone and Mac, about 305 MB) and the local address reader (Mac with Apple silicon, about 3.1 GB). Both run entirely on your device: your cards and your questions are never sent anywhere to use them. The only network use is the download itself, from cardlio’s release page on GitHub; like any download, GitHub sees your device’s network address, and it receives nothing about you or your cards. Each file is checked against a fingerprint built into the app before it is used. On iPhone the meaning-search download uses Wi-Fi only, unless you allow mobile data. Nothing is downloaded until you tap Download, and Delete removes the model again.

Optional cloud AI

By default, cards are read and polished entirely on your device. In Settings you may optionally choose a cloud AI provider to improve recognition of difficult cards; nothing is sent to one unless you choose it.

Apple Private Cloud Compute (iOS 27 / macOS 27, no key needed). If you choose it, the text read from a card is sent to Apple’s Private Cloud Compute to polish the name, title and company after a scan. Each scanned card’s photo is also sent once, while you review the scan, to read its address and company; you can switch this off under Settings → AI & Refine → Read the Address from the Photo (on a Mac with the downloadable local address reader installed, that reader does this on your Mac instead). The card photo is also sent when you tap Refine. Ask your network sends your question and the few cards its search found — never your whole library. These requests go to Apple, not to us; Apple states that data sent to Private Cloud Compute is used only to fulfil the request and is not stored or made accessible to Apple.

Anthropic Claude or Google Gemini, with your own API key. If — and only if — you add a key, the text of the card being processed, and its photo when you tap Refine, is sent to that provider under their terms. Company Insights sends the company’s name, its website and the contact’s job title so the provider can search the web. Who is this?, the person lookup in Company Insights, runs only when you tap it: it sends that person’s name, company, job title, the company’s website and the city, so the provider can search the web — never an e-mail address or a phone number — and nothing it finds is saved to the card unless you tap to save it. Keys are stored in your device’s Keychain.

Shared card links

When you share your own card as a link (or QR code / NFC tag), the card's data is encoded inside the link itself, in the part after the "#" that browsers do not send to web servers. Opening a card link downloads only this website's static page; the card is decoded in the recipient's browser. Nothing about your card or the recipient is transmitted to or stored by us.

Apple Wallet passes

Creating a Wallet pass sends your card's details to our pass-signing service for the duration of one request, solely to produce the signed pass file. The service stores nothing, logs nothing, and has no database. Its source code is public.

Office 365 sync

If you connect a Microsoft 365 account, cardlio can push your cards into your own Outlook contacts. This is entirely optional and off until you connect it. When you tap Sync, your card details are sent directly to Microsoft under your own account, using permissions you grant at sign-in; they are stored in your Microsoft mailbox, not on any server we operate. Sign-in uses Microsoft's standard OAuth flow, and the resulting token is kept in your device's Keychain. Disconnecting the account in Settings removes that token. We never see your Microsoft credentials or your contacts.

Company logos when importing a signature

When you import an email signature, cardlio fetches the company’s favicon from DuckDuckGo’s icon service to use as a placeholder logo. Only the company’s domain name is sent, nothing about you or the contact; the request is made only when you use the signature importer.

Checking that an email domain exists

When you review a scanned card, cardlio checks that the domain of its email address exists, so that a misread letter can be caught before the card is saved. Only the domain name — the part after the @ — is looked up, through your device’s normal internet name lookup (DNS), the same way your device looks up any website you visit. Nothing about the contact or about you is sent, and nothing reaches us.

On the Mac, File → Library → Check Email Domains does the same for your whole library at once: it looks up the company domain of each card’s email addresses (large free-mail providers are left out), and when a domain does not exist it also looks up a few likely misreadings of it, so a letter the scan got wrong can be fixed. Again only domain names are looked up, through the same system lookup; nothing else is sent, and nothing reaches us.

Checking a VAT number (EU VIES)

When a card carries an EU VAT number, the card editor offers Check in VIES. Only when you tap it, cardlio sends that number — and nothing else about the contact or about you — to the European Commission’s VAT Information Exchange System (VIES, ec.europa.eu). VIES answers whether the number is valid and, where the member state shares it, with the registered company name and address. The answer is shown to you and is not stored; nothing reaches us.

Google Contacts sync

If you connect a Google account, cardlio can write your cards into your own Google Contacts. This is entirely optional and off until you connect it. Your card details go from your device straight to Google under your own account, using permissions you grant at sign-in; they are stored in your Google account, not on any server we operate. Sign-in uses Google’s standard OAuth flow and the resulting token is kept in your device’s Keychain. Disconnecting the account in Settings removes that token, and the contacts already in your Google account stay exactly as they are.

cardlio reads back only the contacts it created itself, identified by a marker it wrote, so that syncing the same card again updates that contact instead of adding a duplicate. It does not read, store or analyse the rest of your Google Contacts, and no Google user data reaches us or any service we run. Removing a contact is limited the same way: a contact you created yourself cannot be deleted by a cardlio sync.

The card photo is never sent. Sync is one-way — cardlio to Google — and runs only when you ask for it.

The sign-in token is held in your device’s Keychain, the connection to Google uses HTTPS with TLS, and no copy of this data reaches any server we operate. See How your data is protected for the full detail.

Limited Use

cardlio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Concretely: cardlio does not transfer this data to anyone, does not use it for advertising or any form of profiling, and no human at cardlio reads it — we operate no server in the path, so it never reaches us at all.

No AI or machine-learning model is trained on, or given access to, data received from Google APIs. cardlio’s on-device text recognition reads the business cards you photograph, and never anything returned by Google. In fact the only data cardlio receives back from Google is the identifier and change-tag of contacts cardlio itself created, plus the email address of the connected account so the settings screen can show which account is in use; your other contacts’ names, numbers, addresses and photos are never requested and never received.

How your data is protected

Contact details are sensitive, and cardlio’s main protection is structural: we operate no server that receives them. There is no cardlio account, no cardlio database and no cardlio backup of your contacts, so there is no copy of your data for us to lose, sell or be compelled to hand over. Everything below describes how the data is protected on the paths it does travel.

Encryption in transit. Every network request cardlio makes uses HTTPS with TLS, enforced by Apple’s App Transport Security — the app declares no exemptions, so plain HTTP connections are refused by the operating system rather than merely discouraged. Webhook destinations you enter are additionally restricted to https:// addresses in the app’s own code, and an http:// address is rejected outright.

Encryption at rest. Card data lives in the app’s own container on your device, protected by the operating system’s file protection and by whatever device encryption you have enabled (Data Protection on iPhone, FileVault on Mac). Anything secret — your Google and Microsoft sign-in tokens, and any AI API key you choose to add — is stored in the system Keychain, never in ordinary files, never in preferences and never in our source. Keychain items are marked so they are unavailable until the device has been unlocked at least once after restart.

Access control. When iCloud sync is on, your cards are mirrored into the private CloudKit database of your own Apple ID. A private database is readable only by the account that owns it: not by other cardlio users, and not by us — we have no administrative console, no credentials and no technical means to read it. Data you sync to Google or Microsoft is likewise held in your own account, under permissions you granted and can revoke.

Data minimisation. cardlio asks third-party services for as little as it can. From the Google People API it requests only contact metadata — resource identifiers and change-tags — plus its own marker on contacts it created, and the email address of the connected account so the settings screen can show which one is in use. Your other contacts are never requested and never received. Card photographs are never sent to Google, Microsoft or a webhook.

Retention and deletion. Because we store nothing, deletion is immediate and in your hands. Deleting a card removes it from the device and, through iCloud, from your other devices. Disconnecting a Google or Microsoft account deletes the stored token from the Keychain. Removing a webhook address removes it from the device. Contacts already written into your Google or Microsoft account remain yours and are unaffected — cardlio will not delete them.

No third parties in the path. cardlio contains no analytics, advertising, tracking or crash-reporting SDKs of any kind. Diagnostic reports are written to a local file, are never uploaded automatically, and leave the device only if you choose to share them with us. No human at cardlio reads your contacts, and no AI or machine-learning model is trained on them.

Optional features are off until you turn them on. Google sync, Microsoft 365 sync, webhooks and cloud AI refinement each require an explicit action from you, and each can be switched off again, which stops the corresponding data flow immediately.

If you believe you have found a security problem in cardlio, please write to support@cardlio.app and we will respond.

Webhooks (CRM & automation)

You can give cardlio a web address of your choosing — a Zapier or Make catch-hook, or your own server — and each card you save is then posted to it as JSON so it can reach a CRM. This is off until you turn it on, and there is no default or suggested destination: the address is one you enter.

While it is on, the card’s fields leave your device and go to that address, and what happens next is governed by whoever operates it, not by us — we never see it and operate no server in the path. The card photo is never sent. The “Send test” button posts a made-up contact rather than one of yours, so you can set up a workflow without sending anyone’s real details. Turning the switch off stops it immediately; clearing the address removes it from the device.

Treat the address as a secret: services like Zapier put a token in the URL, which is why cardlio accepts https:// addresses only.

This website

cardlio.app uses no cookies, no analytics, and no tracking of any kind. It is a static site.

cardlio on the web (team.cardlio.app)

team.cardlio.app shows your own cards (“My cards”) and your teams in a browser. It is a static page with no server of ours behind it: after you sign in with your Apple ID in Apple’s own sign-in window, your browser talks directly to Apple’s iCloud, under Apple’s privacy terms. We never see your Apple ID, your password, your cards or your teams. Under My cards, the page reads your cardlio library from your private iCloud database: the card details, the small preview images, and the unlocked marker. There it can change some details of a card you already have — the lead rating, the event, the notes, the interests, the title, company, industry, website, LinkedIn and WeChat, whether you owe a follow-up or have done it, “I was in touch”, and how often to keep in touch — and each change goes straight to your iCloud, as an edit in the app would. Names, phone numbers, e-mail addresses, the postal address and photos are changed only in the app. A follow-up email opens in your own mail program, and a reminder is a calendar file your browser saves; neither passes through us. It cannot add or delete your own cards or change anything else on them. In your teams, the changes it can make are joining a team whose owner invited your Apple ID, marking a card as claimed (and taking that mark back on a card you claimed yourself), adding a card you type in, import from a vCard file or copy from your own cards (without its photo), editing a team card’s details, and deleting a team card (the team’s creator can delete any card, a member only one they added) — all of which go straight to the team’s shared area in iCloud, as they would from the app. Three optional functions talk to a third party, all only with your own Anthropic or Google API key: a photo of a card you choose to read is sent to Anthropic (Claude) or Google (Gemini) under that key, and the fields come back for you to check; and when you press Draft with AI on a follow-up email, that person’s name, title, company, city, event, interests and your notes on the card are sent the same way, and the draft comes back for you to edit; and when you press Talking points on a card’s brief, the company, its website and industry, the person’s title, the place, the event, the interests and your notes on the card are sent the same way — never the person’s name — and the provider may search the web for the company’s recent news. All three are calls under those providers’ own terms, like the app’s “Refine with Claude / Gemini”. Nothing is sent without a key you entered and a button you pressed; the key stays in your browser, never in iCloud or with us, and you can forget it there at any time. The Map view under My cards uses Apple Maps (MapKit JS), loaded from Apple only when you open it: the cards are pinned at the location the app already found for their address, and the pins are drawn in your browser, so Apple receives the map tiles you look at, not your cards or their addresses. Your browser keeps Apple’s sign-in so you stay signed in, and remembers the name you claim cards under (it also signs a drafted email); signing out or clearing the site’s data removes both. It uses no analytics and no tracking, and it loads code only from this site and from Apple.

What we collect

Nothing. cardlio has no accounts, no sign-up, and no telemetry. If you email support, we see what you send us and use it only to help you.

Changes

If this policy changes, the new version will be published here with an updated date.

Contact

Questions about privacy: support@cardlio.app