Privacy Policy

Last updated: September 18, 2026

cardlio is built so that your contacts stay yours. This policy describes what the app and this website do with data — which is very little, by design.

What cardlio processes on your device

Scanning, text recognition, card parsing, and organizing all run locally on your iPhone or Mac. Card images and contact details are stored on your device and in your personal iCloud (see below). We operate no servers that receive, store, or analyze your contacts.

Permissions cardlio asks for

Every one of these is requested only at the moment you use the feature it belongs to, and each can be refused without stopping the rest of the app working.

• Camera — to scan a card. Images stay on your device.
• Photos — only the images you pick to import.
• Microphone and speech recognition — for a voice note after a scan. The transcription happens on your device.
• Contacts — only when you tap Save to Contacts. cardlio does not read your address book.
• Location — only while the map is open, to show where you are among your contacts. It is never stored or sent.
• Reminders — only when you tap Add to Reminders. cardlio writes one reminder and nothing else: it does not read, edit, or delete your reminders.

Caller ID (iPhone)

If you switch it on, cardlio gives the phone numbers already in your card library to iOS so an incoming call from someone whose card you scanned shows their name. The numbers go into a system database on your iPhone. Nothing is uploaded, iOS never tells cardlio that a call happened or who called, and the app is not running when the call arrives. Numbers already saved in your Contacts always take precedence. Switching it off clears the list.

Crash reports

If cardlio crashes or freezes, the system hands the app a technical report. Those reports stay on your device — you can read them under Help, and they leave only if you choose to share or email them to us. There is no analytics service in cardlio and nothing is uploaded on its own.

iCloud sync

Your card library syncs between your devices through Apple's iCloud (CloudKit), in a private database tied to your Apple ID. Only you can access it; we cannot. Apple's own privacy terms govern iCloud.

Team library

A team is optional and exists only if you create one or accept an invite. A team lives in the iCloud account of the person who created it and is shared, through Apple’s iCloud, only with the people they invite by Apple ID. A card reaches a team only when someone deliberately shares it there; the team then holds a copy of that card’s details and a reduced photo of it, visible to everyone on the team. Claiming a card records the claimer’s name on it for the team to see. We operate no server for teams and cannot see them. When the creator deletes a team, its cards and everyone’s access go with it; cards people already added to their own library stay there.

Address verification

To verify and pin addresses, the app queries Apple Maps with the address text from a card. This request goes to Apple, not to us, under Apple's privacy terms.

Optional cloud AI

You may optionally add your own API key for a third-party AI provider (Anthropic Claude or Google Gemini) to improve recognition of difficult cards. If — and only if — you do, the text of the card being processed is sent to that provider under their terms. Keys are stored in your device's Keychain. Without a key, no card data ever leaves your device for AI processing.

Shared card links

When you share your own card as a link (or QR code / NFC tag), the card's data is encoded inside the link itself, in the part after the "#" that browsers do not send to web servers. Opening a card link downloads only this website's static page; the card is decoded in the recipient's browser. Nothing about your card or the recipient is transmitted to or stored by us.

Apple Wallet passes

Creating a Wallet pass sends your card's details to our pass-signing service for the duration of one request, solely to produce the signed pass file. The service stores nothing, logs nothing, and has no database. Its source code is public.

Office 365 sync

If you connect a Microsoft 365 account, cardlio can push your cards into your own Outlook contacts. This is entirely optional and off until you connect it. When you tap Sync, your card details are sent directly to Microsoft under your own account, using permissions you grant at sign-in; they are stored in your Microsoft mailbox, not on any server we operate. Sign-in uses Microsoft's standard OAuth flow, and the resulting token is kept in your device's Keychain. Disconnecting the account in Settings removes that token. We never see your Microsoft credentials or your contacts.

Company logos when importing a signature

When you import an email signature, cardlio fetches the company’s favicon from DuckDuckGo’s icon service to use as a placeholder logo. Only the company’s domain name is sent, nothing about you or the contact; the request is made only when you use the signature importer.

Google Contacts sync

If you connect a Google account, cardlio can write your cards into your own Google Contacts. This is entirely optional and off until you connect it. Your card details go from your device straight to Google under your own account, using permissions you grant at sign-in; they are stored in your Google account, not on any server we operate. Sign-in uses Google’s standard OAuth flow and the resulting token is kept in your device’s Keychain. Disconnecting the account in Settings removes that token, and the contacts already in your Google account stay exactly as they are.

cardlio reads back only the contacts it created itself, identified by a marker it wrote, so that syncing the same card again updates that contact instead of adding a duplicate. It does not read, store or analyse the rest of your Google Contacts, and no Google user data reaches us or any service we run. Removing a contact is limited the same way: a contact you created yourself cannot be deleted by a cardlio sync.

The card photo is never sent. Sync is one-way — cardlio to Google — and runs only when you ask for it.

The sign-in token is held in your device’s Keychain, the connection to Google uses HTTPS with TLS, and no copy of this data reaches any server we operate. See How your data is protected for the full detail.

Limited Use

cardlio’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Concretely: cardlio does not transfer this data to anyone, does not use it for advertising or any form of profiling, and no human at cardlio reads it — we operate no server in the path, so it never reaches us at all.

No AI or machine-learning model is trained on, or given access to, data received from Google APIs. cardlio’s on-device text recognition reads the business cards you photograph, and never anything returned by Google. In fact the only data cardlio receives back from Google is the identifier and change-tag of contacts cardlio itself created, plus the email address of the connected account so the settings screen can show which account is in use; your other contacts’ names, numbers, addresses and photos are never requested and never received.

How your data is protected

Contact details are sensitive, and cardlio’s main protection is structural: we operate no server that receives them. There is no cardlio account, no cardlio database and no cardlio backup of your contacts, so there is no copy of your data for us to lose, sell or be compelled to hand over. Everything below describes how the data is protected on the paths it does travel.

Encryption in transit. Every network request cardlio makes uses HTTPS with TLS, enforced by Apple’s App Transport Security — the app declares no exemptions, so plain HTTP connections are refused by the operating system rather than merely discouraged. Webhook destinations you enter are additionally restricted to https:// addresses in the app’s own code, and an http:// address is rejected outright.

Encryption at rest. Card data lives in the app’s own container on your device, protected by the operating system’s file protection and by whatever device encryption you have enabled (Data Protection on iPhone, FileVault on Mac). Anything secret — your Google and Microsoft sign-in tokens, and any AI API key you choose to add — is stored in the system Keychain, never in ordinary files, never in preferences and never in our source. Keychain items are marked so they are unavailable until the device has been unlocked at least once after restart.

Access control. When iCloud sync is on, your cards are mirrored into the private CloudKit database of your own Apple ID. A private database is readable only by the account that owns it: not by other cardlio users, and not by us — we have no administrative console, no credentials and no technical means to read it. Data you sync to Google or Microsoft is likewise held in your own account, under permissions you granted and can revoke.

Data minimisation. cardlio asks third-party services for as little as it can. From the Google People API it requests only contact metadata — resource identifiers and change-tags — plus its own marker on contacts it created, and the email address of the connected account so the settings screen can show which one is in use. Your other contacts are never requested and never received. Card photographs are never sent to Google, Microsoft or a webhook.

Retention and deletion. Because we store nothing, deletion is immediate and in your hands. Deleting a card removes it from the device and, through iCloud, from your other devices. Disconnecting a Google or Microsoft account deletes the stored token from the Keychain. Removing a webhook address removes it from the device. Contacts already written into your Google or Microsoft account remain yours and are unaffected — cardlio will not delete them.

No third parties in the path. cardlio contains no analytics, advertising, tracking or crash-reporting SDKs of any kind. Diagnostic reports are written to a local file, are never uploaded automatically, and leave the device only if you choose to share them with us. No human at cardlio reads your contacts, and no AI or machine-learning model is trained on them.

Optional features are off until you turn them on. Google sync, Microsoft 365 sync, webhooks and cloud AI refinement each require an explicit action from you, and each can be switched off again, which stops the corresponding data flow immediately.

If you believe you have found a security problem in cardlio, please write to support@cardlio.app and we will respond.

Webhooks (CRM & automation)

You can give cardlio a web address of your choosing — a Zapier or Make catch-hook, or your own server — and each card you save is then posted to it as JSON so it can reach a CRM. This is off until you turn it on, and there is no default or suggested destination: the address is one you enter.

While it is on, the card’s fields leave your device and go to that address, and what happens next is governed by whoever operates it, not by us — we never see it and operate no server in the path. The card photo is never sent. The “Send test” button posts a made-up contact rather than one of yours, so you can set up a workflow without sending anyone’s real details. Turning the switch off stops it immediately; clearing the address removes it from the device.

Treat the address as a secret: services like Zapier put a token in the URL, which is why cardlio accepts https:// addresses only.

This website

cardlio.app uses no cookies, no analytics, and no tracking of any kind. It is a static site.

The team library on the web (team.cardlio.app)

team.cardlio.app shows your teams in a browser. It is a static page with no server of ours behind it: after you sign in with your Apple ID in Apple’s own sign-in window, your browser talks directly to Apple’s iCloud, under Apple’s privacy terms. We never see your Apple ID, your password, or your teams. The page reads only your teams, not the rest of your cardlio library. The only changes it can make are joining a team whose owner invited your Apple ID, and marking a card as claimed. Your browser keeps Apple’s sign-in so you stay signed in, and remembers the name you claim cards under; signing out or clearing the site’s data removes both. It uses no analytics and no tracking, and it loads code only from this site and from Apple.

What we collect

Nothing. cardlio has no accounts, no sign-up, and no telemetry. If you email support, we see what you send us and use it only to help you.

Changes

If this policy changes, the new version will be published here with an updated date.

Contact

Questions about privacy: support@cardlio.app