ExpoCards privacy
Last updated: 23 September 2026
ExpoCards turns a photograph of a business card into a contact you can review, correct and export. This page explains what the app does with that data.
What is stored, and where
- Contacts and card photos are stored on your device, in the app's own storage. They are not uploaded to us for storage, and we keep no copy of them.
- Your settings — app name, logo, accent colour and event tag — are stored on your device in the same way.
- There is no sign-in and nothing to register: we never ask for your name, email or a password. There are no analytics, advertising or tracking of any kind.
What leaves your device
- When you scan a card, the photo is sent over an encrypted connection to our scanning service, which passes it to Anthropic's Claude API to read the text. The details it reads are returned to your device. Our service does not store the photo or the details: once the response has been sent, it no longer has them.
- Anthropic processes the image to produce the response. Under its published data-retention policy Anthropic deletes inputs and outputs within 30 days — or later if its safety systems flag a request, or the law requires it — and by default does not use them to train its models. See Anthropic's privacy policy for details of their handling.
- The app generates a random id at first launch. It is sent with each scan, and when the app starts or you open Settings, so the app can show how many scans you have left. Our server keeps a count of scans against that id, so the monthly allowance and anything added to it can be honoured. The id is not derived from your device or your identity, and is erased from the device by "Erase all data".
- Like any internet service, our server and its hosting provider see the IP address a request comes from, and the provider keeps standard request logs for a limited time. We use the address only to limit abuse: a counter per address is kept for a couple of minutes, and, while a launch gift of scans is running, a count per network for up to two days. We do not use it to locate you and we do not share it.
- Nothing else is sent to us. Viewing, editing, searching and exporting your contacts all happen entirely on the device and work with no connection.
- If you have device backups switched on — iCloud on an iPhone, Google backup on Android — the app's data may be included in your own backup. That is between you and Apple or Google; we never see it.
Who processes data for us
Vercel hosts the scanning service. Upstash stores the scan counters. Anthropic reads the card photo. Stripe handles payments in the web version. None of them receives your contact list, and none of them is given anything for advertising or profiling.
Payments
Purchases are available in the web version only. If you buy scans or an event pass there, the payment is processed by Stripe on Stripe's own pages. Your card details never pass through this app or its servers. The only thing recorded on our side is what you bought and the app's anonymous account id it belongs to, so your purchase can be honoured.
Optional team sync
If — and only if — you enter your own Supabase project URL and key in Settings and switch sync on, your contacts are also copied to that Supabase project. That project is yours: we have no access to it, and the app never contacts it while sync is switched off.
Exporting and deleting
- You can export your contacts at any time as a vCard, CSV or Excel file, or download a full JSON backup, and take that data elsewhere.
- Deleting a contact removes it, and its photo, from the device. "Erase all data" in Settings removes everything the app holds on the device, including the random id.
- The scan count our server holds against that id stays behind: the monthly count expires by itself after about 45 days, and scans added to an id are kept so they can be honoured. To have the server-side record deleted, copy the id first (Settings, About, tap to copy) and email it to us.
- Removing the app deletes its local storage along with it.
Other people's data
The details on a business card belong to the person who gave it to you. You are responsible for handling them lawfully — including under the GDPR or any other rules that apply to you — and for honouring any request from that person to see or delete what you hold.
Children
ExpoCards is a business tool and is not directed at children.
Who we are, and contact
This app is published by Adam Michel Monir Hakim Ayad, an individual developer based in the United Kingdom, who is the data controller for what is described here. Questions about this policy, or requests about your data: help@expocards.app. We reply within one business day.