Last updated: 18 August 2026
DigiCard is a business card you hand to people. A card is therefore meant to be readable by whoever you give it to — that is the product, not a leak. Everything built on top of a card is the opposite: your contacts list, your private notes and your conversations are visible only to you.
There are no ads, no analytics, no crash reporting and no third-party tracking SDKs of any kind. Nothing about you is sold, shared or profiled.
There are two ways in, and they collect different amounts.
Either way, Firebase Authentication issues a user ID. Your name and photo, if there is one, are used to pre-fill the card editor when you make your first card, and are written to a profile document so that someone you are chatting with can see who they are talking to.
| What | Where | Who can read it |
|---|---|---|
| Your cards — name, job title, company, tagline, phone, email, website, address, social handles, layout and colour | cards/{cardId} | Anyone with the link. See below. |
| Your profile — display name, photo URL, email | users/{yourId} | Any signed-in DigiCard user |
| Your contacts and your private notes about them | users/{yourId}/connections | Only you. Not even the person the note is about. |
| Messages | chats/{chatId}/messages | Only the two people in that conversation |
| Which card you are currently sharing, and your NFC toggle | Your phone only | Only you — this never leaves the device |
A card link has to open for someone who does not have DigiCard and is not signed in. That is the entire point of putting it on a QR code or an NFC sticker. So a card can be read by anyone who has its address. What protects it is the address itself: card IDs are 20 random characters, so a card is unguessable rather than secret — the same security model as a paper card you hand out. Do not put anything on a card that you would not hand to a stranger.
Card links are also not indexed by search engines: the public renderer sends noindex for every card page.
Saving someone's card writes only into your contacts list. Nobody can add themselves to your list, and nobody can add you to theirs without you handing them a card first. This is enforced by the database's security rules, not just by the app.
DigiCard uses Google Cloud Firestore and Firebase Authentication. Data is encrypted in transit (TLS) and at rest by Google, and is processed under Google Cloud's privacy notice. The developer can technically access the database as its owner but does not read user cards, notes or messages.
In the app: Settings → Delete account and data. This immediately and permanently deletes every card you have made, your contacts list, your private notes, your profile and your DigiCard sign-in. Cards you have handed out stop working for the people holding them.
Messages you have already sent stay in the other person's conversation, in the same way a sent email stays in the recipient's inbox. Once your profile is deleted those messages no longer carry your name, email or photo — only an account ID that no longer resolves to anyone.
If you cannot reach the app, request deletion at digicard-370bc.web.app/delete-account.
DigiCard is intended for working adults and is not directed at children under 13.
If this policy changes in a way that affects what is collected or who can read it, the date at the top changes and the new version is published here before the change ships.