Privacy policy

ContactsLuX ("we", "us") is a contacts app made by JBL Group, LLC, on the web and as a phone app for iPhone and Android. This policy explains what we collect, why, where it is kept, and the choices you have. We do not sell your data, we do not use it for advertising, we do not track you across other apps or websites, and we never contact the people in your address book.

What we collect

• Your account: email address, optional name, time zone, and a one-way hash of your password (we never store the password itself). If you use passkeys on the web we store only the public key.
• Your contacts: the people you add in the app, import from a file, or keep in a connected account. When you connect iCloud (with an app-specific password you create at Apple), we read and — only when you tap to change something — update your iCloud contacts. We keep a copy in our database so the app is fast and so you can undo changes. Your app-specific password is stored encrypted.
• Your phone's contacts (phone app): read only when you tap "Import from this phone", after you allow it in the phone's own permission prompt. We copy names, companies, job titles, birthdays, phone numbers, email addresses, websites and postal addresses (and notes on Android) into your ContactsLuX list. Photos are not read. The app never reads your phone's contacts in the background and never uploads them without that tap. You can withdraw the permission at any time in the phone's Settings.
• What you add in the app: notes, call/meeting logs, reminders, tags, gift ideas, introductions, saved views, business-card photos, and items you import from contacts files (vCard/CSV, also when shared to the phone app), WhatsApp chat exports or LinkedIn files. WhatsApp chat text is read on your device and only the dates (and, if you ask, a short summary) are kept.
• Google (only if you connect it): [Google Contacts sync, and Gmail & Calendar, are switched off until Google approves the app.] If enabled, we use Google user data only to show and update your Google Contacts and, if you choose, to show your email and meeting history with people already in your contacts. We store only email metadata (date, subject, a short preview, addresses) — never full email bodies. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• Notifications: if you turn on the morning reminder, we keep a device identifier for notifications (a push token from Firebase Cloud Messaging in the phone app, or your browser's push subscription on the web), stored encrypted, plus the device type and when it was added. Turning reminders off or signing out removes it.
• Purchases: on the web, payments are handled by Stripe; in the phone app, by Apple (App Store) or Google (Google Play) through RevenueCat. We receive your subscription status, product, store and renewal/expiry dates — never your card number. Your phone app purchases are linked to your account through a random identifier, not your email.
• Technical data: sign-in records (time, IP address, device type) to protect your account and stop abuse; error logs.

What stays on your phone

• Face ID / Touch ID / fingerprint lock: the check is done by your phone. We never receive your face or fingerprint data; the on/off setting is kept only on that phone.
• App switcher privacy: the phone app hides its content in the app switcher (on iPhone always, on Android while the lock is on — there it also blocks screenshots).
• Lock-screen privacy: by default, reminders in the phone app say things like "You have 2 birthdays today" without names. You can turn names on or off in Settings → Morning reminder (for all your devices).

How we use it

Only to run the app for you: sync and clean up your contacts, show your history with people, remind you, process your subscription, keep your account secure and answer your requests. Nothing is deleted, merged or sent without your tap. We do not use your data to train AI models and we do not build advertising profiles.

AI features

When you use card reading, "Screenshot + voice", the assistant, message drafts or summaries, the relevant text, photo or screenshot (and what you dictated, as text) is sent to our AI provider [Google Gemini API] to produce the answer. Nothing is sent until you tap Allow on the "Use AI features?" prompt the first time; you can turn it off again in Settings → Account → AI features. Photos and screenshots are read and not kept. We send only what that request needs, we ask the provider not to use it for training [confirm the provider's paid-tier terms], and AI use is limited per account.

Who processes data for us

These companies act on our instructions only, to provide the parts of the service listed:

• Vercel — hosting of the website and the app's server.
• Neon — the database.
• Google (Gemini API) — AI features, only for requests you make. [And Google sign-in / APIs if enabled.]
• Google Firebase Cloud Messaging (and, for iPhones, Apple Push Notification service) — delivering reminders to the phone app: the device token and the reminder text.
• RevenueCat — App Store / Google Play subscription status, linked to a random identifier.
• Apple and Google — payment for subscriptions bought in the phone app (their own privacy policies apply to the purchase).
• Stripe — payment for subscriptions bought on the website.
• Resend — sending account emails (sign-in links, password resets, verification) [once email is turned on].

When you open the map, only place names (city, region, country — never names or street addresses of your contacts) are looked up with OpenStreetMap's Nominatim service; map tiles come from OpenStreetMap.

Where and how long

Data is stored in [the United States]. It is encrypted in transit; stored passwords and device tokens are additionally encrypted per account. We keep your data while your account exists. Automatic backups of your contacts are kept for up to 30 days. Removed card photos are deleted after 30 days. [Server logs are kept for up to __ days.]

Your choices and rights

• Export: Settings → Account → Export my data (everything as JSON, including your plan and subscription status; contacts as vCard).
• Delete: Settings → Account → Delete my account — on the website and in the phone app — removes everything we hold about you right away, including notification devices and our record at RevenueCat (your own iCloud/Google contacts and your phone's address book are not touched). A subscription bought in the App Store or Google Play must also be cancelled there, because only you can cancel it.
• Disconnect: remove iCloud or Google access in Settings at any time; revoke the app-specific password at Apple; withdraw the contacts or notification permission in your phone's Settings.
• Depending on where you live (for example the EU/UK under the GDPR, or California under the CCPA/CPRA) you may have further rights to access, correct, port or object. Write to privacy@contactslux.com. [Name an EU/UK representative if required.]

Children

ContactsLuX is not meant for children under [13 / 16] and we do not knowingly collect their data.

Cookies

We use one essential cookie to keep you signed in (on the website and inside the phone app). No advertising or tracking cookies, no third-party analytics.

Changes and contact

We will tell you in the app before material changes take effect. Questions: privacy@contactslux.com. JBL Group, LLC, [postal address].