We know you might not read every word of a privacy policy. Here’s the whole story in two lists. Every item is a structural property of how ChromaCard is built — not a policy promise we could walk back.

Back to Contents

2.1  Data You Create (Stored Locally Only)

When you build a ChromaCard, you enter contact information such as your name, phone number, email address, company, job title, and website URL. You may also upload a profile photo, logo, or background image. All of this data is stored exclusively on your device using your operating system’s native local storage. It never leaves your phone unless you deliberately share a card via QR code, text message, email, or other sharing methods of your choosing.

2.2  Photos & Images

EXIF metadata is stripped at upload time. When you add any photo to your card — background, logo, or profile photo — ChromaCard automatically removes all embedded metadata from the image file before saving it. This includes GPS coordinates, device model, timestamp, camera settings, and any other hidden data the photo may carry. The image stored in your card contains only the visual pixels. Nothing else.

ChromaCard does not request camera access. You select images from your device’s existing photo library only.

2.3  Crash & Diagnostic Data (Optional)

ChromaCard may collect anonymous, aggregated crash reports through the Apple App Store’s standard crash reporting. This data is used solely to identify and fix software bugs. It contains no personal information, no card content, and no identifiers linked to you. You can opt out through your device’s privacy settings at any time.

2.4  What We Explicitly Do Not Collect

• Your location (the app never requests location permissions)
• Your contacts or address book
• Camera or microphone access
• Device advertising identifiers (IDFA)
• Behavioral analytics, session recordings, or heatmaps
• Any data from your card content for marketing or profiling
• Information about recipients who scan your card — we have no way to collect it

2.5  TestFlight Beta Testing (iOS Only)

If you are testing a pre-release version of ChromaCard through Apple’s TestFlight program, additional data collection applies solely during the TestFlight beta period, governed by Apple’s TestFlight Terms and Conditions and Privacy Policy. This collection is imposed by Apple’s platform and cannot be opted out of while using TestFlight. It does not apply to the publicly released App Store version of ChromaCard.

What Apple collects and shares with ChromaCard LLC during TestFlight:

• Your name and email address (from your TestFlight invitation; you cannot opt out of this)
• Crash logs and usage information automatically collected and shared with ChromaCard LLC by Apple
• Feedback you submit through the TestFlight app, which may include screenshots, device details, carrier, time zone, CPU architecture, and connection type
• Beta app installation details including app name, platform, and OS version (retained by Apple for analytics, accounting, and fraud detection)

ChromaCard LLC uses TestFlight data solely to improve the app and is not permitted to share it with any third party, as required by Apple’s Developer Program License Agreement. Apple retains beta testing data for one year. To view or manage data Apple holds about you through TestFlight, visit privacy.apple.com.

Back to Contents

Because your card data is stored locally on your device, ChromaCard cannot use it for any server-side purpose — because we never have it. The only uses of any data we ever receive are:

• Bug fixes: Anonymous crash reports, if your device shares them, are used exclusively to improve app stability.
• Support: If you email us at privacy@chromacard.app, we use the information in that email to respond to you. We do not add your contact information to any marketing list.
• Payment processing: Subscriptions and one-time purchases are processed entirely by Apple (App Store). ChromaCard LLC does not receive, process, or store your payment card information. Apple’s privacy policy governs that transaction.

Back to Contents

The only limited circumstances in which any information may be shared with third parties are:

• Apple: Payment and subscription management, and optional crash reporting, are handled by Apple on the platform on which you downloaded ChromaCard. Apple has its own privacy policy independent of ChromaCard.
• Legal compliance: If we are required by law, court order, or valid legal process to disclose information, we will comply with the minimum disclosure necessary and will notify you to the extent permitted by law. Because we hold no personal data on our servers, any such request would yield nothing about your card content.
• Business transfer: In the event ChromaCard LLC is acquired or its assets are transferred, this Privacy Policy and its obligations will transfer to the new owner, who will be bound by the same commitments.

Back to Contents

Your card data is retained on your device for as long as you keep the app installed. Deleting the ChromaCard app from your device permanently removes all locally stored card data. Because ChromaCard has no server-side copy of your data, this deletion is final and irreversible.

Back to Contents

ChromaCard stores all data using your device’s native local storage, which is protected by your operating system’s built-in encryption and app sandboxing. Because no data is ever transmitted to external servers, the attack surface that exists for every cloud-based service simply does not exist for ChromaCard. Your device’s passcode, biometric lock, and full-device encryption are your primary security layer — and they’re the only ones you need.

Back to Contents

ChromaCard is intended for professionals aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has used ChromaCard to store personal information, please contact us at privacy@chromacard.app and we will assist with deletion.

Back to Contents

Most privacy laws give you rights you have to formally request from companies — rights to access, correct, delete, or export your data. With ChromaCard, you already have all of those rights, by default, right now, without asking anyone. Because your data never left your device, you have always had full and exclusive control over it.

• Access your data: Open the app at any time.
• Edit or delete any card: Directly within the app.
• Delete all data permanently: Uninstall the app, or use Settings → Reset App to Factory Settings. No request required, no waiting period, no confirmation email.
• Export your card: Save it as an image to your photo library, or share it as a vCard at any time.

8.1  GDPR and UK GDPR (European and UK Users)

Data protection by design and by default (Article 25)

GDPR Article 25 requires that privacy protections be embedded into a product’s design from the outset — not added after the fact. ChromaCard was built to satisfy this principle at every layer: zero-cloud architecture, no account creation, EXIF metadata stripping on every photo import, on-device content moderation, and a one-tap factory reset. Every major product decision is an Article 25 implementation.

Your data subject rights under GDPR / UK GDPR

GDPR gives EU and UK residents formal rights of access, rectification, erasure, portability, restriction, and objection. With ChromaCard, these rights are already yours — exercisable directly in the app, without submitting a formal request to anyone:

Lawful basis for processing

ChromaCard LLC processes a minimal amount of personal data. We are required by GDPR to state the lawful basis for each category:

• Anonymous crash diagnostics (optional, via Apple): Legitimate interests — improving app stability and fixing software bugs, with no material privacy impact given full anonymization.
• Support communications: Performance of a contract and/or your consent — when you initiate contact with us, we use the information in that email to respond to you.
• Card data you enter into the app: This data is stored on your device and is never received by ChromaCard LLC. It is not subject to a lawful basis determination on our end — you are the sole custodian of that data.

EU Representative (Article 27)

GDPR Article 27 requires non-EU companies to appoint an EU representative when processing EU residents’ personal data on a regular or systematic basis. ChromaCard LLC’s status under this provision is currently under formal legal review. Where an EU representative is required, ChromaCard LLC will appoint one and update this Privacy Policy accordingly. EU users may direct any inquiry about EU representation to privacy@chromacard.app in the interim.

No Data Protection Officer (DPO) required

DPO appointment is required for organizations that engage in large-scale systematic monitoring or large-scale processing of special category data. Neither condition applies to ChromaCard LLC.

Supervisory authorities

EU users may contact their national data protection authority with any concerns. UK users may contact the Information Commissioner’s Office (ICO) at ico.org.uk. ChromaCard LLC’s contact for all privacy matters is privacy@chromacard.app.

For any other questions about your rights under applicable law, contact privacy@chromacard.app.

Back to Contents

ChromaCard does not sell personal information, and therefore the “Do Not Sell My Personal Information” right under the California Consumer Privacy Act (CCPA) does not apply. ChromaCard does not share personal information for cross-context behavioral advertising under the California Privacy Rights Act (CPRA), the 2023 amendments to CCPA that expanded consumer protections.

Sensitive personal information (CPRA): The CPRA grants California residents additional rights over “sensitive personal information” — a category that includes Social Security numbers, financial account data, health data, biometric identifiers, and precise geolocation. ChromaCard does not collect any of these categories. GPS and location data embedded in photos is stripped from every image at upload time, before it is saved to your device.

California residents have the right to request information about any data we may have. Given our local-only architecture, ChromaCard LLC holds no personal information about you on file. Requests can be directed to privacy@chromacard.app. We will respond within 45 days as required by CCPA/CPRA.

Back to Contents

As of 2025, more than twenty US states — including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Minnesota, New Hampshire, New Jersey, and others — have enacted comprehensive consumer privacy laws. While these laws vary in their specific requirements, they share a common framework: rights of access, correction, deletion, and data portability; prohibition on selling personal data without consent; and limits on using personal data for targeted advertising or profiling.

Applicability thresholds

Most US state privacy laws apply to companies that process personal data for more than 100,000 consumers per year, or that derive revenue from the sale of personal data. ChromaCard LLC does not currently meet these thresholds. Nonetheless, ChromaCard’s architecture satisfies the structural requirements these laws were designed to mandate — because we do not hold your data in the first place.

Your rights under state privacy law

The rights these laws grant — to access your data, correct it, delete it, obtain a portable copy, and opt out of its sale — are available to you directly through the ChromaCard app, without submitting a formal request to ChromaCard LLC:

• Access and portability: All your card data is in the app. Export it as a vCard or save it as an image at any time.
• Correction: Edit any field directly in the app.
• Deletion: Uninstall the app or use Settings → Reset App to Factory Settings. Deletion is immediate, complete, and irreversible.
• Opt out of data sale / targeted advertising: There is nothing to opt out of. ChromaCard LLC does not sell personal data and does not use it for targeted advertising. No data leaves your device.

For any questions about your rights under applicable state law, contact us at privacy@chromacard.app.

Back to Contents

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by posting a prominent notice on chromacard.app at least 30 days before the changes take effect. Continued use of ChromaCard after the effective date constitutes acceptance of the updated policy.

Back to Contents

We take privacy questions seriously. If you have questions, concerns, or requests related to this policy — including data subject requests under GDPR, UK GDPR, CCPA/CPRA, or any other applicable privacy law — please contact us: