Privacy Policy — CardHaus
Draft for CardHaus 1.3 — pending owner review before publication.
CardHaus is a business-card scanner for iPhone and iPad. This policy describes the information handled by the app, its network features, and the controls available to you. Core text recognition runs locally using Apple's Vision and VisionKit; this does not mean that every app feature is offline.
1. Cards, settings, and storage
CardHaus stores scanned, entered, and imported contact information in a local SwiftData store. This can include names, job titles, companies, phone numbers, email and website addresses, postal addresses, social links, notes, tags, categories, scan dates, card images, and your own "My Card". Saved records can also contain scan-location coordinates and place labels, company information, approved logos, and integration-export status.
App preferences are stored using iOS user defaults. Downloaded logo candidates and company information may be cached locally.
iCloud Sync is enabled by default. When available and enabled, the app uses your private CloudKit database to synchronize saved cards through your Apple account. Settings → General → iCloud Sync changes this preference; relaunch the app for the change to take effect.
The separate iCloud Backup preference defaults on and controls backup eligibility for the local card database and its companion files. Actual device backups depend on your Apple/device settings. Turning off sync or backup does not itself delete existing cloud records, backups, or previously exported copies.
2. Scanning and location
The app uses the camera for live scanning and can process images you choose to import. Core OCR is performed on the device. The experimental on-device image refinement feature is not enabled in the 1.3 Release build.
Opening the live scanner can request When In Use location permission. If authorized, CardHaus requests a location fix and uses Apple MapKit reverse geocoding to obtain a place label. Latitude, longitude, and the resulting label can be saved with a scanned card and included in its iCloud synchronization. MapKit reverse geocoding can send the location to Apple's service. Location precision depends on the permission and information supplied by iOS. Scanning can continue if location access is denied. You can change location access in iOS Settings.
3. Network lookups and sharing
Some requests happen automatically when an enabled feature is used, not only when you tap Export. Network services receive connection information, including your IP address, as well as the request data described below.
| Feature | Information sent and destination |
|---|---|
| Automatic company-logo lookup | A domain derived from the card's website or corporate email is sent to Google's favicon service (www.google.com/s2/favicons). The app can also request /favicon.ico from that company's domain. The active automatic lookup does not use the legacy Clearbit logo endpoint. |
| Company details | Opening the Company section can request information using the company name from DuckDuckGo (api.duckduckgo.com) and Wikipedia (en.wikipedia.org), and fetch the company website and About pages using a website or email-derived domain. Results can be saved on the card. |
| Microsoft 365 or Dynamics 365 export | Contact fields, including notes and supported additional fields, are sent to your connected Microsoft account: Microsoft Graph (graph.microsoft.com) or your configured Dynamics/Dataverse environment. If you enable Auto Sync, newly added cards can be exported to connected supported services without a separate export tap. Auto Sync defaults off. |
| Save to Contacts | Contact information is passed to Apple's Contacts interface. Copies saved there follow your Contacts account and synchronization settings. |
| Share, QR, or file export | Contact information is included in the vCard, QR code, or file you choose to share. Recipients and selected destination apps control their copies. Settings → Data provides library vCard export. |
| External links | Opening a website or LinkedIn action sends the selected URL or search query to the destination app or service. A LinkedIn search can include the contact's name. |
| Apple Wallet, if a signing service is configured | Requesting a Wallet pass sends the generated pass contents, including contact details, to the configured signing service. Without a configured service, the app offers vCard sharing instead. |
Microsoft connections use OAuth in a system web-authentication session. CardHaus stores connection tokens in the iOS Keychain so it can use and renew the connection. Disconnecting removes the app's saved authorization for that connection; it does not delete contacts already exported to Microsoft. These integrations are optional and require your own service account and, where applicable, organization approval.
Pro purchase entry points, cloud AI enhancement, two-way CRM sync, and the deferred share/caller-ID extensions are not offered as current 1.3 features.
4. Advertising
CardHaus uses Google Mobile Ads (AdMob) for native ads in the card list. Google User Messaging Platform is also included as a dependency. The app attempts to request iOS App Tracking Transparency authorization before starting ad loading while active. The advertising identifier (IDFA) is subject to iOS tracking authorization. Declining that permission does not disable ad loading.
Google's SDK disclosure describes potential collection of IP addresses (including approximate location derived from them), device identifiers, advertising data, interactions, crash logs, and performance diagnostics for advertising and analytics. The app's ad-loading code does not supply scanned card fields as ad-request parameters. This is not a declaration that the SDK collects no data.
The 1.3 interface does not offer a Show ads switch or a Pro purchase option. Changing tracking authorization in iOS Settings controls that authorization; it is not an ads-off switch or a guarantee of a particular ad-personalization mode.
See Google's SDK data disclosure, the Google Privacy Policy, and AdMob & AdSense terms.
5. Optional system contact access
Settings provides an opt-in for Siri/system contact access, off by default. When enabled and access conditions are met, basic saved contact facts can be placed in a protected on-device Core Spotlight index and exposed through app intents. System integration varies by OS and device; specific Siri answers or recommendations are not guaranteed.
Allowing access using device unlock independently of the app's biometric lock is a separate permission, also off by default. Notes require a separate opt-in, the app in the foreground, and the app lock to be unlocked. Notes are not included in the contact schema index or generated card-preview thumbnails. Those thumbnails use selected contact facts and available logo assets, not the original scanned-card photo. Turning off the main opt-in also turns off the notes/device-unlock permissions and requests removal of the app's contact index.
6. Controls and deletion
You can review and edit saved cards, delete cards using the library controls, export contacts, disconnect integrations, change sync/backup preferences, and clear downloaded brand caches in Settings. iOS Settings controls camera, location, Contacts, and tracking permissions. An optional biometric app lock is available in Settings → General.
Removing the app is not a way to erase every copy: iCloud records, device backups, saved Contacts, exports, and recipient/service copies may remain. Use the relevant account or service controls for those copies. This policy does not specify retention periods or processing regions for third-party services.
7. Service policies and contact
Apple services are covered by the Apple Privacy Policy. Microsoft services are covered by the Microsoft Privacy Statement. Company lookups also involve DuckDuckGo, Wikimedia, and the company websites requested. LinkedIn actions are covered by LinkedIn's Privacy Policy.
For privacy questions, complaints, or requests concerning your information, email hello@lead-lens.app. Support is available at https://lead-lens.app/support. The public policy URL is https://lead-lens.app/privacy.
We will update this policy when the app's data handling changes.