Privacy policy
uaisync syncs and merges contacts between the address books you connect. This page says what data it handles. Questions: see the contact address at the bottom of the page.
What we collect
- Your account. The e-mail address(es) you sign in with. Sign-in uses a link sent to that address; there is no password.
- Your connections. For a CardDAV server: its address and the credentials you gave. For Google: the access and refresh tokens Google issues to uaisync. These are stored encrypted and are never shown again.
- Your contacts. The contacts in the contact lists you choose to sync, as read from your Google or CardDAV account (names, phone numbers, e-mail addresses, addresses and the other fields of a contact). Photos are not copied.
- Sync history. When each sync ran and counts of what changed. Run records hold no contact data, except the display name of a contact in a preview you asked for, kept sealed and shown only to you.
Google user data
uaisync requests these Google permissions:
| Scope | Why |
|---|---|
https://www.googleapis.com/auth/contacts | To read the contacts in your “My Contacts” and, when you chose a Google contact list as the destination of a sync, to create, update and delete contacts in that list. |
openid, email | To identify your Google account and show its address next to the connection. |
uaisync does not read “Other contacts”. It uses Google data only to provide the sync you set up, shows nothing of it to anyone but you, and does not sell it, use it for advertising, or transfer it to others, except to run the service under your instructions (for example, our hosting provider stores it encrypted) or where the law requires.
Limited Use. uaisync’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How it is protected
Contacts are stored as encrypted copies, sealed with a key that belongs to your account; that key is itself protected by a key held outside the database. Each user’s data is isolated in the database. Contact data, sign-in links and tokens are never written to logs. Connections to the service use HTTPS.
How long it is kept
- While your account exists: the data above, so the sync can keep merging and notice changes.
- When you remove a contact list from every sync: its encrypted copies are deleted after 7 days.
- A contact deleted at its source: a record of the deletion is kept for 30 days, because the deletion rules of your syncs depend on it, and then removed.
- When you disconnect a connection: its tokens are revoked where the provider allows it and its copies are removed.
- When you delete your account: everything uaisync holds about you is deleted at once, including your encryption key, which makes any remaining copy unreadable. Database backups are rotated out on their normal schedule.
You can also download your data first. The contacts themselves are in your own contact lists, which are the copy to keep. Removing uaisync’s access from your Google account at myaccount.google.com/permissions stops it from reading or writing your contacts.
Your rights
Under the LGPD (Brazil) and the GDPR (EU) you can ask to access, correct, export or delete your data, and to object to its processing. Most of this you can do yourself in the app; for the rest, write to the contact address below. We answer within 30 days.
Changes
If this policy changes in a way that matters, we say so in the app before it takes effect. The date at the top shows the current version.