Privacy

Two different situations

Most privacy notices assume one kind of user. Here there are two, and the difference matters:

• Account holders — you signed up, you have a profile and a QR code.
• People who share their details — you scanned someone's QR code and filled in the form. You do not need an account, and none is created for you.

If you scanned someone's code

What you type goes to the person whose code you scanned. That is the whole point of the product, and it is worth being blunt about: they keep it, and they can add their own private notes about meeting you.

• Your name. This is the only required field.
• Your company and email address, if you chose to give them.
• Which button you tapped afterwards — Telegram, LinkedIn, or neither — and when.
• The date and time, and whether you arrived by scanning a code or by opening a link.
• A randomly generated identifier stored in a cookie called ec_vid. It contains no personal information and exists so that a scan can be matched to the details submitted moments later.

We do not track you across other websites, we do not build an advertising profile, and we do not sell anything to anyone.

If you have an account

• Your email address, and a password stored only as a cryptographic hash — or, if you sign in with Google, your Google account email and basic profile details.
• Your profile: username, display name, and optionally your role, company, profile photo, Telegram handle and LinkedIn URL. Everything in your profile is shown publicly on your profile page, because that is the page you hand to strangers.
• The people you have met through the app, with anything you add about them: a note, the event, a follow-up date.
• When a signed-in user views your profile page, so it can be shown on their entry in your list. Anonymous visitors are never identified.

Email we send

Account holders may get one daily summary, and only on a day when they actually met someone and have not yet written notes. Every one of those emails carries a one-click unsubscribe link that works without signing in. We send no marketing email.

Where it is stored, and who else touches it

Data is held in a Supabase Postgres database hosted in the European Union (Ireland). These companies process data on our behalf:

• Supabase — database, accounts and file storage (EU).
• Vercel — hosting and delivery of the website.
• Google — only if you choose to sign in with Google.
• Resend — delivery of the daily summary email, when that is switched on.

Why we are allowed to hold it

For account holders, to provide a service you asked for. For people who share their details, because you chose to submit the form in order to be contacted — you can decline simply by not filling it in, and the Telegram and LinkedIn buttons work either way. Keeping the product working and free of abuse is our legitimate interest.

How long it is kept

Until it is no longer needed or until deletion is requested. An account holder can remove any individual from their list at any time, which deletes that record. Deleting an account removes the profile and everything attached to it.

Your rights

If you are in the EU or UK you can ask for a copy of your data, ask for it to be corrected or deleted, object to how it is used, or complain to your national data protection authority. Write to bounza@gmail.com and we will respond within one month.

One honest limitation: if you shared your details with someone through a QR code, they hold a copy in their own contact list. We can delete it from ours on request, and we will tell you who received it so you can ask them directly.