Privacy Policy
Last updated 22 September 2026
The short version.The business cards you collect are encrypted on your iPhone with a key only you hold. They are not sent to Carte, and we cannot read them. If you connect a calendar, its events are read on your device and are not sent to us either. We hold an email address so you can sign in, and a random ID for each of your cards so we can count how often a shared card is opened — never who opened it.
Who we are
Carte is produced by Appé Latte, in Alberta, Canada. Appé Latte is the data controller for the information described below.
If you have a question about this policy or about your data, write to hello@appe-latte.ca or call +1 825 521 6591.
What we collect, and what we do not
| Data | Where it lives | Can Carte read it? |
|---|---|---|
| Your cards and saved contacts | Encrypted on your device; optionally in your own iCloud | No |
| Account email address | Supabase Authentication | Yes |
| Subscription status | RevenueCat and Apple | Yes |
| Calendar events from a connected source | Read on your device; only a short summary of your next meetings is kept, on your device and your paired Watch | No |
| Widget, Lock Screen and Apple Watch summary | On your device, and your paired Watch | No |
| Spotlight entries (off unless you turn them on) | Your device’s own search index | No |
| Access tokens for connected accounts | Your device’s Keychain | No |
| Where you met someone (city, event, approximate map point) | Encrypted on your device with the contact | No |
| Card view counts | A random card ID, linked to your account, and a timestamp per view | Yes: how often, never who |
How your contacts are protected
Your wallet — every card and contact you store — is encrypted on your device using AES-256-GCM before it is written to disk. The encryption key is generated on your device and stored in the iOS Keychain. The short summaries for widgets and your Watch, and Spotlight’s entries if you turn them on (see below), are kept outside that store and protected by iOS’s own data protection instead.
So that your cards are still available when you replace your phone, that key is stored as a synchronising Keychain item. This means it can travel to your other Apple devices through iCloud Keychain, which Apple protects with end-to-end encryption. Carte never receives the key, and neither does Appé Latte.
You may also set a recovery passphrase. If you do, an encrypted copy of your key is stored in your own private iCloud database, locked with that passphrase. The passphrase is never transmitted and never stored. If you forget it, we cannot reset it — that is what keeps the data private.
Backups
Backups are optional. When enabled, your wallet is encrypted on your device and then written to your own private iCloud storage. It is not stored on Carte’s servers, and it is encrypted before it leaves your phone.
When you share a card
A shared card link carries its contents in the fragment of the URL — the part after the #, which browsers do not transmit to the server. The card is rendered in the recipient’s browser. We do not receive the contents of cards you share.
Each of your cards has a random identifier, and a shared link carries it so we can count how many times that card was opened. We record which account each identifier belongs to, so that only you can see its count. A view records only the identifier and a timestamp. It does not record who opened it, their location, or any other information.
Calendars and connected accounts
Carte can connect to a calendar so the People screen can lead with who you are seeing today, and so a meeting can remember who was in the room. Connecting is entirely optional and nothing is read until you do it.
What is read. Event times, titles, the conferencing link, and the names and addresses of the people invited. Carte does not read the body, description or notes of an event. For Google Calendar this is enforced by the request itself: Carte names the fields it wants, so the description is never transmitted at all rather than being received and ignored.
Where it goes. Nowhere but your own devices. Events are fetched by your phone, matched against the cards already in your wallet on your phone, and displayed. A short summary of your next meetings is kept on your phone for widgets and sent to your paired Watch, as described below. Events are not sent to Carte, are not stored on our servers, and we cannot see them.
The access tokens. When you connect an account, the token that allows Carte to read it is stored in your device’s Keychain and is scoped to the account you signed in with. It is never stored on our servers, and it stays on the device you connected on: if you use Carte on another device, that device holds its own token.
Disconnecting. You can disconnect any source at any time in Settings → Sources. Disconnecting deletes the stored token and removes that source’s events from Carte. You can also revoke Carte’s access from the provider’s own account settings.
Carte’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: calendar data is used only to provide the features described above, is never sold or transferred, is never used for advertising, and is not used to build or improve any general-purpose model.
Widgets, Lock Screen, Apple Watch, Spotlight and Siri
Widgets, the Lock Screen and Live Activities. To show your next meeting, a card ready to hand over, or where you last met people, Carte keeps a short summary on your iPhone that only Carte and its own widgets can open. It holds your own cards’ names and share links. For your next meetings, twelve at most, it holds the time, the calendar it came from and who it is with: the name your wallet has for them or the name the invitation gives (never an address), plus the role and company of people already in your wallet. It also holds the event, city and initials for the last place you met people.
The Home Screen “Next” widget shows those names and roles. Lock Screen widgets, Live Activities, meeting reminders and your Apple Watch do not name the people you are meeting unless you switch on “Names on Lock Screen” in Settings, because they can be seen without unlocking your phone; without it they show times and initials. The summary on your iPhone keeps the names either way; the switch decides where they are shown, and whether they are sent to your Watch.
The only contact details in the summary are your own. Each card’s share link carries whatever that card is set to send (your email, phone number, website and social links, unless you switched them off), and your card widget keeps only what it shows: your name, title, company, photo and any details you picked for it. Nobody else’s addresses, phone numbers or notes go in. The summary is rewritten as things change and emptied when you sign out or delete your account.
Apple Watch. If you use the Carte Watch app, your iPhone sends it a shorter version of that summary through Apple’s WatchConnectivity: each card’s name, colours and a QR code of its share link, and the times and initials of your next meetings with other people, with names only if “Names on Lock Screen” is on. It goes from your iPhone to your Watch without passing through Carte, and the Watch clears it when you sign out.
Spotlight. Off unless you turn it on in Settings. When it is on, the names, roles and where-you-met of the people in your wallet are added to your iPhone’s own search index, so searching an event finds the people you met there. The index stays on your device, cannot be read while your phone is locked, is paused while Carte’s Face ID lock is on, and is emptied when you switch it off or sign out.
Siri and Shortcuts. Asking Siri to hand over a card or who you met is answered by Carte on your phone, from your wallet. Apple processes your voice request under its own privacy policy. Carte sends nothing to us to answer it.
Notifications
If you allow notifications, Carte registers with Apple’s push service so it could be reached in future. Carte does not keep the resulting device token, does not send it anywhere, and no server of ours sends push notifications today — the notifications you see are generated on your own phone. Once a calendar is connected, Carte may ask to deliver quietly to Notification Centre; those notifications are reminders about your own meetings and are scheduled on your phone. If that changes, this section changes with it.
Third parties
- Supabase — stores your email address so you can sign in. If you use Sign in with Apple, we receive only what Apple passes on.
- Firebase (Google)— held the accounts of earlier versions of Carte. Nothing new is stored there, and this version uses it only to move an older account across and delete what it held. Some of that account’s records can stay behind; see below for what, and how to have it deleted.
- Apple— processes subscription payments and provides iCloud storage for your backups and Keychain sync. If you use “where you met”, Apple’s geocoding service also receives an approximate location, or the city you type, to name the place or put it on a map; a city you type goes to Apple even when the location switch is off. Apple handles it under its own privacy policy.
- RevenueCat — records whether your subscription is active.
- Google Calendar — where the connection is offered, and only if you connect it. Your phone reads your events directly from Google; nothing passes through us.
- Calendly — only if you connect it. Your phone reads your own scheduled bookings directly from Calendly.
- Microsoft 365, Slack and Notion — not offered in this version. A connection made in an earlier version is removed when you update. If Microsoft 365 is offered in a later version, it will work the way Calendly does: your phone reads your Outlook calendar and Teams meetings directly from Microsoft Graph, the sign-in and its token go straight between your phone and Microsoft, and nothing passes through us.
Carte contains no advertising, no third-party analytics SDK, and no tracking. We do not sell or share your personal information for money or for anything else of value, and we have nothing about your contacts or your calendar to sell.
Company logos
This version of Carte does not fetch company logos, so no contact’s website or email domain is sent anywhere to look one up. If that changes, this section changes with it, and fetching will be something you switch on.
Device permissions
- Calendar — only if you connect Apple Calendar, to read the times, titles and invitees of your events. Never the body of an event.
- Notifications — only if you allow them, to reach you about your own activity.
- Camera — to scan QR codes and paper business cards.
- Contacts — only to save a card you have chosen to save. Saving one first looks for an existing entry with the same name, so you do not end up with duplicates; nothing found that way is kept, read again, or sent anywhere.
- Photos — only to save a QR code image you asked to save.
- Location (while you are using Carte) — off unless you turn on “where you met” in Settings. Read only as a hand-over completes, never in the background, and only roughly: Apple’s geocoder names the city, and an approximate map point is saved with the contact.
- Local network and Nearby Interaction — to exchange a card with a phone in front of you.
- NFC — to write your card to a tag, or read one.
- Face ID — to lock the app, if you enable that.
Keeping and deleting your data
Your contacts stay on your device until you delete them. Deleting your account from Settings deletes the account record and email address we hold for this version of Carte, along with your card IDs and their view counts. On this iPhone it deletes this account’s encrypted wallet, its settings, the widget and Watch summaries, any Spotlight entries, the reminders it had scheduled for your meetings, and the access token for every calendar you connected on this iPhone. It also deletes any backup Carte made in your iCloud and any escrowed recovery key; if iCloud cannot be reached at that moment, Carte finishes those two the next time you open it.
The encryption key is not deleted. That one item is shared through your iCloud Keychain with your other Apple devices, and with any other Carte account you use on them, so erasing it would leave those wallets unreadable. It stays; only an older device-only copy, left behind by version 1 of Carte, is removed. Nothing of the deleted account is left encrypted under it: that account’s wallet on this iPhone, its iCloud backup and its escrowed copy of the key are all gone.
Deleting your account does not cancel an App Store subscription; cancel it in your Apple ID settings. Nor does it withdraw Carte’s access at a calendar provider; you can do that in the provider’s own account settings. It also does not reach another device you used Carte on, because each device keeps its own tokens: disconnect your calendars there first, or withdraw Carte’s access at the provider, which makes any copy left on a device useless.
Calendar events are not stored by Carte: they are read when the app refreshes and held in memory, apart from the short summary of your next meetings that widgets and your Watch show, which stays on your iPhone and Watch and is replaced as your day moves on. Disconnecting a source deletes its access token from your Keychain, and deleting your account removes every token on the iPhone you delete it from.
Earlier versions of Carte stored contacts on our servers before the app moved to on-device encryption. When you sign in to this version it deletes those contacts, and the profile and sharing records kept with them — and only while it can still reach your old sign-in. Either way, some records stay in Firebase: the email address Firebase Authentication holds, the profile fields an earlier version mirrored there (name, email, phone, company, website and links), and its record of app activity. If the app could not reach your old sign-in, or you had already signed out before updating, your old contacts stay there too. Deleting your Carte account does not remove those. Write to hello@appe-latte.ca and we will delete them.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data. Your contacts are already in your possession and can be exported from the app. For anything held by us — which is essentially your email address — write to hello@appe-latte.ca or call +1 825 521 6591, and we will respond within 30 days.
Children
Carte is not directed at children under 13, and we do not knowingly collect their personal information.
Changes
If this policy changes materially we will update the date above and note the change in the app. Continued use after a change means you accept the updated policy.