Privacy policy for NFC.cool Tools and nfc.cool

What this policy covers

This policy covers:

• the website at nfc.cool, including its guides, its blog and the tools that work in your browser, such as the online NFC reader ("the website");
• the NFC.cool Tools app for iPhone and iPad, and for Android ("the app").

NFC.cool Business Card has its own privacy policy. It also covers NFC.cool business card accounts, including the ones you sign in to in this app, the cards made with them, and the details people leave on those cards. See Business card accounts.

Who is responsible

The controller for the processing described here is:

We have not appointed a data protection officer. For any question about your data, write to the controller at the address above.

The data we process, and why

This section describes what data the website and the app process, why, and on what legal basis.

The website

Hosting. The website is hosted on GitHub Pages, a service of GitHub, Inc., and delivered through GitHub’s content delivery network. To deliver a page, GitHub’s servers receive your IP address, the address of the page you open and the details your browser sends, as every web server does. GitHub logs visitors’ IP addresses for security purposes, under the GitHub Privacy Statement. We do not receive these logs.

Legal basis: our legitimate interest in delivering the website securely (Art. 6(1)(f) GDPR).

No cookies, analytics or third-party scripts. The website sets no cookies. It uses no analytics, no tracking pixels and no ad networks, and loads no scripts, fonts or embedded content from other companies. Its fonts are served from nfc.cool itself. It keeps two settings in your browser’s storage, described in Cookies and similar technologies.

Tools in your browser. The online NFC reader reads and writes tags with your browser’s Web NFC feature. What it reads stays in your browser and is not sent to us. The tap counter page shows the count that a tag adds to the page’s address, and your browser decodes it. Like any page request, that address, with the tag’s serial number and count, reaches GitHub’s servers.

Newsletter. If you sign up on the website, your email address goes to our newsletter list at Mailjet. See The newsletter.

Links to shops and stores.

• Some links to shops, such as Amazon, are affiliate links. If you follow one, the shop knows you came from our website, and sets its own cookies on its own site under its own policy. If you buy something, we may earn a commission. Amazon tells us which products were bought through our links, but not who bought them.
• Some links to the App Store carry a campaign name. Apple shows us only totals for each campaign, such as the number of downloads.
• Links to our social media profiles are plain links. Nothing loads from those networks until you click one.

Analytics and crash reports in the app

From the first time you open it, the app uses Firebase, a Google service:

• Firebase Analytics records which screens you open and what you do in the app. On iPhone and iPad this includes your answers to the questions the app asks when you first open it, the steps you take on the paywall, and your purchases: the transaction number, the product, its price and its currency. On Android it includes the first-run questions and your answers, the paywall, and the Google review link creator. Firebase also records some events by itself, such as the first time you open the app, each session and app updates. Each event comes with an identifier for the app on your device, device details such as the model, system version and language, and your approximate region, which Google works out from your IP address.
• Advertising identifiers: the iPhone and iPad app does not give Firebase Analytics your device's advertising identifier (IDFA). On Android, Firebase Analytics also collects your phone's advertising ID where one is available. You can reset or delete it in your phone's settings.
• Firebase Crashlytics sends a report when the app crashes, with the device model, system version, app version, where in the app the crash happened and an identifier for the app installation. On Android a report can also include technical notes from the app, such as the state of the NFC reader. We add no name, email address or user id to crash reports.

Purpose: to understand how the app is used, find and fix problems, and decide what to improve. Legal basis: our legitimate interest in an app that works and gets better (Art. 6(1)(f) GDPR). This data is linked to identifiers for the app and your device, not to your name or email address. You can object at any time by emailing info (at) nfc (dot) cool. See Your rights.

Ads in the free version

The free version of the app shows ads from Google AdMob. Platinum shows no ads.

• Your choice first. The app requests ads only after Google's consent tool has checked whether your consent is needed where you are. Where it is, Google's consent form asks you whether Google may store and read information on your device and show you personalised ads.
• iPhone and iPad: Apple's tracking prompt also asks whether the app may use your device's advertising identifier (IDFA). Google AdMob receives it only if you allow tracking.
• Android: Google AdMob can use your phone's advertising ID. You can reset or delete it in your phone's settings.
• Each ad request sends Google technical data, such as your IP address, your device model and system version, and the app, so that Google can deliver the ad, count it and protect against fraud.

Google decides itself how it uses ad data, as an independent controller, under its own privacy policy and its explanation of how it uses data from apps.

Legal basis: your consent (Art. 6(1)(a) GDPR) for personalised ads and for storing and reading information on your device for ads, which is also the consent Portuguese law requires (Art. 5 of Lei 41/2004). If you decline, Google can still show ads that are not personalised. For those, we rely on our legitimate interest in funding the free version (Art. 6(1)(f) GDPR).

Changing your choice. You can change your choice at any time:

• where the app offers it, with Reset Consent in More, which asks for your choice again;
• on iPhone and iPad, in Settings, Privacy & Security, Tracking;
• on Android, by deleting or resetting your advertising ID in your phone's settings;
• by emailing info (at) nfc (dot) cool, and we help you change it.

Withdrawing your consent does not affect what happened before.

Purchases and Platinum

You buy Platinum, including free trials, lifetime purchases and offers you redeem with a code, through the App Store or Google Play. Apple or Google takes the payment. We do not receive your card or other payment details.

We use Qonversion to manage purchases. Qonversion knows the app by an identifier it creates, the Qonversion user id, not by your name or email address. It receives:

• your App Store receipts or Google Play purchases, and what they unlock, with technical details about your device and the app;
• on iPhone and iPad, your device's advertising identifier (IDFA), but only if you allowed tracking in Apple's prompt;
• on iPhone and iPad, Apple's attribution token. See Measuring our App Store ads.

We also use Qonversion to change settings in the app without an update, and to try out different versions of screens and offers (A/B tests). For a test, Qonversion places the app in one of the test’s groups.

Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR) for your purchases. Our legitimate interest in improving the app and our offers (Art. 6(1)(f) GDPR) for settings and tests. Your consent in Apple’s tracking prompt (Art. 6(1)(a) GDPR) for the IDFA.

Measuring our App Store ads

On iPhone and iPad, each time the app starts, it gets an attribution token from Apple and sends it to Qonversion. Qonversion uses the token to ask Apple whether the download came from one of our Apple Search Ads campaigns. The answer identifies the campaign, not you.

Legal basis: our legitimate interest in knowing which of our ads work (Art. 6(1)(f) GDPR). You can object by emailing info (at) nfc (dot) cool.

Notifications

If you allow notifications, Firebase Cloud Messaging, a Google service, gives the app a token so that we can send notifications to it. On iPhone and iPad, notifications are delivered through Apple’s push service.

• On iPhone and iPad, if you are signed in to a business card account, the app gives this token to the business card service, so it can tell you about new contacts. See the Business Card privacy policy.
• On Android, the token stays with Google and is not sent to our server.

Legal basis: your consent, given when you allow notifications (Art. 6(1)(a) GDPR). You can turn notifications off in your device’s settings.

The newsletter

You can sign up for our newsletter on the website and in the app. On iPhone and iPad the app offers it in More, in the screens you see when you first open it, and in a prompt on its third launch.

Your email address is sent through a small service we run on Cloudflare to our newsletter list at Mailjet, which sends the newsletter. Cloudflare receives your IP address with the request, as every server does. Every newsletter has a link to unsubscribe.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the link in any newsletter, or by emailing us.

When you write to us

If you email us, we receive your email address, your message and anything you attach. Our inbox is hosted by our email provider, lima-city.

If you write from the app, it opens your own email app with a message that already includes your device model, system version, how often you have opened the app and your Qonversion user id, so that we can help you with the app and your purchases. You see these lines before you send the message, and you can remove them.

Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR). Where your message is about a purchase or a problem with the app, performance of our contract with you (Art. 6(1)(b) GDPR).

Features that use an online service

• Google review link: to find a business, the app sends Google's Places service the business name you type, your device's language and region, and the coordinates in a Google Maps link you paste. On Android, the app also shows a map from Google Maps.
• Amiibo: when you scan an Amiibo, the app looks up the character at amiiboapi.org, a free public database run by others, using the character's id.
• Google search (Android): if you tap search on a saved tag, the app opens Google search with the tag's text in a view inside the app. Google handles the search under its own privacy policy, and can set its own cookies in that view.
• Game Center (iPhone and iPad): if you sign in to Game Center, the app reports the achievements you earn to Apple.

Each of these services also receives your IP address and the technical details of the request, as every server does.

Legal basis: providing the feature you use (Art. 6(1)(b) GDPR).

Webhooks

With Platinum you can set up a webhook. The app then sends the data of each tag you scan (its identifier, the date and its content) directly from your device to a web address you choose, with a user name and password if you set them. We do not receive this data. Whoever runs that address decides what happens to it.

On iPhone and iPad, the user name and password are kept in the Keychain on your device, and the web address syncs through your iCloud.

iCloud on iPhone and iPad

On iPhone and iPad, the app syncs what you save in it through Apple’s iCloud, to the app’s private storage in your own iCloud account:

• your saved tags, codes, scanned documents and pages, 3D models, your Amiibo collection and your QR code designs;
• the passport and ID wallet (Platinum): the name, date of birth, document number, nationality, address, phone number, face photo, signature image and machine-readable zone of the documents you add;
• your settings, through iCloud's key-value storage;
• tag passwords and keys, through iCloud Keychain if you use it.

This storage belongs to your Apple account. Apple keeps it for you, under your agreement with Apple and Apple’s privacy policy. We cannot see or read it, and it is not sent to us. Your device’s iCloud settings control which apps use iCloud.

Google Block Store on Android

On Android, the app keeps your NTAG 424 keys, ICODE passwords and AES keys in Google’s Block Store, and, if you are signed in to a business card account, its sign-in token. They then come back when you set up a new Android phone. Block Store keeps them on your phone and, if backup is on, in your Google account’s backup. Google keeps them for you, and we cannot read them.

Business card accounts

If you already have an NFC.cool business card account, you can sign in to it in the app. New accounts are made in the NFC.cool Business Card app. Your account, its cards and the contacts people leave on them are covered by the Business Card privacy policy, not by this one.

If you use the contact form on someone else’s card to leave your details with them, your details go to that card’s owner, as the Business Card privacy policy describes.

Features that work on your device

These features process their data on your device:

• reading and writing NFC tags;
• scanning QR codes and barcodes, and recognising text in scanned documents (on Android with Google's ML Kit, on your phone);
• title suggestions for scanned documents, on iPhone and iPad with Apple's on-device models;
• 3D capture of objects and rooms;
• reading the chip in passports and ID cards, and checking that it is genuine. On Android, the passport and ID wallet stays on your phone, encrypted with AES-GCM. On iPhone and iPad it syncs through your iCloud, as described above.

Permissions the app asks for

On iPhone and iPad:

• NFC: to read and write tags.
• Camera: to scan QR codes, documents and the code lines on passports and ID cards.
• Contacts: to pick a contact, for example to make a business card from it.
• Calendars and reminders: to make QR codes for events, and to put your agenda or a reminders list on an e-ink phone case. What the app reads stays on your device.
• Photos: to save QR codes and documents, and to save photos to the Photos app.
• Face ID: to protect the keys stored for your tags, so only you can reveal them.
• Alarms: for NFC Alarm, which keeps ringing until you scan your tags.
• Tracking: see Ads in the free version.
• Notifications: see Notifications.

On Android:

• NFC and camera: to read and write tags and to scan codes and documents.
• Location: on older Android versions, to join Wi-Fi networks.
• Nearby Wi-Fi devices: to join Wi-Fi networks.
• Contacts and calendar: for the features that use them.
• Notifications and exact alarms: for notifications and NFC Alarm.
• Billing: for purchases through Google Play.

You can withdraw a permission at any time in your device’s settings.

Who receives data

These are the recipients of the data this policy describes:

• GitHub: hosts the website.
• Google: Firebase (analytics, crash reports and notification tokens), AdMob (ads in the free version), Google Places and Google Maps (the review link), Google search on Android, Google Play purchases, and Block Store, which keeps data for you on Android.
• Apple: App Store purchases, push delivery, Game Center and the Apple Search Ads attribution token. iCloud keeps data for you, as your own provider.
• Qonversion: manages purchases, settings and tests, and receives the attribution token.
• Cloudflare: runs the small service that adds newsletter sign-ups to Mailjet.
• Mailjet: sends the newsletter.
• lima-city: hosts our email inbox.
• amiiboapi.org: Amiibo lookups.
• The addresses you choose for webhooks.
• The NFC.cool business card service, if you sign in to a business card account. See the Business Card privacy policy.

Where data is processed, and data outside the EU

Mailjet stores emails in the EU, in Germany and Belgium. The app sends data to Qonversion’s EU endpoint.

Some of the services we use are based in the USA. Where data leaves the European Economic Area for them, the transfer rests on one of these safeguards:

• The EU-U.S. Data Privacy Framework. The European Commission decided that US companies certified under it protect personal data adequately (Art. 45 GDPR).
• Standard contractual clauses. The European Commission's model clauses are part of our contract with the service (Art. 46(2)(c) GDPR).

For each service:

• Google LLC (USA): Data Privacy Framework, with standard contractual clauses in Google's terms for Firebase.
• Cloudflare, Inc. (USA): Data Privacy Framework.
• Apple Inc. (USA): standard contractual clauses.

For Qonversion, GitHub, lima-city and amiiboapi.org, email info (at) nfc (dot) cool if you want to know where they process data and what applies to a transfer outside the EEA.

To get a copy of the standard contractual clauses that apply, email info (at) nfc (dot) cool. The European Commission explains these safeguards on its information page.

How long we keep data

• Firebase Analytics: Google deletes the event data linked to the app's identifier at the end of the retention period we set in Google Analytics. Google offers 2 or 14 months. Reports that show only totals can be kept longer.
• Crash reports: 90 days.
• Qonversion: as long as needed to manage your purchases and subscriptions.
• The newsletter: we email you until you unsubscribe. Mailjet then keeps your address marked as unsubscribed, so you are not emailed again. To have it deleted completely, email us.
• Emails you send us: as long as we need them to answer you and to deal with what follows from your message.
• What the app keeps on your device: until you delete it, or delete the app.
• What the app keeps in your iCloud or in Google Block Store: until you delete it there. Deleting the app does not delete it.
• Services that decide themselves: GitHub's logs, Google's ad data, purchase records at Apple and Google, and the data that amiiboapi.org and Google search receive are kept under those services' own policies.

We do not sell your data

We do not sell your personal data.

In the free version, if you allow personalised ads, Google uses your device’s advertising identifier, together with information about the app and the ads you see, to choose the ads it shows you. Some US state privacy laws call this “sharing” personal data for targeted advertising, or treat it as a “sale”. To say no:

• if the app shows you Google's consent form, do not allow personalised ads there. Where the app offers it, Reset Consent in More shows the form again;
• on iPhone and iPad, do not allow tracking when Apple's prompt asks, or turn it off in Settings, Privacy & Security, Tracking;
• on Android, delete your advertising ID in your phone's settings, under Ads;
• or use Platinum, which shows no ads.

If you cannot find these settings, email info (at) nfc (dot) cool and we help you.

What you must give us, and automated decisions

No law or contract requires you to give us personal data. You can use the website and the app without telling us who you are. Some features need data to work: the newsletter needs your email address, and a purchase needs an App Store or Google Play account.

We make no decisions about you based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Testing different versions of screens and offers is not such a decision.

Your rights

Under the GDPR you have the right to:

• get a copy of your data and information about how we use it (Art. 15);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• have processing restricted (Art. 18);
• receive data you gave us in a machine-readable format and take it elsewhere (Art. 20);
• withdraw consent at any time, without affecting what happened before (Art. 7(3)): for ads as described in Ads in the free version, for the newsletter with the link in any newsletter, and for notifications in your device's settings.

Your right to object. Where we rely on legitimate interests (hosting the website, app analytics and crash reports, measuring our App Store ads, settings and tests, and answering your emails), you can object at any time, on grounds relating to your situation (Art. 21 GDPR). We must then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. Email info (at) nfc (dot) cool.

To exercise any of these rights, email info (at) nfc (dot) cool. We answer within one month. Much of the app’s data is linked only to identifiers for the app, not to your name. To find it, we may need your help, for example the Qonversion user id that the support email from the app includes. If we cannot identify you in some data, we tell you (Art. 11 GDPR).

You also have the right to complain to a supervisory authority, in the EU country where you live or work or where you think your rights were infringed. In Portugal, where we are based, that is the Comissão Nacional de Proteção de Dados (cnpd.pt).

For a business card account, the Business Card privacy policy explains how to download your data and delete your account.

Children

You must be at least 16 to use the app. If you are under 18, you need a parent’s or guardian’s permission to buy Platinum. Neither the app nor the website is directed at children. If you think someone younger than 16 has given us personal data, for example by signing up for the newsletter, email info (at) nfc (dot) cool and we will delete it.

Cookies and similar technologies

The website sets no cookies. It keeps two settings in your browser’s storage:

• theme: light or dark. On your first visit it stores your device's setting, and it changes when you switch the theme;
• preferredLang: the language you picked in the language menu, if you picked one.

On your first visit, the website can also take you to the version in your browser’s language. Both settings stay in your browser until you clear them, and neither is sent to us. They only show the website the way your device or your choice set it, which is why we do not ask for consent.

The app stores identifiers and choices on your device that Firebase, Qonversion and Google AdMob use as described above, including an identifier for the app at Firebase, the Qonversion user id, and your answers to Google’s consent form. For ads, storing and reading information on your device depends on your consent, as described in Ads in the free version. On Android, Google can set its own cookies in the Google search view.

Security

The website is served only over HTTPS: a plain HTTP request is redirected. On iPhone and iPad, the keys stored for your tags are protected with Face ID, and webhook user names and passwords are kept in the Keychain. On Android, the passport and ID wallet is encrypted with AES-GCM.

No system is completely secure, but we work to protect your data and fix problems quickly.

Changes to this policy

When we change this policy, we update the “Last modified” date at the top of this page.

Contact

Questions about this policy or your data: