Privacy Policy

We collect only what we need to operate the Service:

• Account data: your name, email address, and a securely hashed password when you create an account.
• WhatsApp number data: the phone number you register, its country and region, and a display name you choose. Registered numbers are made discoverable to other signed-in members in the global directory.
• Usage data: basic activity such as VCF downloads, sync events, and referral shares, used to power your dashboard analytics.

If you choose to connect your Google account, we use Google OAuth and the Google People API to help you grow your contacts. We request the following scopes:

• .../auth/contacts — to create contacts in your Google Contacts on your behalf.
• .../auth/userinfo.email — to identify which Google account is connected.

How we use it: we use this access solely to add verified directory contacts into your Google Contacts (including an optional background auto-sync so new contacts arrive even when you are offline). We only ever create contacts; we do not read, modify, or delete your existing Google contacts.

Storage: we store your Google OAuth access and refresh tokens and your Google account email so background sync can run. Tokens are stored securely and used only for the purpose above.

Limited Use disclosure: our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising and do not sell it.

• To provide, maintain, and improve the Service.
• To make registered WhatsApp numbers discoverable to other members.
• To generate VCF exports and sync contacts to Google when you enable it.
• To display analytics and protect against abuse, spam, and duplicate numbers.

We do not sell your personal information. WhatsApp numbers you register are intentionally shared with other signed-in members through the directory and exports — this is the core purpose of the Service. We may share data with infrastructure providers (hosting and database) strictly to operate the Service, and where required by law.

You can remove your registered WhatsApp number at any time from your dashboard, which removes it from the directory. You can disconnect Google at any time from the Sync page, which deletes the stored Google tokens and stops all background sync. To delete your account and associated data entirely, contact us and we will process the request.

Passwords are hashed, sessions are signed, and database access is scoped per user. Communication with the Service is encrypted in transit. No method of storage or transmission is 100% secure, but we take reasonable measures to protect your data.

The Service is not directed to children under 13, and we do not knowingly collect their data.

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

For privacy questions or data deletion requests, contact us at privacy@hostify.co.zw.