MeishiPrivacy policy
Effective 21 October 2026. Applies to getmeishi.app and the Meishi wallet passes.
Meishi is a business card that lives in Apple Wallet and Google Wallet. Someone scans your QR, reads your card on a web page and saves you to their contacts. This policy says what information Meishi holds to do that, where it goes, and how you remove it. Meishi is operated by Gary Cox at getmeishi.app. Questions go to hello@getmeishi.app.
What you give us
- Your account. Your name and the email address you sign in with. If you sign in with Google or Apple, they tell us that address and your name; we do not receive your password.
- Your cards. The details you put on a Work or Home card: email, phone, company, title, address, website, which of those to show, a colour, a company logo, a greeting line, and an optional second-language side.
- Your profile. An optional photo, how to pronounce your name, and an optional short voice clip of you saying it.
- Your card holder. Notes you write beside the cards you receive, the event you met at, meeting tables you arrange, and a reminder date.
- Company branding. If you give a Work card a company website, our server fetches that site once to find its logo and colour. You confirm the result before it is used. The company's site sees a request from our server, not from you.
What the people you meet give us
- Sent details. When someone sends their details back from your card page, we keep what they typed: name, email, and any of phone, company, title and address, plus a greeting line if they wrote one. They need no account for this.
- Reading time. The card page notes how many seconds it was open before the reader chose to save or send details, capped at an hour. It is shown to the card's owner as a hint that the card was read. It is not tied to any identifier beyond the exchange itself.
- Paper cards. If you photograph a paper card, the photo is sent to Anthropic's Claude to read the printed text, and the text comes back to a form you check and save. We do not keep the photo. Anthropic processes it under its API terms and does not train on it.
What happens on its own
- Sign-in cookies. Supabase, our sign-in provider, sets session cookies so you stay signed in. There are no advertising or analytics trackers on getmeishi.app.
- Server logs. Netlify, which hosts the site, keeps standard request logs (IP address, browser type, page requested) for a short period for security and debugging.
How we use it
To show your card to people who scan it, to put it in their wallet or contacts, to keep your card holder, and to send the emails the service is made of: a sign-in code, a copy of a card someone sent you, a note that someone saved yours, a one-line reply, and a single reminder two days after a meeting. We do not sell information, do not build marketing lists from it, and do not send marketing email.
Who can see your card
Your card page is unlisted: it is reachable only through the long random link in your QR code, and search engines are asked not to index it. Anyone who has that link can see what you chose to show. You can issue a new link at any time; the old one then shows "no longer active". The wallet pass carries your name, company, title and the QR, nothing more.
Services we rely on
- Supabase (United States) stores the database, files such as photos and voice clips, and runs sign-in.
- Netlify hosts and serves the site.
- Resend delivers our email.
- Cloudflare provides DNS for getmeishi.app.
- Google and Apple, when you sign in with them or add a pass to their wallets. Their own policies apply to what they keep.
- Anthropic, only when you use the paper-card scanner, as described above.
Each of these processes data on our instructions and under its own security commitments. We do not share your information with anyone else except when the law requires it.
Google Contacts
If you connect Google Contacts, Meishi adds the people you exchange cards with to your Google contacts and keeps those entries up to date. It is one way: Meishi writes contacts it created and reads back only those same entries so it can update them. It does not read your other contacts, your email or anything else in your Google account. We store an encrypted token that lets us do this; you can disconnect on your Profile page at any time, which deletes the token. Meishi's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Keeping and deleting
We keep your information while you have an account. You can delete the account yourself at any time from the Profile page, under "Delete account". Deletion is immediate and complete: your profile, photo and voice clip, your cards and their wallet passes, every card in your holder with your notes and meetings, and your Google Contacts connection are erased, along with the sign-in account itself. Your cards also disappear from the holders of everyone you gave them to, and so do the details other people sent you. Nothing is kept in a recoverable form. Contacts that Meishi already wrote to your Google account stay there, because they are in Google, not in Meishi. Backups of the database are kept by our database provider for a short period, currently seven days, and are then gone.
If you would rather we did it, or you can no longer sign in, email hello@getmeishi.app from your sign-in address and we will delete the account within 30 days. Someone who sent you their details without an account can ask us the same way to have them removed.
Your rights
You can see and change everything on your cards and profile in the app, download any card as a vCard, and delete your account yourself. You can also ask us for a copy of what we hold, ask us to correct it, or object to how we use it, by emailing the address above. Depending on where you live you may have further rights under laws such as the GDPR or the CCPA; we honour them for everyone.
Security
Everything travels over HTTPS. Database access keys live only on the server. Google tokens are encrypted at rest with a key the database never sees. No system is perfect; if we learn of a breach affecting you, we will tell you.
Children
Meishi is for working adults. It is not directed at anyone under 16, and we do not knowingly keep their information.
Where your data lives
Our servers are in the United States. If you use Meishi from elsewhere, your information is transferred there.
Changes
If this policy changes in a way that matters, we will say so on this page and, for account holders, by email. The date at the top is the current version.