Privacy Policy — AddFace2Contact
Effective date: 7 October 2026
Last updated: 18 October 2026
AddFace2Contact ("the app") is published by VULANDER.NET PTE. LTD. ("we", "us"), a company registered in Singapore. This policy explains exactly what the app does with data, including the data you never have to take our word for because the app never sends it anywhere.
Questions, requests or complaints: david@vulander.net
1. The short version
AddFace2Contact fills in the contact photos your address book is missing. To do that it reads your contacts on your device and writes a photo back to the card you choose.
- Your contacts are never uploaded. They are read from, and written to, Apple's Contacts database on your device.
- Your photos are never uploaded. A photo you pick for the AI head-shot feature is handed to Apple's Image Playground on your device.
- There is no account, no sign-in and no profile. We cannot identify you.
- The app detects where a face is in a photo, on your device, purely to crop it. That is not facial recognition: nothing is identified, no faceprint is made, and nothing about it leaves the device. Section 2.1.
- There is no advertising or attribution software in the app, and no advertising identifier is read or used.
- There is anonymous usage analytics, and it is off until you switch it on. The app asks on its second screen and takes no for an answer; there is a switch in Settings either way. Turned on, it records that an event happened — a screen was reached, a photo was applied, a search failed — and never what you searched for or who is in your address book. Section 3.4 explains what they do and do not contain.
- We do not sell, rent or share personal information, and we do not track you across other apps or websites.
- The only things that leave your device are a search term — the text in the search box, which the app pre-fills with a contact's name and which you can edit — and, if you switched them on, the anonymous usage events in 3.4, plus the technical request data described in section 3.
2. Data that stays on your device
The following never leaves your device, is never transmitted to us, and is deleted when you delete the app.
| What | Why it exists | Where it is kept |
|---|---|---|
| Your contacts (names, and the company and city used to refine a search) | To show you which contacts have no photo, and to write a photo to the right card | Read live from Apple's Contacts database; the app keeps no copy of your address book |
| Contact photos, including the photo that was there before a change | So every change can be undone | Local app database (SwiftData) |
| A change history (contact name, time, success or failure) | The undo list | Local app database (SwiftData) |
| A photo you select from your photo library for an AI head shot | It is the input to Apple's Image Playground | Held in memory for the duration of the task |
| Your appearance preference and the single onboarding question ("why are you here") | To set the theme and choose which sentence to show you | Local preferences (UserDefaults) |
| A count of photos applied this month | To apply the free monthly allowance | Local preferences (UserDefaults) |
| An App Attest key reference and a short-lived access token | So the search service can tell a genuine copy of the app from an automated abuser | Apple Keychain, device-only |
Deleting the app removes all of it. We hold no copy and cannot restore it.
2.1 Finding the face in a photo
Every photo the app is about to save — whether it came from the web or from Image Playground — is run through Apple's Vision framework, on your device, to find where the face is, so the picture can be cropped to a square that is actually centred on the person rather than on their shoulder.
This is face detection, not face recognition: it locates a rectangle and nothing else. It does not identify anyone, it does not produce a faceprint, template or any other biometric measurement, and it does not compare the photo against any other photo or any database. The rectangle exists only in memory for the moment it takes to crop, is never written to storage, and is never transmitted — to us or to anyone. Nothing about it is shared with any third party, because there is nothing to share.
3. Data that leaves your device
3.1 Your search term
When you run a web image search, the app sends the text in the search box to our server, which passes it to an image-search service. The box is pre-filled with the contact's name (and a company or city if you add one); you can edit it before searching.
The search term is sent on its own — no contact record, phone number, email address, photo, device name or account identifier goes with it, and we do not log it against you or your device. Our server keeps a short-lived cache of results, keyed on the search text with no identifier attached, which expires within 24 hours.
Because a contact's name is personal data belonging to that person, please see section 8.
3.2 Device attestation and quota counters
Before the first search, the app proves it is a genuine, unmodified copy using Apple's App Attest. Our server keeps one row per install so it can block abuse and keep the free tier affordable. That row holds, in full:
| Field | What it is |
|---|---|
| Key ID | The random identifier Apple creates for this app on this device |
| Public key | The matching public half of the attestation key, used to check each signature |
| Validation category | Whether the copy came from the App Store or TestFlight |
| Bundle version | Which build of the app attested |
| Signature counter | A number that only ever goes up, so a replayed request can be spotted |
| First attested / last used | Two timestamps |
Alongside it we keep a monthly search count, stored against the same key ID.
That key ID is not the advertising identifier and not an Apple ID. It tells us "a copy of this app made N searches this month" and nothing more — we cannot use it to identify you, contact you, or link you to anything you do outside this app. It resets if you reinstall the app, and the counters expire within 60 days.
3.3 Technical request data
Like any internet service, our server processes the connection data inherent in an HTTPS request — your IP address, timestamp and user agent — for delivery, security and abuse prevention. We do not use it for analytics, profiling or advertising, and we do not build records about users from it.
When the image-search provider returns an error, our server writes that error to its own diagnostic log so we can tell a broken integration from a bad query. Those entries hold the provider's response, not your search term.
3.4 Anonymous usage analytics
This is off unless you turn it on. The app asks, on the second screen you ever see, whether it may count what happens inside it. The switch starts off, nothing is sent before you answer, and the app behaves identically either way. If you say no, that is the end of it — you will not be asked again.
You can change your mind at any time: menu → Settings → Send anonymous usage data. Turning it off stops collection immediately, within the same session and without relaunching the app.
If you do turn it on, here is exactly what that means.
We count what happens in the app so we can see which screens people get stuck on and which features fail — the things we cannot fix if we cannot see them.
Each event is a short, fixed name with a handful of fixed labels: a screen was reached, a search came back empty, a photo was applied. There is no free text in any of them — no contact name, no contact identifier, none of the text you type in the search box, no result image or website, and no photo data. Counts that describe your address book are sent as a band ("51-200") rather than an exact figure.
Three kinds of label ride along with every event, and they are worth naming because they are what our App Store privacy label declares:
- How the app is set up for you — whether Contacts access is granted, whether this iPhone can generate AI head shots, and whether you have bought the one-time unlock. The last of these is why the label lists Purchase History; it is a yes/no about this install, and we never see your payment details (see 3.6).
- What went wrong, when something does — why a search failed, why a photo could not be applied, and roughly how long a search took. This is the label's Diagnostics entry. We collect no crash logs: the app contains no crash reporter.
- Ordinary device context, added by the analytics tool itself — app version, iOS version, device model, locale, screen size, time zone, light or dark mode, and your accessibility display settings. There is no switch to turn this off, so we disclose it rather than pretend otherwise. We have turned off the two parts that can be disabled: the tool's own session counters and its automatic session events.
Events are grouped under a one-way hash the app derives on your device. There is no step that takes us from it back to you, and because it is specific to this app, the same iPhone produces a different hash in our other apps.
Turning the switch off, or deleting the app, ends collection. There is nothing for us to delete on request, because we cannot tell which events are yours — the honest answer is that the switch is the control, not an erasure request.
3.5 Images loaded from other websites
Search results are photos hosted on other people's websites. When the app shows a result, your device loads that image directly from the site hosting it, so that site sees your IP address and standard request headers, exactly as if you had opened the image in Safari. Those sites are not our partners and handle the request under their own policies. The image is saved only if you choose it and apply it to a contact.
3.6 Purchases
The one-time unlock is sold by Apple through in-app purchase. Apple handles the payment and tells the app only whether the unlock is active. We never receive your name, payment card, billing address or Apple ID.
3.7 AI head shots
The AI head-shot feature uses Apple's Image Playground, built into iOS. The photo you choose and the result are handled by Apple on your device. Nothing in that feature is sent to us, and it works with no network call to our servers at all.
4. Why we process this data, and our legal basis
- To return results for the term you searched, and to honor your purchase — performance of a contract (GDPR / UK GDPR Art. 6(1)(b)). It is the service you asked for.
- To prevent fraud and abuse, control what the service costs us to run, and keep it secure and available — legitimate interests (Art. 6(1)(f)).
- To understand which parts of the app work and fix the parts that fail — your consent (Art. 6(1)(a)), asked for on the app's second screen and withdrawable at any time from Settings without giving a reason and without losing any functionality. Withdrawing it does not affect the lawfulness of what was processed before. See 3.4.
We do not process special-category data, we do not profile you, we do not combine the usage events in 3.4 with anything else, and no decision about you is made by automated means.
5. Who we share data with
We have no advertising or data-broker relationships, and we do not sell data to anyone.
Data reaches only the service providers that make the app work, each acting on our instructions and under its own privacy terms:
| Who | What they receive | What for |
|---|---|---|
| Cloudflare, Inc. | The HTTPS request itself — connection data, the search term on its way through, and the attestation row and counters described in 3.2 | Hosts and runs our server |
| Serper (which queries Google Images) | The search term only — a name, optionally plus a company or city. Not your IP address, which is ours, not yours, by the time the request reaches them | Runs the image search |
| TelemetryDeck GmbH (Germany) | The anonymous usage events in 3.4 — only if you switched them on | Processes our usage analytics |
Apple additionally handles App Attest, in-app purchase, Image Playground, and Contacts and Photos access on your device.
We name these providers rather than describing them generically because you cannot meaningfully judge a privacy policy that will not tell you who is actually involved.
Separately, a website hosting a result image sees your IP address when your device loads that image; those sites are not our processors (see 3.5).
We may also disclose data if required by law, or to establish, exercise or defend legal claims — given how little we hold, there is very little to disclose.
6. International transfers
We are in Singapore, and our providers operate internationally — including in the United States and inside the EEA. Requests are served from the location nearest you, so data may be processed outside your own country. Where you are in the EEA, the UK or Switzerland, those transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) in our providers' data processing terms, or another lawful transfer mechanism.
7. How long data is kept
| Data | Retention |
|---|---|
| Contacts, photos, history and preferences on your device | Until you undo the change, clear the history, or delete the app |
| Cached search results | Up to 24 hours, then automatically discarded |
| The attestation row in 3.2, and search counters | While the install remains active; counters expire within 60 days |
| Anonymous usage events | Per our analytics retention period. They carry no identifier we can resolve to a person, so there is nothing in them for us to look up, correct or delete on request |
| Security and connection logs | Standard retention for our infrastructure; we do not extend it or export it |
We keep no user database, so there is nothing we retain about you beyond the above.
8. Searching for other people
A contact's name is personal data belonging to that person, and an image search for a name may return photographs of them or of someone else entirely.
- You decide what to search for and which photo to apply. Please use the app lawfully, and only for your own address book.
- Results come from a public web image index. We do not verify that a result depicts the person named — the app is a convenience for your own contact cards, not an identity or background-check tool.
- Photographs may be protected by copyright or by the subject's own rights. Applying one to a contact card on your device is a private use; publishing or redistributing it is not.
- If your photograph appeared in a result, it is hosted by a third-party website and indexed by a search engine, not by us, and we cannot remove it from either — those requests go to the website operator or the search engine. Our cache holds results for at most 24 hours.
9. Your rights
Depending on where you live, you have rights over your personal data. Because the app has no accounts, the fastest route for almost everything is the app itself: your contacts, photos, history and settings live on your device, and deleting the app erases them permanently.
For the little our server holds, you may ask us to confirm what we hold, correct it, delete it, restrict or object to its processing, or receive a copy. Email david@vulander.net and we will respond within 30 days.
- EEA / UK (GDPR): the rights above, and the right to complain to your supervisory authority.
- California (CCPA/CPRA): we do not sell or share personal information, or use it for cross-context behavioral advertising, so there is nothing to opt out of. You may still request access, deletion or correction, and we will not discriminate against you for asking.
- Singapore (PDPA): access and correction requests go to the same address.
One honest limitation: our server identifies that data only by a random key ID your device holds, which we have no way to tie to you. If you ask us to delete "your" data we may be unable to find it — deleting the app retires that key ID entirely.
10. Children
AddFace2Contact is a productivity utility and is not directed at children. We do not knowingly collect personal information from children under 13 (or the equivalent age in your jurisdiction). If you believe a child has provided personal information to us, contact david@vulander.net and we will delete it.
11. Security
- All network traffic uses HTTPS/TLS.
- The search service is reachable only by a genuine copy of the app, with per-install rate and quota limits.
- API keys live on the server, never in the app binary.
- Device secrets are stored in the Apple Keychain, marked device-only and left out of backups.
- Contacts and photos are not transmitted, which removes the largest risk entirely rather than mitigating it.
No system is perfectly secure, but there is no account to compromise and no store of personal data to breach.
12. Changes to this policy
If we change how the app handles data, we will update this policy and move the "Last updated" date. Material changes will be announced in the app's App Store release notes. Continuing to use the app after a change means you accept the updated policy.
13. Contact
VULANDER.NET PTE. LTD. — data controller
22 Sin Ming Lane, #06-76 Midview City, Singapore 573969
Registered in Singapore, UEN 202639834K
Email: david@vulander.net
This policy is governed by the laws of Singapore, without prejudice to data protection rights you hold under the laws of your own country.