Privacy Policy

This policy applies to the Nomad Cairn website, iOS application, Public Cards, sign-in and save continuation flows, and related services (together, the “Service”). It applies whether you use the Service as an account holder, view a Public Card, or contact us for support.

The information we receive depends on how you use Nomad Cairn. It may include:

• Account and identity information, such as your verified email address, provider identifier, and limited account details received when you sign in with Apple or Google.
• Public Profile information you choose to add, including your name, profile photo, headline, bio, location and travel details, categories, skills, what you are working on, what you are open to or looking for, and public contact methods.
• Private Pal information, including names, photos, contact details, where and when you met, notes, and other relationship context you save for your own use.
• Save and connection workflow information, such as the profile you chose to save, related status, and the minimum context needed to complete that action.
• Release-interest choices, including whether you ask to be notified about Android availability.
• Messages and information you provide when you request support, exercise a privacy right, or otherwise contact us.

Another user may create a private Pal record about a person they have met. That record may include the person’s name, photo, contact details, meeting context, and private notes. These records belong to the user who created them and are not added to the other person’s Public Profile.

When eligible, Nomad Cairn may compare a Pal email address with a verified account email using an exact, normalized match on our servers. We use this only to support discovery, linking, and Save notifications. We do not reveal the matched account email to the other user.

When you use the Service, we may automatically receive limited technical information needed to operate and protect it, including:

• IP address and request metadata used for security, abuse prevention, rate limiting, and troubleshooting.
• Browser, device, and platform information used to present the appropriate Web or App handoff experience.
• Authentication and strictly necessary workflow cookies, including short-lived cookies that preserve a user-initiated Save while sign-in is completed.
• Operational, security, and failure logs. We design these logs to avoid private notes, full contact values, authentication secrets, and sensitive workflow tokens.

The iOS application requests Camera access only when you choose to scan a QR code or take a photo, and Photo Library access only when you choose a photo. You can change these permissions in iOS Settings. Nomad Cairn does not request microphone, contacts, or precise location access for its launch features.

The application stores authentication material in secure device storage and keeps limited preferences, such as language and storage-version information, on your device. Signing out or deleting your account clears account-scoped local state controlled by Nomad Cairn.

We use personal information to:

• Create and secure accounts, maintain sessions, and provide Apple or Google sign-in.
• Create and display Public Profiles and Public Cards using the information you choose to publish.
• Store private relationship memories and let each owner search, update, and manage their own Pals.
• Complete user-initiated Save, linking, notification, QR, vCard, and Web-to-App handoff flows.
• Protect the Service, prevent abuse, enforce rate limits, diagnose failures, and maintain reliability.
• Respond to support and privacy requests and send notices about the Service.
• Record and honor an explicit Android availability request, including a later withdrawal.
• Comply with applicable law and protect users, Nomad Cairn, and others.

Your Profile is public by design. Anyone who has its Public Card URL may view the public fields you have provided. We ask search engines not to index Public Cards, but that request is not access control. You can edit public fields or rotate your public URL; rotating it makes the previous Nomad Cairn URL unavailable.

Pal records, private photos, meeting context, private contact details, notes, and fallback values are visible only to the account that created them. Linking a Pal to a Public Profile, unlinking it, or receiving an update from that Profile does not transfer or overwrite the owner’s private memory.

A Save is a one-way action. It does not create a mutual relationship, confirm that two people have met, or give either person access to the other’s private records.

Where applicable law requires a legal basis, we process information as necessary to provide the Service you request and perform our agreement with you; with your consent for optional choices such as release-interest notifications and device permissions; for legitimate interests such as security, abuse prevention, service reliability, and support, where those interests are not overridden by your rights; and to meet legal obligations or protect vital rights.

We do not sell personal information. We do not share it for targeted advertising. We share information only as needed in the following circumstances:

• Infrastructure providers. Supabase provides authentication, database, and file-storage infrastructure. Vercel provides website hosting and request delivery. They process information on our behalf to operate the Service.
• Sign-in providers. Apple or Google process information when you choose their sign-in service, subject to their own terms and privacy policies. We request only the information needed for authentication.
• Actions you direct. Public Profile information is shared through your Public Card. Opening Email, Instagram, LinkedIn, WhatsApp, or another external contact action sends you to that third party under its own policies.
• Legal and safety reasons. We may disclose information when reasonably necessary to comply with law, respond to valid legal process, protect rights or safety, investigate abuse, or enforce these Terms.
• A business transition. If Nomad Cairn is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may be transferred subject to appropriate confidentiality and notice requirements.

Nomad Cairn is designed for people who live and work across countries. Our service providers may process information in countries other than the one where you live. Where required, we rely on recognized contractual or other lawful safeguards for these transfers. Local privacy laws may differ from those in your country.

We keep account, Profile, Pal, photo, and related service data while your account is active and as needed to provide the Service. Short-lived Save, sign-in, handoff, and rate-limit records expire when their operational purpose ends. Notification and discovery status may remain with your account so that choices such as dismissing a suggestion are respected. Release-interest records remain until you withdraw, the requested notice is completed, or the record is no longer needed.

You can start account deletion from Settings in the iOS application. We may ask you to confirm or reauthenticate before deletion. We then delete or de-identify your account and service-controlled content unless limited retention is reasonably necessary for security, fraud prevention, legal compliance, dispute resolution, or enforcing agreements.

Deletion may take additional time to pass through routine backups and security records. It cannot recall information another person independently saved, a vCard or photo you exported, information already sent to an external contact service, or copies outside Nomad Cairn’s control.

You can edit or remove Profile fields, rotate your public URL, manage Camera and Photo Library permissions in iOS Settings, withdraw an Android availability request, sign out, and delete your account from the application.

Depending on where you live, you may also have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, or an explanation of how we use your information. You may submit a request to legal@nomadcairn.com. We may need to verify your identity before acting on a request. Applicable law may permit or require limited exceptions.

The website uses only cookies and similar storage that are strictly necessary for authentication, security, and user-requested workflows. Nomad Cairn does not use advertising cookies or cross-site behavioral analytics. Because we do not track people across third-party websites for advertising, the Service does not respond differently to browser “Do Not Track” signals. If we introduce non-essential tracking, we will update this policy and implement any consent controls required before using it.

We use reasonable technical and organizational measures intended to protect information, including authenticated access, owner-based data boundaries, restricted server credentials, secure transport, protected device storage, and limited logging. No service can guarantee absolute security. Please protect your sign-in provider account and tell us if you believe your Nomad Cairn account has been compromised.

Nomad Cairn is intended only for people who are at least 18 years old. We do not knowingly offer the Service to children. If you believe a person under 18 has provided personal information through the Service, contact us so we can review and take appropriate action.

Privacy rights vary by location. Where applicable, you may lodge a complaint with your local data protection or privacy authority. We encourage you to contact us first so we can try to address your concern, but doing so does not limit any right to contact an authority.

We may update this policy as the Service, our practices, or applicable requirements change. We will post the updated policy with a new effective date and provide additional notice when a change is material and notice is required.

For questions, privacy requests, or concerns about this policy, email legal@nomadcairn.com.