Privacy Policy

Comeriver Limited operates Contacts++: Share & Connect. This policy explains how we handle information across our mobile apps, web app, websites, communications and support services under the Nigeria Data Protection Act and other applicable law.

Information we process

We process verified identifiers, profile and contact-card information you provide, device and session records, security diagnostics, messages, posts, media, support requests, purchase entitlements and your privacy preferences.

Contact discovery

With permission, the mobile app sends normalized phone numbers securely to our API for matching; the API derives purpose-specific discovery tokens and match records. Names, notes, addresses and unrelated phonebook fields are not uploaded solely for discovery. You can disable discovery and revoke contact permission.

Contact backup and updates

Backup saves a copy of your contacts where you choose: your Contacts++ account, or your own Google Drive (Android) or iCloud (iPhone). Backups in your Contacts++ account are encrypted at rest on our servers; backups in Google Drive or iCloud are kept in a private app folder protected by that account. You can turn on end-to-end encryption, which encrypts the backup on your device with a key only you hold (your recovery key), so that neither we nor Google nor Apple can read it. Automatic backup is included with Premium. You can turn backup off and delete backups at any time. When people you are connected with change their name, photo or shared details, Contacts++ updates their entry in your phone's contacts according to your synchronization settings, keeps the previous name searchable, and lets you undo the change.

Calls

Voice and video calls between members connect directly between the two devices or, when a direct connection is not possible, through a relay operated by Cloudflare. We never record or store call audio or video. Connection messages pass through our servers and are held in memory for up to two minutes to deliver them. We keep a call record (who called whom, when, how long, how it ended, whether it was relayed, connection-quality totals and any rating or comment you give) for your call history, your chats, support and service quality. The microphone is used only during calls you make or answer and for voice notes you record; the camera only when you turn it on, and it pauses when the call is out of sight.

Location

Contacts++ uses location when you share it in a chat or start or respond to a Safety Circle incident. Chat locations are sent to that chat; Safety location may update while the active incident screen is running, according to your emergency settings.

Safety Circle

When you start a Safety Circle alert, or a check-in you set isn't confirmed in time, Contacts++ shares your alert, location and, unless you turn audio off in your emergency settings, live audio from your microphone with the Safety Contacts you chose. Location and audio are stored encrypted, shown only to you and those contacts, and deleted 30 days after they were captured. Safety Circle never runs unless you start it or set a check-in. Test alerts are clearly marked as tests for your contacts.

Crash reports

If the app crashes or a call fails, a diagnostic report (app version, device model, operating system and the error) is sent to Sentry so we can fix it. Reports do not include your contacts, messages or call content.

How information is used

We use information to authenticate accounts, provide safe synchronization and communication, enforce your audience choices, prevent abuse, verify store purchases, answer support requests and comply with law.

Processors and transfers

Our processors include our hosting provider, Google/Firebase for push delivery and diagnostics, Cloudflare for call relays, Sentry for crash reports, Termii and optional Twilio for SMS verification, Mailgun for email delivery, Apple or Google for store purchases, and Google Drive or Apple iCloud when you choose them for backups. They process only what is necessary under contractual and security safeguards; international transfers use applicable protections.

Retention

Discovery records are normally pruned after 45 days without refresh, expired verification challenges and draft uploads are routinely removed, and revoked sessions are pruned. Account deletion hides the account immediately and schedules personal-data purge after 30 days, except narrowly retained security, dispute, transaction, or legal records.

Your rights and choices

You may access, correct, export, restrict, object to processing of, or request deletion of applicable personal data. Use the in-app Account & security tools or the account deletion page. You may also complain to the Nigeria Data Protection Commission.

Security, children and contact

We apply technical and organizational safeguards, though no system is perfectly secure. Contacts++ is not directed to children below the applicable digital-consent age. Contact [email protected] with privacy questions or rights requests.