Privacy policy

1. Who we are

xynn OÜ (Estonia) is the data controller for Reko. Contact: example@xynn.io.

2. What we store

Your account email, the content you put on your card (name, title, company, phone, email and links), the cards you collect (with your own tags and notes), and cumulative counts about your own card: views, link taps, contact-card saves, CV downloads, rolodex adds and removals, and referrals. Payments are processed by Polar; we never see card numbers. Pro uploads (profile photo, CV) are stored only while a Pro subscription is active and are permanently deleted the moment it ends; we keep no copies.

3. No cookies on public cards

Public card pages set no cookies and load no third-party trackers. View counting happens server-side; to avoid double-counting one visit we briefly hash your IP address and browser, discard it automatically, and never store it against your identity.

4. Your rights

Settings includes an export of your account data, meaning your card and your rolodex tags and notes (portability, Art. 20), and account deletion (erasure, Art. 17). Cards you collect are shown live from their owners: if an owner edits or deletes a card, your rolodex updates and only your own tags and notes remain. When you delete your account we erase your card, uploads, rolodex, counters and sign-in (people who collected you keep their own notes, but your card is no longer shown to them), and your address is released 30 days later.

5. Tailored cards and your email domain

If your employer commissions a tailored card, the part of your address after the @ decides whether that design is offered to you. We check it when you sign in and each time you apply a template; we store only the list of designs it unlocks, never a record of your employer. Change your email and the check simply produces a different answer. Nothing is kept from the previous one, and a card you can no longer use reverts to a free design on its own.

6. Sessions

Signing in stores a session on your device. Changing your email address ends every session everywhere and requires signing in again with the new address, because that address is what proves who you are. You can also end all sessions yourself from Settings.

7. Processors

Google Firebase (EU regions) hosts data and screens sign-up with Google reCAPTCHA; Resend sends transactional email; Polar handles billing. Optional product analytics (Google Analytics) run only on our marketing and app pages, only after you consent, and never on public cards; you can withdraw that consent at any time in Settings. Firebase Remote Config supplies our own contact addresses to the page so they are not harvested by scrapers; it stores nothing about you. Each processor handles data only on our instructions.