Privacy Policy

1. About This Policy

This Privacy Policy explains what data the Contacts for Nextcloud extension ("the Extension", "we", "our") collects, stores, and shares — and what it does not. It is written in plain language so you can understand exactly how your data is handled. By installing or using the Extension you acknowledge that you have read and understood this policy.

2. About Contacts for Nextcloud

Contacts for Nextcloud is a Chrome extension that provides fast, private access to your Nextcloud address books directly from your browser toolbar. It connects to the Nextcloud server you configure and lets you search contacts, copy phone numbers and email addresses, manage favourites, and receive birthday reminders.

The Extension does not generate content, host a server, collect analytics, or transmit any data to the developer. All contact data syncs directly between your browser and your own Nextcloud server.

3. Data We Collect

The Extension stores the following data locally on your device only:

• Credentials. Your Nextcloud server URL, username, and an app-specific password used to authenticate with your server. Both login methods — Browser Login (Login Flow v2) and manual App Password — result in a Nextcloud-issued app password being stored. Your main Nextcloud account password is never requested, seen, or stored. All credentials are encrypted with AES-256-GCM before being saved.
• Contacts. Your vCard contact data (name, email addresses, phone numbers, birthdays, organisation, notes, photo) cached locally so the extension works offline and syncs efficiently. Sensitive fields — name, email addresses, phone numbers, and notes — are encrypted at rest using AES-256-GCM.
• Settings. Your sync interval preference and whether birthday notifications are enabled.
• Sync metadata. Timestamps, pending sync queue entries, and birthday notification records used to keep your contacts up to date with your server.

None of this data ever leaves your device except as part of the direct, encrypted HTTPS connection to your own Nextcloud server.

4. Data We Do NOT Collect

We do not collect, transmit, or store any of the following:

• Personal identifiers such as your name, email address, IP address, or device ID.
• Usage data, telemetry, crash reports, or analytics of any kind.
• Browsing history or activity on other websites.
• Contact content or any Nextcloud data outside your own device and your own server.
• Payment or financial information.

The Extension contains no analytics SDKs, no tracking pixels, no third-party advertising, and makes no outbound network requests except to your configured Nextcloud server and the Polar.sh checkout service described in Section 6.

5. Chrome Permissions — Why We Request Them

• storage — Saves your encrypted credentials, cached contacts, and preferences to chrome.storage.local on your device.
• alarms — Schedules periodic background syncs with your Nextcloud server at the interval you choose, and daily birthday checks.
• notifications — Displays birthday reminder notifications on a contact's birthday. No notification data is transmitted externally.
• clipboardWrite — Copies contact details (phone numbers, emails) to your clipboard when you click a copy button. The Extension never reads clipboard contents.
• optional_host_permissions (<all_urls>) — Requested only at runtime when you provide your Nextcloud server URL. Required to allow the Extension to make CardDAV API calls to the domain that hosts your Nextcloud instance. No access is granted to any other site.

6. Third-Party Services

The Extension includes an optional "Support the project" section powered by Polar.sh. If you choose to donate:

• Clicking a donation button opens a Polar.sh checkout page in a new browser tab. You interact directly with Polar.sh and their privacy policy applies.
• The Extension itself receives no payment data and stores nothing from the donation flow.
• Donating is entirely optional and has no effect on extension functionality.

Polar.sh privacy policy: https://polar.sh/legal/privacy

7. Trademark & Affiliation Disclaimer

"Nextcloud" and the Nextcloud logo are trademarks of Nextcloud GmbH. "CardDAV" refers to an open IETF protocol standard (RFC 6352). This extension is an independent community project and is not affiliated with, endorsed by, or supported by Nextcloud GmbH in any way. All trademarks belong to their respective owners. Use of these names is nominative fair use to describe interoperability only.

8. Your Rights & Control Over Your Data

Because all data is stored locally on your device, you have complete control:

• Access. Open the extension options page to view your connected server and credentials.
• Delete. Click "Disconnect" in the options page to wipe all stored credentials and cached contact data instantly. Uninstalling the extension removes all stored data from your device.
• Portability. Your contact data lives on your own Nextcloud server and in your browser's local storage — no account or export request to us is needed.
• No account required. The Extension requires no registration or account with the developer.

9. Children's Privacy

The Extension is not directed at children under the age of 13. We do not knowingly collect any information from children. If you believe a child has used this Extension, please contact us at the address in Section 15 and we will assist however we can.

10. Security

• Credentials and sensitive contact fields are encrypted on-device using AES-256-GCM via the browser's built-in Web Crypto API before being saved to storage.
• A random 12-byte IV is generated per encryption operation and stored alongside the ciphertext.
• All communication with your Nextcloud server uses HTTPS.
• The published extension code includes SHA-256 integrity checks that halt execution if any extension file has been tampered with after installation.

Despite these measures, no security measure is 100% effective. If you discover a security issue, please contact us privately before disclosing it publicly.

11. Transparency & Open-Source Intent

The source code for this extension is available for inspection. The extension contains no minified third-party bundles from external CDNs, no dynamically loaded scripts, and no eval() calls. The published build is optimised and minified for performance, but the original source code remains auditable on request.

12. Legal Rights, Fair Use & DMCA

All original code in this Extension is copyright of its authors. The Extension accesses Nextcloud's public CardDAV API solely to provide interoperability. The Extension does not scrape, harvest, or circumvent any access controls. If you believe any content in this Extension infringes your rights, please contact us at the address in Section 15 with a description of the concern and we will respond promptly.

13. International Users & GDPR

This Extension stores data only on your local device and does not transmit personal data to any server we control. As such, standard data-controller obligations under GDPR, CCPA, or similar regulations do not apply to us. If you use this Extension within the EU, your contact data remains on your own device and on your own Nextcloud server under your own control. You are the sole data controller of any personal data stored locally.

14. Changes to This Policy

We may update this policy as the Extension evolves. The "Effective Date" at the top will reflect any changes. Continued use of the Extension after an update constitutes acceptance of the revised policy. For significant changes we will include a note in the Chrome Web Store release notes.

15. Contact

For privacy questions, bug reports, feature requests, or any other feedback:

We aim to respond to all inquiries within 5 business days.