Privacy Policy for OnlyMaxon
Last updated: 9 November 2026 Effective date: 9 November 2026
The OnlyMaxon app (“the App”, “we”, “us”) is made and run by OnlyMaxon Studio, based in Poland. We decide what happens to the personal data described here — the data controller, in the wording of the GDPR. For anything on this page, write to [email protected].
This policy covers the OnlyMaxon app on both platforms — com.onlymaxon.cards
on iOS and com.onlymaxon.nfc on Android, which are the same app under two
names for reasons that have nothing to do with you — and the pages it publishes at
cards.onlymaxon.com. By creating an account you agree to it and to
the terms of use.
1. What the product is, in one paragraph
You are handed a physical card with an NFC chip inside it. The chip holds one web address and nothing else — no name, no phone number, nothing about you. Everything a visitor sees lives in our database instead, which is the point: you can change your phone number tonight and the card already in somebody's wallet is correct the moment they tap it. Reading this policy is mostly a matter of understanding that split.
2. What we collect
2.1 Your account
| Data | Required | Why |
|---|---|---|
| Email address | Yes | It is how you sign in, and it is how we know a card is yours. A card is created before you have an account, with your address written on it; confirming that address is the only thing that stops somebody else from claiming your card. |
| Password | Yes | Handled entirely by Google Firebase Authentication. It never reaches our own code and we cannot read it, not even to help you. |
2.2 What you put on the card
All of it is optional, all of it is typed by you, and all of it becomes public the moment you switch the card on: name, job title, city, a short description, phone number, email address, website, a list of services with prices, links to your other pages, the language the card opens in, and its colour.
Please treat these fields as what they are — a business card. Do not put anything there you would not hand to a stranger in a café, and do not put somebody else's personal data there without their agreement.
2.3 Your photograph
You may put a picture of yourself on the card. It is optional and the card is finished without one — a card with no photograph shows the first letter of your name, which is how it is meant to look rather than a gap waiting to be filled.
If you choose one, the App asks for your photo library or your camera at that moment and for nothing else: it does not read, index or upload anything else you have, and it does not keep the permission open for any other purpose. The picture you pick is cropped to a square and reduced to 512 pixels on your own phone, and only that small copy is sent to us. We store it in Google Cloud Storage, in a bucket that is closed to the public; the only thing that serves it is the page your own card opens.
That page is public. Anybody who taps your card, and anybody who is given its address, sees your face. This is the point of a business card, but it is worth saying plainly, because a photograph is not the same kind of thing as a phone number.
You can replace the picture or take it off at any time from the same screen. Removing it deletes the file — not just the link to it — and the card goes back to the letter. Deleting your account does the same thing before it does anything else.
2.4 The record of the card itself
Separately from your account we keep, for every card we produce: its address
(cards.onlymaxon.com/your-name), the email address it was issued to, the serial
number the chip's manufacturer burned into it, and the password that protects that chip from
being rewritten. This is our production record rather than your profile — you never see it
in the App, and it is what makes a lost or damaged card replaceable.
2.5 Technical records
Firebase Authentication records when an account was created and when it last signed in. Google Cloud keeps short-lived request logs for the service that renders your public page, which include IP addresses, as any web server does. We do not read these except when something is broken.
2.6 What we do not collect
No location. No contacts. Nothing from your photo library or your camera beyond the one picture you choose for your card, described above. No advertising identifiers, no analytics product, no tracking across other apps or sites, and no cookies on your public card page. We do not sell anything to anybody, and there is nothing here to sell.
3. The chip in your card
The App asks for permission to use NFC because that is how we write a card in the first place — on our own device, with you standing there, before you are handed it. Writing is protected by a password only we hold, which is also why a card cannot be rewritten by anyone who finds it.
If you are a cardholder rather than the studio, the App never touches a chip: you edit your card and nothing is read from or written to anything you are carrying. The chip itself counts how many times it has been read, in its own memory; that counter is a feature of the hardware, we do not collect it, and it says nothing about who tapped the card.
4. Your public page
A published card is readable by anyone who has its address, without signing in. That is the entire purpose of a business card and is not a leak — but it means the usual rule applies: assume anything on it can be read by anyone you give the card to, and by anyone they pass it on to.
We ask search engines not to index these pages, both in robots.txt and in
each page itself, because a card is something handed to a person rather than something to be
found by strangers. That request is honoured by the major search engines, but it is a
request and not a wall.
A new card is hidden until you choose to publish it, and you can hide it again at any moment with one switch in the App.
5. Who else sees it
One company, in one role: Google, as our processor, through Firebase and Google Cloud. Accounts live in Firebase Authentication, cards in Firestore, photographs in Cloud Storage, and the page a visitor sees is rendered by a Google Cloud function. Google acts on our instructions under its Data Processing Addendum.
Where the data physically is. Our Firestore database is in Google's
nam5 multi-region and your photograph is in a Cloud Storage bucket in
us-east1, both in the United States; the service that renders
your public page runs in Belgium. So your card content and your picture are stored outside
the European Economic Area, transferred under the European Commission's Standard
Contractual Clauses as incorporated into Google's terms. We would rather all of it sat in
Europe, and we are saying plainly that today it does not.
Apple and Google know you downloaded the App, on their own terms, and we receive nothing about you from either. Nobody else gets anything. We have never had a government request for this data; if we receive one we will comply only with a lawful order and, where the law allows it, tell you.
6. Our legal basis
| Data | Basis (GDPR Art. 6) |
|---|---|
| Your account and your card content | Performance of a contract — you cannot have a working card without them |
| The production record of a card | Legitimate interest — a card we cannot identify is a card we cannot replace or support |
| Technical and request logs | Legitimate interest — keeping the service running and secure |
7. How long we keep it
Your account and everything you typed: until you delete it. Deleting is in the App and takes effect immediately — see deleting your account.
The card itself: for as long as the physical card exists. We do not delete the row behind a card, because its address is printed on a piece of plastic in somebody's pocket and a deleted row turns that into a dead link with nothing to explain why. When you delete your account the card is emptied of your content and goes back to “not set up yet”, exactly as it was the day it was made.
The production record, including the address a card was issued to: kept while the card is in circulation, for the reason in section 2.3. Ask us and we will remove your email address from it as well — say so in the same message and we will do both at once.
8. Your rights
Under the GDPR you may ask us to show you the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or hand it to you in a portable form. Most of this you can simply do yourself in the App, which is faster than asking us.
For the rest, write to [email protected] from the address on your account. We answer within 30 days and normally within a few. If we get it wrong you can complain to your national supervisory authority — in Poland that is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
9. Children
The App is a tool for working professionals and is not intended for anyone under 18. We do not knowingly create accounts for children; if you believe we hold a child's data, write to us and we will delete it.
10. Security
Everything travels over HTTPS. Who may read or change a card is enforced by rules on the server rather than by the App, so a modified copy of the App gets refusals rather than somebody else's data — and reading a card you do not own is not something the service will do for anyone. Passwords are stored and checked by Firebase, hashed, never by us. No system is perfect; if you find a hole in ours, please tell us at [email protected] before you tell anyone else.
11. If this changes
We will change the date at the top and, for anything that actually affects you, say so in the App before it takes effect. Continuing to use the App after that means you accept the new version.