SHOOT

Privacy Policy

Last updated 31 October 2026

SHOOT has no accounts and no database. Your cards live on your phone. The only thing our server ever holds is a huddle in progress, in memory, for about a minute — and then it is gone.

Nothing is collected

Every app has to say whether it collects your data, and collecting means keeping it: storing what leaves your phone for longer than it takes to answer the request it was sent with. SHOOT's answer is that it does not, and here is exactly what that means.

A shoot sends your card and your rough position to our relay, because working out which phones are standing together cannot be done on your phone alone. The relay holds them in memory for the minute the huddle lasts, passes your card to the people you and they both chose to keep, and destroys all of it. None of it is written to disk, none of it is logged, and there is no database for any of it to sit in.

So there is no copy of your card on our side, no record that a huddle ever happened, and nothing about you for us to look up, hand over, or lose.

What stays on your phone

All of this is stored on your device and is never sent to us:

• Your phone number. It is how the app knows it is set up. It is only ever shared with somebody if you put it on your card and you both keep each other in a shoot.
• Cards you receive. The people you have swapped with.
• Your labels and notes. How you file people, and anything you write on the back of their card. These are your opinions and they are never shown to the person concerned.
• Your block list. Permanent, private, and never sent to us. The person is not told.

Your phone's own backup

Phones back apps up by default, and SHOOT is not an exception: an Android phone to your Google account, an iPhone to your iCloud. So a copy of what is listed above may sit in your own Google Drive or iCloud, which is what lets a new phone restore your cards instead of starting empty. You can turn it off in your phone's backup settings.

That copy is yours. It goes to your account, not to us, and we have no way to reach it — but it would be wrong to say this data never leaves the phone when your phone may be sending it somewhere on your behalf.

Location

When you tap SHOOT, your phone sends its position to our server so it can work out which phones are standing next to each other. It is used for that and nothing else.

Your position is held in memory for the length of the huddle — at most about a minute — and is discarded when the huddle ends. It is never written to disk, never logged, and never linked to you afterwards.

Location is only read while you are actively using the app. SHOOT does not track you in the background.

Your contacts

If you turn it on, SHOOT reads your phone's address book to show your contacts as cards. They are read fresh each time and never copied to us or anywhere else. Turning it off forgets them immediately.

If you ask it to, SHOOT can also save cards you have kept into your phone's own contacts, so you can ring people without opening the app.

Photos and business cards

A photo you add to your card is stored on your phone and is shared with people you swap with, as part of your card.

When you photograph a paper business card, the picture is read on your phone. The image is never uploaded. Only the words it contains are kept, as a card, on your device.

Instagram and LinkedIn

You can add your Instagram and LinkedIn to your card. SHOOT keeps only the handle, such as sunil.k, and never signs in to either service or reads anything from them. The handle travels with your card, like your email address, and opens your profile when somebody taps it.

Sending a card by link or contact file

You can send a card by message, on WhatsApp or anywhere else. You choose who gets it, and it goes through the app you pick, under that app's own privacy terms.

As a link. The card is written into the link itself, in the part after the #. Browsers never send that part to a website, so when somebody opens the link, shoot.cards receives a request for the page and not the card. The card is read and shown in their browser, or in SHOOT if they have it. A messaging app that shows a preview of the link fetches the same picture for every card, because it cannot see whose card it is either. Photos are not put in links.

One exception: a link saved in a phone's contacts. Some Android contact apps throw away everything after a # when you tap a website, so the card link SHOOT writes into a contact carries the card after a ? instead. When that link is opened, the request to shoot.cards includes the card. We do not store it, but our web host, Vercel, keeps routine request logs for a short time, as every website host does. Links you send in a message are not affected.

As a contact file. The card, including its photo, is saved as a standard contact file and handed to the app you choose. It goes straight from your phone to them. We never see it.

What our server does

The relay exists to introduce phones that tapped at the same moment in the same place. While a huddle is open it holds, in memory only:

• the cards of the people in it, so they can be shown to each other
• their rough positions, to work out who is nearby
• who each person chose to keep

While people are still choosing, the relay passes on only each person's name, title, company, photo and design. Phone numbers, email addresses and Instagram and LinkedIn go only to people who kept each other, so somebody you leave out never receives them.

When the huddle settles or expires, all of it is destroyed. None of it is written to disk. There is no database, and the server keeps no record that the huddle ever happened.

One thing is written down, and it is counting. The relay keeps a running tally: how many times the button has been pressed, how many huddles formed, how many cards changed hands, and how many people were in each. Numbers and nothing else — no names, no cards, no positions, no device identifiers, nothing that could be traced to a person or to a particular huddle. It is how we can tell whether anybody is using SHOOT at all, which is otherwise unanswerable when you keep nothing.

Like any website or app, SHOOT reaches the internet through companies that carry the connection: Fly.io runs the relay, Vercel serves shoot.cards, and Expo delivers app updates, which the app checks for when it opens. They see your IP address as part of delivering that connection, as your internet provider does. None of them receives your card, your contacts or your labels from SHOOT.

Work cards

Some companies give their people a verified work card. To get one, you enter your work email and SHOOT sends a six-digit code to it. The email address is used only to send codes — when you join, and every few months to confirm you still work there — and is never stored. The code is not stored either.

The email is delivered by our email provider, Resend, which keeps a record that a message was sent to that address, as any email service does. We keep no list of who works where. What proves your card is a signed pass that lives on your phone with the card. For each company that has asked to be on SHOOT we keep only its name, email domains, logo and colours.

The company form

If you ask about SHOOT for your company using the form on shoot.cards, what you type is passed straight to our inbox as an email, through the same email provider, and is not stored anywhere else. We use it only to reply to you.

Backups

If you make a backup, SHOOT writes a file and hands it to whatever you choose — your own cloud storage, or an email to yourself. It goes directly from your phone to wherever you send it. We never see it and never hold a copy.

What we do not do

• No accounts, no passwords, no sign-in.
• No analytics, no tracking, no advertising identifiers. There is no analytics software in the app at all.
• We do not sell, rent or share your information with anybody.
• We do not keep anything you send through SHOOT. It passes between phones and is gone from our side.
• We do not build a profile of you, and we could not: nothing about you is kept on our side to build one from.

Children

SHOOT is not directed at children under 13, and we do not knowingly collect information from them.

Deleting your SHOOT information

There is no request to make and nobody to email, because SHOOT holds nothing about you. Deleting your information is something you do on your own phone, and it takes effect immediately:

1. Open SHOOT and tap the backup icon in the top corner of the home screen.
2. Scroll to the bottom and tap Delete everything.
3. You will be offered the chance to save a copy first. Confirm, and it is done.

Uninstalling SHOOT does the same thing.

What that deletes: your own card, every card you have kept, the labels and notes you added to them, the places and dates the cards were swapped, and your block list. All of it is stored only on that phone, and all of it goes at once.

What is kept afterwards: nothing. There is no account, no copy on our servers, and no retention period to wait out. The relay that puts a huddle together holds names, contact details and rough positions in memory for the few seconds a shoot lasts, and never writes them to disk, so there is never a stored copy for us to delete later.

Cards you already swapped are the one thing you cannot delete: they are on the other person's phone, exactly as a paper card you handed over would be. Deleting yours does not reach theirs.

Any backup file you exported yourself is yours too, wherever you saved it. Delete it the way you would any other file.

Changes

If this policy changes, the date at the top changes with it. If a change ever meant SHOOT holding more than it does today, we would say so plainly in the app rather than only here.