Privacy Policy

Last updated: 2026-11-04

TokaID ("we", "us") provides a digital business card and networking service. This policy explains how we collect, use, share, and protect your information when you use TokaID.

To delete your TokaID account, see Section 6, "Account Deletion"; to delete specific data without deleting your account, see Section 7.

1. Information We Collect

• Account data: your login identifier (a handle, or the identifier provided by third-party login such as Google/Apple), email, and display name, together with the language and ranking region you choose (including whether the region is set automatically from your device's location).
• Age confirmation: when you sign up, we ask you to select your month and year of birth. It is used only on your device to determine whether you are at least 18 and is never sent to us; we record only the time you completed the confirmation. If you are determined to be under 18, your device keeps the date from which you may sign up again, to prevent repeated attempts.
• Card and profile data: the card content you create, such as name, nickname, title, company/brand, contact details, bio, avatar and background images, social links, tags, and notes.
• Connection and interaction data: relationships and records generated from card exchanges, saves, and Sparks with other users.
• Messages: the content and timestamps of the messages you exchange with your connections.
• Board content: the posts, comments and photos (up to 4 per post) you publish on card boards and in Spark posts, together with when you published them and the audience you chose (public, network circle or connections).
• Sparks: the Sparks you create or join (the cards taking part, the time, and the members when it was completed), the names you give your Sparks, and the messages, group name and read progress of Spark group chats. If you have allowed location access, we record your location and the name of the neighbourhood you are in when you open or join a Spark; it is shown only in your own footprints.
• Exchange location (Footprint): when you exchange cards with someone, we record the geographic location at the time of exchange as your personal "Footprint Map".
• Real-time location: only while you are using the app (when-in-use), to show venues near you, and to confirm that you are actually there when you exchange cards, check in to a venue, or join a venue; not continuously tracked in the background.
• Venues: for venues you create, the name, subtitle, description, cover and avatar images, the time, and the place (the place you pick on the map, its coordinates, and any location details you add), together with the venue's member, attendance and invitation records.
• Reports: when you file a report, the category you choose, the description you write and any screenshots you attach, together with a snapshot of the reported content (see Section 5 for how long these are kept).
• Bluetooth: used to exchange cards with nearby devices.
• Device identifiers: to deliver push notifications and to prevent abuse, we collect the push token and installation identifier generated by Firebase, the device name and app version, together with the App Check device attestation result. The reCAPTCHA Enterprise component used by App Check collects its own crash records, performance data, and interaction signals in order to assess device authenticity.
• Purchase records: when you buy a card style in the app, we record the style and price tier you bought, your consent before payment to the notice that the seven-day right of withdrawal does not apply (the notice version and time), and the transaction identifier, purchase time, and refund status provided by the platform. Payment details (card numbers, billing information) are handled directly by Apple or Google and are never sent to us.
• Server logs: for operations, security and abuse prevention, and to comply with lawful requests from judicial and police authorities, our servers record the request time, URL and query parameters, response status, device and browser information (User-Agent), account identifiers, the connecting IP address, and the approximate location (country/region/city level) that our edge service derives from that IP. Because URLs and query parameters are recorded, search terms you enter in the app also appear in these logs.

2. How We Use Your Information

• To provide core features such as card creation, persona switching, proximity exchange, connection management, and the Footprint Map.
• To compute social metrics (popularity, connections, reputation, value).
• To maintain account security, prevent abuse, and improve the product experience.

3. Sharing and Visibility

• Card data: your card is shared with users you exchange or interact with; how much they can see depends on your relationship with them and the privacy level you set for the card — closer relationships can see more complete data, while strangers see only basic information. The phone number and email on a card can each be limited further to Public, Network circle, or Connections, and never more widely than the card's own privacy level; a new personal card and its phone number and email are visible to Connections only by default, while brand cards are public by default. You can control disclosure through your card's privacy settings. When you open exchange mode, people nearby who also have it open can see the name on this card regardless of its privacy level; other fields still follow the privacy level, and the back of the card stays hidden until you exchange.
• Messages: visible only to you and the person you are talking to; if a message is reported, that message and its surrounding context are retained as evidence under Section 5. A message we remove under the law or our community guidelines is shown in the conversation as "This message was removed."
• Exchange location (Footprint): visible only to you and the person you exchanged with; it is never shown to other users, including your other connections.
• Boards: a post whose audience is "public" can be seen by anyone, including people who are not signed in and open it from a shared link; a post whose audience is "network circle" can be seen by people who have exchanged cards with that card and by people who share a mutual connection with that card; a post whose audience is "connections" can be seen only by people who have exchanged cards with that card. A post's audience is never wider than the card's own privacy level: a card set to Network circle can publish network circle or connections posts, and a card set to Connections can publish connections posts only; if the card is later made more private, older posts beyond the new level become visible to connections only. Comments follow the visibility of their post.
• Spark group chats: visible only to the members of that Spark.
• Enforcement actions: while a card is taken down by us under our community guidelines, or while an account is suspended, no one except you can see those cards (the Social tab, venue member lists, rankings, search, and the public share link), and notifications that mention them are hidden from other people as well; everything returns when the action is lifted. Push notifications already delivered to other people's devices cannot be recalled.
• We do not sell your personal data.
• Legal requests: when judicial or police authorities lawfully request it, we provide the data needed for the investigation (for example, server logs).
• Service providers: our servers, database and files are hosted by Cloudflare (edge computing, image and file storage, server logs), Amazon Web Services (the application, the database and server logs) and Upstash (caching, including the temporary copies of real-time location used for exchanges and of connection data); they store and process data on our behalf, under our instructions. We also use the third-party services listed in Section 4. Each provider is subject to its own privacy policy.

4. Third-Party Services

• Google Firebase: Authentication (including Google Sign-In and Sign in with Apple), Cloud Messaging (push notifications), and App Check (device attestation, using reCAPTCHA Enterprise and the platform attestation services). The title and text of push notifications (for example, the card name of the person who messaged you — never the message content) are delivered to your device through Firebase Cloud Messaging, and on iPhone also through the Apple Push Notification service (APNs).
• OpenFreeMap: the tiles, fonts, and icons for the Footprint and venue maps are delivered to your device directly by OpenFreeMap, so that service receives your connecting IP address. Map data comes from OpenMapTiles and OpenStreetMap.
• Google ML Kit: when you scan a QR code in the Android app, the camera image is decoded on your device and is never uploaded; ML Kit sends Google basic device and app information (such as device model, OS and app version, performance metrics, and error codes) together with a per-installation identifier, for diagnostics and usage analytics.
• Apple and Google in-app purchases: payments for card styles are processed by the App Store and Google Play respectively; we receive only the item purchased, the transaction identifier, and the purchase time. When a purchase is refunded, the platform notifies us so that the style can be revoked.
• OpenAI (content moderation): the card images and board photos you upload, the text you write in cards, venues, invitations, board posts and comments, and Spark group chat names, your account's handle and display name, and the place names recorded when you exchange cards, are sent to OpenAI's moderation service to check them against our community guidelines; the content of messages and Spark group chat conversations is not sent. According to OpenAI's documentation, data sent to its API is not used to train or improve its models, and the moderation service does not retain this data.
• OS reverse geocoding (Apple / Google): to show the place name of an exchange location in Footprint, the app hands that location's coordinates to the geocoding service built into your phone's operating system — Apple's service on iPhone, Google's on Android. The coordinates are sent by the operating system; we do not pass them to any other third party.

5. Data Retention and Deletion

• A card is permanently deleted 30 days after you delete it; connection and footprint records are kept until either person's card is permanently deleted or either account is deleted (they stop being shown as soon as you remove the connection or delete the card; see Section 7 for the steps). When a connection is removed, the location recorded at the exchange is erased immediately (the connection record itself is kept); when an exchange invitation is declined or expires, the location recorded on the invitation is erased as well. "Clear footprint" only removes an entry from your own footprints; it deletes no data and does not change how long it is kept.
• The change log of connection states (when a connection was made, hidden, or removed — no names or locations) is used to investigate connection problems and is automatically deleted after 30 days.
• Notifications you delete are kept on our servers for 30 days and then deleted automatically; achievement and ranking reward notifications are the exception and are kept until you delete your account, so that the same reward is never issued twice.
• Once a venue is dissolved by its organizer, it is no longer shown to other users; its records are not deleted by the dissolution and are retained until the organizer deletes their account. Connections and footprints created at the venue are not affected.
• Messages are retained until 30 days after both participants' accounts have been deleted; when an account is deleted, the content of the messages that person sent is cleared for everyone in the conversation, leaving only a content-free placeholder. "Clear conversation" only hides messages from your own view (see Section 7).
• Real-time location is retained only briefly (it expires within about 24 hours).
• Boards: when you delete a post or comment, its text is cleared immediately and only a content-free record remains (so that replies beneath it can still show "deleted"); that record is kept until the card is permanently deleted. A post's photos are deleted from our servers within 3 days of deleting it. Closing your board does not delete anything. When a card is permanently deleted (30 days after you delete it), the posts, comments and photos on that card's board are deleted with it; the text of comments you left on other people's boards with that card is cleared the moment you delete the card.
• The notification you receive when someone comments on your board or replies to your comment expires after 7 days and is removed from your inbox; our servers keep its record for a further 30 days and then delete it automatically.
• Sparks: a Spark that is not completed within 24 hours of being opened is cancelled automatically, and the cancelled record is deleted 24 hours later. A completed Spark (the cards taking part, the time and the members) is kept until 30 days after every participant has deleted their account; your footprint location and the names you give belong to you alone and are deleted when the card is permanently deleted (30 days after you delete it) or when you delete your account.
• Daily records of social metrics: the daily reputation record is kept until the card is permanently deleted; the daily value and star-level records are kept until you delete your account.
• Push tokens: once deactivated (for example, when you sign out, when the token becomes invalid, or after 60 days without opening the app on that device), they are kept for 30 days and then deleted. For a device you signed out from in "Logged-in Devices", its token record and the record of the signed-out sign-in (the sign-in time and the reason) are kept until you delete your account, to stop the signed-out device from coming back with the sign-in it had before.
• When the content moderation service is temporarily unavailable, text that could not be checked at the time (or the server location of an image) is held for a later check: it is deleted immediately if the check finds no problem; if it needs a human review, it is kept until the review is done or for 180 days.
• Spark group chats follow the same rules as messages: they are kept until 30 days after every member's account has been deleted; when an account is deleted, the messages that person sent and the group names they set are cleared for every member, leaving only a content-free placeholder. "Hide group chat" only hides it from your own list.
• Data kept after you delete your account (the reports and enforcement exception and legal holds below are described separately):
  • Spark interactions (including the interaction points from Spark rooms): the record shared with the other person (both account and card identifiers, the date and interaction points, used to calculate their achievements and reputation) is kept, but your location is erased when you delete your account; the record is deleted entirely once the other person has also deleted their account, or once both cards no longer exist.
  • Settlement records for ranking champions, cycle rewards and rookie graduation (account and card identifiers, rank, score and reward, plus markers that prevent the same settlement from running twice) are kept as the audit record of competition results and reward payouts, to handle appeals and disputes; after the account is deleted they are kept until 732 days (two years) after the settlement and then deleted (longer while a legal hold applies).
  • The audit log of actions our staff took on an account is kept to handle appeals and legal requests, in two tiers depending on whether you were notified in the app when the action was taken: enforcement actions you were notified of (account warnings, card takedowns and their reversal) are kept for 732 days (two years) and then deleted; all other records are kept for 1828 days (five years) and then deleted — this includes enforcement actions we do not notify you of (for example restrictions, suspensions, card image takedowns, watch lists and legal holds), records of viewing account data together with the reason, and cases where the notification was not delivered or the record also concerns someone who was not notified. You may learn of these actions later, so they are kept until the longest period in which a legal claim can be made. Both are kept longer while an account or report they concern is under a legal hold, and each deletion is itself logged. The warnings and suspensions themselves are deleted with the account; what is kept is this log of the actions.
  • Deletion ledger: the identifier of the deleted account and the time of deletion, plus the identifiers of the messages and conversations that were cleared (no names or message content), used to re-run deletions during disaster recovery (both the whole account and the content of the messages it sent) so that deleted data does not come back from a backup; kept for about 30 days and then deleted automatically. Automatic database backups are kept for 7 days, so deleted data disappears from the automatic backups within 7 days.
  • Recently deleted sign-in identity: a hash (not the original value) of your Firebase sign-in identity is kept for 1 to 2 days and then deleted, to stop a just-deleted account from being re-created with sign-in credentials issued before the deletion.
  • In-app purchases: your purchase records on our side (including the consent recorded before payment) are deleted with your account; payment records are kept by the App Store and Google Play under their own policies.
• Server logs (including IP addresses) are automatically deleted after 30 days. Where we are legally required to preserve them (for example, on notice from a competent authority under Article 8 of Taiwan's Child and Youth Sexual Exploitation Prevention Act), the relevant records are kept separately until the preservation period ends and are used only for the investigation.
• Security records of sign-ins to our admin console (successful and failed sign-ins and two-step verifications, attempts blocked for being too frequent, and reused verification codes) and of scheduled jobs our staff re-ran manually are kept to investigate intrusion and abuse; they do not concern any user account but may contain the IP address of whoever tried to sign in (for an IPv6 address, only its first 64 bits, i.e. its network prefix), and are kept for 366 days (one year) and then deleted.
• The data you can delete without deleting your account, and the steps, are in Section 7; how to delete your entire account, and how long that takes, is described in Section 6.
• Exception for abuse reports and enforcement actions: if a report has been filed about you, or by you, or if we have removed images on your card for violating our rules, that case record and the minimum necessary evidence (a snapshot of the reported message and its immediate context, screenshots attached to a report, the removed card images, the content of messages we removed, and snapshots and photos of reported board posts and comments) is not deleted together with your account. When an account is deleted we remove the account identifiers from the case (de-identification). The evidence in a report (message snapshots, screenshots, and board snapshots and photos) is retained until 180 days after the report is closed, and for reports that are still open, for the same period counted from when they were filed; the report record itself (its category, description, status and outcome) is kept until both accounts have been deleted and that period has elapsed; removed card images are retained for 180 days from the removal, and are deleted within one day if the removal is reversed; the preservation copy of a message we removed is retained for 180 days from the removal, and is deleted within one day if the removal is reversed (the message is restored). Where there is a formal appeal, a legal request, or a legal obligation to retain the data, that period may be extended on a case-by-case basis with a recorded reason and expiry date. Once both accounts have been deleted and the period has elapsed, the entire report is purged.
• We retain this data solely to handle and review reports and enforcement actions, to prevent abuse, and for the establishment, exercise or defence of legal claims. We do not use it for any other purpose.
• Legal holds: if your account is subject to an investigation by a competent authority or court and we are legally required to retain the related data (for example, under Article 8 of Taiwan's Child and Youth Sexual Exploitation Prevention Act), deletion of your account is postponed until that retention period ends, and the periodic deletions described in this section (deleted notifications, the connection change log, preservation copies of removed messages, board photos, comment notification records, Spark records, deactivated push tokens, copies held for moderation review) are paused as well; during that period the data is used only for the investigation.

6. Account Deletion

• In the TokaID app: open Personal Center → Account → Account Management, tap "Delete Account" at the bottom of the page, and follow the prompts to verify your identity and confirm.
• By email: if you can no longer sign in, email contact@art-dimensions-ai.com from the address on your account and state that you want your TokaID account deleted.
• 30-day grace period: once you request deletion, your account enters a 30-day grace period and becomes read-only (you can no longer create or change content); during that time you can sign in and cancel the deletion. When the period ends, your account and related data are permanently deleted and cannot be recovered.
• What is deleted and what is kept: your cards, connections, footprints, saved items, board content, Spark records and account data are all deleted. The narrow exceptions we must keep by law or to handle abuse reports — and how long server logs and the connection change log are retained — are described in Section 5.

7. Deleting Specific Data Without Deleting Your Account

In the TokaID app you can delete the following data yourself without deleting your account. In the steps below, Social, Home, Store and Personal Center are the tabs at the bottom of the screen (Personal Center is the Profile tab), and the envelope and gear icons are at the top right; the switcher at the top of the Social tab has two groups, Connections | Collections and Messages | Feed. Unless noted, deletion takes effect immediately; any retention period is stated at the end of each item. While your account is scheduled for deletion it is read-only (Section 6), so cancel the deletion first.

• Business cards: Home → tap the pencil icon at the top left of your card → at the bottom of Edit Card, tap "Delete card" → confirm with "Delete". The card stops being shown right away, the connections, saves and brand links made with it are removed, and its avatar and background images are deleted immediately; the card itself is permanently deleted after 30 days (it cannot be restored during that time). Achievements you earned are kept; conversations with that card become read-only and the other person can still see them. A card that represents a live venue or is responsible for a brand card must be released from that role first.
• Connections: Social → pick your card → Connections → tap the selected "All" chip again to open Manage Connections → tap "⋮" on that row → "Remove connection" → "Confirm delete" → "Save" at the bottom. The connection disappears from both people's Social tab and footprints, the other person is not notified, and your conversation becomes read-only; the location recorded at the exchange is erased immediately, and the rest of the record is kept until either person's card is permanently deleted or either account is deleted. "Hide connection" only hides that person from others viewing your card; it is not deletion.
• Notifications: tap the envelope icon at the top right → Inbox → Notifications or Rewards → tap an item → "Delete", or tap "Clear read" to delete all read and claimed notifications at once. They stop being shown right away; the server keeps the records for 30 days and then deletes them, except achievement and ranking reward notifications, which are kept until your account is deleted (so that the same reward is never issued twice). A notification with an unclaimed reward cannot be deleted.
• Card tags: Social → Connections or Collections → long-press a custom tag → "Delete label" → confirm with "Delete label". The tag and its assignments are permanently deleted right away; the cards themselves are untouched. To take one person out of a tag: tap "⋮" on that row → "Add to tag" → uncheck → "Confirm".
• Style tags: Personal Center → Styles (or Store → Owned) → long-press a custom tag → "Delete tag" → confirm. The tag is permanently deleted right away; your styles are untouched.
• Saved cards: Social → pick your card → Collections → tap the selected chip again to open Manage Collections → tap "⋮" on that row → "Remove from collections" → "Confirm removal" → "Save". Your side of the save is deleted when you save; once neither side saves the other, the record is permanently deleted. The other person's save of your card is unaffected, and they are not notified.
• People who saved your card: Home → tap the people icon at the top right of your card → the Collectors list → tap "⋮" on that row → "Remove collector" → "Remove". Their save is removed right away and they are not notified; to prevent an immediate re-save, a 7-day cooldown record is kept and then deleted automatically.
• Venue membership: Home → Venues → tap the wax seal on the venue card (or flip it and tap "Enter venue") → "Leave venue" → "Leave". You are no longer a member and your participation record is deleted right away; the membership record is kept, marked as left, until your account is deleted (you can still rejoin later). Connections made at the venue are not affected; a venue's creator cannot leave it.
• Brand links: brand card owner: Home → the manage icon at the bottom right of your brand card → Brand Link Management → Linked → "Remove link" → "Remove". Member: Home → your card → the pencil icon at the top left → the link icon next to the brand field ("Unlink brand card") → "Save changes". The link is permanently deleted right away; either side can remove it.
• Guide progress: tap the gear icon at the top right → Settings → "Replay guide". The record of which guides you have seen is cleared right away.
• Saved styles: Store → Saved → tap the filled heart on a style → "Unsave". It is permanently deleted right away.
• Blocks: Social → Messages → long-press the conversation → "Unblock" (or tap "Unblock" on that person's card page). The block record is permanently deleted right away.
• Board posts and comments: Home → the expand icon at the bottom left of your card → the info icon at the bottom left of the card → "Board" at the top → open the post → the "⋯" at the top right of the post → "Delete post" → "Delete" (for a comment, tap that comment's "⋯" → "Delete comment" → confirm). The text is cleared right away, and the photos are deleted from our servers within 3 days. A board's owner can also delete comments other people left on their board.
• Footprints: deleting footprint data is not available. Personal Center → Footprints → tap "⋯" on an entry → "Clear footprint" only removes that entry from your own footprints (on all your devices); it deletes no data, and the other person's footprints are not affected. If you exchange cards or leave a Spark with that person again, it appears in your footprints again. Exchange footprints come from the connection itself: once you remove that connection (see above) it is no longer shown, and the location recorded at the exchange is erased at that point. The meeting locations you recorded are erased when you delete your account.
• Individual messages: deleting individual messages is not currently available. Social → Messages → long-press a conversation → "Clear conversation" only hides the messages so far from your view on all your devices; the other person keeps their copy. The content of messages you sent is cleared for everyone in the conversation when your account is deleted (Section 5).
• Spark group chats: deleting Spark group chat messages is not currently available. "Hide group chat" only hides it from your list (and mutes it); other members are not affected. The content of messages you sent is cleared for every member when your account is deleted (Section 5).

8. Your Rights

• You have the right to access, correct, and delete your personal data, and to request data portability or to restrict/object to certain processing.
• If you are located in the EU/EEA (for example, France), you have these rights under the GDPR; to exercise them, please contact us via the email below.

9. Data Storage and International Transfers

• Your data is stored with our cloud service providers ("Service providers" in Section 3): the application and database are located in the Amazon Web Services Sydney (Australia) region; edge computing, image and file storage, and server logs are handled on Cloudflare's global network; caching is provided by Upstash. When the service is used from regions such as the EU, your data is transferred to and processed in these regions.

10. Children's Privacy

• The Service is intended only for people aged 18 or older, and we do not knowingly collect personal data from anyone under 18.
• Legal notices: when a competent authority notifies us under Article 8 of Taiwan's Child and Youth Sexual Exploitation Prevention Act, we restrict access to or remove the content concerned (cards, messages, card images, venues, board content) as that article requires, and preserve the related data as required by law (see "Legal holds" in Section 5).
• If we learn that a user is under 18, we delete their account and data: an account that has never created a card and has not been reported is deleted immediately; any other account becomes read-only right away, the deletion cannot be cancelled, and the account is deleted after 30 days (except for abuse reports and enforcement actions as described in Section 5, and where we are legally required to retain the data).

11. Changes to This Policy

• We may update this policy and will post the latest update date on this page.

12. Contact Us

For privacy questions or to exercise your rights, contact: contact@art-dimensions-ai.com

The Service is provided by Artdim Innovations Ltd. (藝維度創新科技有限公司). Representative: Yung-Chun Chuang. Address: 2F-3, No. 112, Zhongming S. Rd., Taichung 403430, Taiwan. Phone: +886 932 001 916.