Contact data privacy: what to check before you trust an app with your network

Your contact list is other people's data as much as your own. Everyone in it gave you their number for a reason, and none of those reasons included a third party they have never heard of. That is the standard worth holding any personal CRM to, including this one.

What a connected account actually grants

When you connect a Google or Microsoft account, you approve a specific list of scopes, and the consent screen names them. It is worth reading rather than clicking through. Access to contacts means the app can read the contact records in that account. Access to calendar events means it can see events, usually including attendees. Permission to send mail is separate from permission to read mail, and the difference is significant — an app that can send on your behalf but cannot read your inbox is a much smaller surface than one that can do both.

The right question is not whether the permissions are scary but whether they are the minimum for the feature you want. An app that asks for full mailbox read access to do contact syncing is asking for more than it needs.

The three questions

• Is the data sold, shared or brokered? The answer should be a plain no, in the privacy policy, not a paragraph about trusted partners.
• Is it used to train models? This is increasingly the live question, and a vague answer is an answer.
• Who inside the company can see it, and under what circumstances? Support access during a ticket is normal; unrestricted browsing is not.

A.R.O's position, for the record: contacts are never sold and never used to train models, connectors read only the scopes you approve, and the address geocoding behind the map view runs in-house rather than being sent to a third party. The privacy policy states it in full.

Why export is a privacy feature

Export usually gets filed under convenience, but it belongs here. The ability to take everything out, in a format you can read, without asking anyone, is what keeps the relationship voluntary. It means a price rise, a policy change or an acquisition is an inconvenience rather than a hostage situation.

A documented API is the stronger version of that promise — it means your data is reachable programmatically, not just through screens the vendor controls. A.R.O's is public: see the API docs. Deletion is the other half: you should be able to wipe an account and have that mean something.

Practical hygiene

• Connect one account first and see what lands before connecting the rest.
• Review what an import will create before applying it, rather than after.
• Disconnect accounts you stopped using; a dormant connection is still a connection.
• Export your data occasionally, both as a backup and as a test that export actually works.

A note on the people in your list

Nothing in a personal CRM should be anything you would be embarrassed for the person to read. That is not a legal standard, it is a decency one, and it is also practical: notes written in that spirit are the ones that help you be a better correspondent rather than a creepier one. Write down that they are weighing up a job move. Do not build a dossier.

If you want the fuller argument for keeping any of this at all, what is a personal CRM starts there.