Privacy
Privacy
ContactFile runs entirely in your browser. There is no server, no database, and no record of what you paste.
Parsing
Text you paste is parsed by JavaScript running locally on your device. No outbound request is made at parse time. Open your browser's Network tab while you paste — you'll see nothing leave your machine.
Filing to Google
When you file a contact, your browser signs in directly with Google and
receives an OAuth token. That token never passes through ContactFile or
9W — it goes straight from Google to your browser, then from your browser
to the Google People API. When you file, the only requests go to
accounts.google.com and people.googleapis.com.
Once data reaches Google, it is governed by
Google's Privacy Policy.
Storage
ContactFile uses the minimum browser storage needed, split by kind. Your
Google OAuth token lives only in memory and is discarded when you close or
refresh the tab. The Recent list is kept in sessionStorage,
which clears automatically when the tab closes. UI preferences — just your
language choice, stored as a 2-letter code — live in a first-party cookie
(cf_lang) so the site remembers your preference on return
visits. No identifiers, never sent to any server, not shared with anyone.
Analytics
ContactFile uses Umami, a privacy-first platform that counts anonymous page views. It does not track individuals, does not set cross-site cookies, and cannot see what you paste or which contacts you file. The only data collected is that someone visited the page.
Independent audits
Don't take my word for it. These free public scanners independently grade the site's security and privacy posture. Last verified 22 Apr 2026 — click any to re-run:
- Mozilla Observatory A+ — overall web security grade (CSP, cookies, HTTPS config).
- Security Headers A+ — HTTP security header audit (HSTS, CSP, X-Frame-Options).
- SSL Labs A+ — TLS configuration, certificate chain, cipher suites.
- Webbkoll — GDPR-relevant properties (trackers, cookies, referrer behavior).
- Blacklight — live-tests the page for trackers, fingerprinting, and third-party cookies.
To report a security issue, see security.txt.
Disclaimer
ContactFile is provided as-is, without warranty of any kind. 9W accepts no responsibility for errors in parsing, data loss, or any consequences arising from use of this service. You are solely responsible for reviewing contacts before filing them and for your use of the Google Contacts API.
Contact
Built by 9W, New York City. Questions or concerns: [email protected].