Hà Mã Tím's home

← Back

Privacy Policy for Contact Backup & Restore

Effective date: 2026-11-11

This Privacy Policy applies to the Android application Contact Backup & Restore (package name com.hamatim.contactcloudbackup), published on Google Play by HMT Developer (hamatim.com). It explains what data the app accesses, how that data is used, where it is stored, who it may be shared with, and how you can delete it.

By installing and using the app you agree to this Privacy Policy. If you do not agree, please uninstall the app.

1. Who we are and how to contact us

The app is developed and published by HMT Developer, an independent developer whose apps and pages are hosted on https://www.hamatim.com.

Privacy point of contact: admin@hamatim.com

You can use this address at any time to ask a privacy question, request information about the data described below, or request deletion of data that could be associated with you.

2. Summary

  • The app accesses and collects your Contact List (address book). That is the data the app exists for: it reads your contacts so it can back them up, and it writes them back when you restore.
  • Contact data is used only for the backup, restore and contact-cleanup features you start yourself. It is never used for advertising, profiling, or any automated decision about you.
  • The backup itself is stored on your device, inside the app's private storage. We do not operate a server: no contact data is uploaded to any server controlled by us, and we never sell or rent your data.
  • A cloud copy is created only when you explicitly ask for it, and it goes to your own Google Drive, in a private application folder that belongs to the app.
  • Wherever contact data does leave the device (your Google Drive), it travels over an encrypted HTTPS/TLS connection and is stored in Google's encrypted infrastructure.
  • The app includes third-party SDKs (Google Play services, Firebase Analytics, Firebase Crashlytics, Google Mobile Ads) that collect limited technical and diagnostic data, as described in section 7. None of them receive your contact list.

3. Data the app accesses on your device

The app requests the following Android permissions and uses them strictly for the features listed:

  • Contacts (read and write) - READ_CONTACTS, WRITE_CONTACTS: reading your Contact List to back it up, reading it again when you open the backup or restore screen to show how many contacts will be copied or deleted, writing contacts back to the address book when you restore a backup or import a .vcf file, and writing the changes when you merge duplicate contacts or delete contacts from the app. Contact data is read and written only when you start one of those actions; the app never modifies your address book on its own.
  • Network and internet - INTERNET, ACCESS_NETWORK_STATE: only needed for the optional Google Drive backup and restore, and for the analytics, crash-reporting and advertising SDKs. Every backup, restore, merge, import, health scan and delete works fully offline.
  • WAKE_LOCK and FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC: keeping the device awake and running a backup or restore to the end, even if you leave the app, with a progress notification you can watch.
  • POST_NOTIFICATIONS: showing that progress notification. Refusing it never blocks a backup or a restore.

All of this data stays inside the app's sandbox. None of it is transmitted to us.

4. What the app copies, and what it never touches

When you tap Backup, the app reads each contact as the Android contacts provider stores it - display name and structured name, phone numbers with their types and labels, e-mail addresses, postal addresses, organisation and job title, notes, nicknames, websites, relations, events, group memberships and the contact photo - and writes every contact into a single vCard 3.0 record inside the app's own database. That record is what a restore writes back, so a phone number, a photo and a group membership come back the way they were saved.

The app does not read or collect call logs, SMS or MMS messages, calendars, files outside a .vcf file you explicitly pick, precise location, microphone, camera or any health data.

5. How the app stores your data

  • Local database (the backups themselves): the app keeps its backups in a private SQLite database in the app's sandboxed storage - one row per backup, one record per contact. Contacts are stored as vCard text, so a backup is readable only by the app. Android prevents other apps from reading this storage area.
  • Preferences: small settings such as the last backup time, the last cloud file information and the analytics flags, kept in the app's private preference file.
  • No copy anywhere else: there is no developer-owned database, bucket or server, and no hard-coded credentials in the app. The only off-device copy that can ever exist is the one you create in your own Google Drive (section 6).

If you delete a backup inside the app, or clear the app's data, or uninstall the app, the stored contact data is removed permanently - we hold no copy to restore it from.

6. Optional cloud backup to your own Google Drive

If you open Cloud and tap upload, the app asks you to sign in with your Google account and requests the drive.appdata permission (Google Drive "application data folder"). This permission lets the app create, read and delete files only inside its own hidden folder in your Google Drive. It cannot read any other file in your Drive, and it cannot see your files outside that folder.

  • The backup file is the app's own database, sent directly from your device to Google's servers over an encrypted HTTPS/TLS connection. It is not routed through, copied to, or stored on any server of ours - we do not run one.
  • The file is stored in your Google Drive, protected by Google's encryption at rest and by your Google account's own security (password, two-step verification). We cannot read it, and we do not receive a copy of it.
  • Tap download to fetch that file back to your device and restore your backups from it.
  • You can end this access at any time: sign out of Google inside the app, delete the app's data folder through your Google Account permissions page, or remove the app's access in your Google Account settings. Deleting the file from your Drive also removes the cloud copy.

If you never open the Cloud screen and grant that permission, the app never uploads anything to Google Drive.

7. Third-party services

The app uses the following third-party services, each of which processes data under its own privacy policy. Links to their policies are listed below.

  • Google Play services (sign-in and Google Drive) - used only for the optional cloud backup described in section 6. Google Privacy Policy: https://policies.google.com/privacy
  • Google Analytics for Firebase - collects aggregated, app-level usage events such as screens opened and features used (for example "backup finished", "merge done"), together with the number of contacts in that operation, its duration and its result, plus a randomly generated app instance identifier and device model/OS version. It does not receive your contacts: no name, phone number, e-mail address, postal address, note or photo is ever sent, and the counts it receives are numbers only. Firebase privacy information: https://firebase.google.com/support/privacy
  • Firebase Crashlytics - receives crash reports and technical diagnostics (stack trace, device model, operating system version, app version, app state at the time of the crash) so that defects can be fixed. Crash reports are not designed to contain contacts, and we do not attach user content to them. Firebase privacy information: https://firebase.google.com/support/privacy
  • Google Mobile Ads SDK (AdMob) - the SDK is included in the build and may access your device's advertising identifier, IP address and general device and app information. This version of the app shows no advertisement, and your contact list is never used for advertising or ad targeting. AdMob privacy information: https://policies.google.com/technologies/ads

Apart from the cases above, we do not share personal or sensitive user data with any other party. We do not sell, rent or trade your contacts or any other personal data, and we do not hand it to data brokers, advertisers or analytics providers. We may disclose information only if we are legally required to do so, or to protect the rights and safety of users and of the developer.

8. Data we do not collect

  • We do not require or offer user accounts of our own, and we do not ask for your name, e-mail address, phone number or postal address.
  • We do not upload your Contact List to any server operated by us. We have no server that stores user data.
  • We do not use your contacts for advertising, profiling, scoring or any automated decision-making, and we do not build an advertising profile from them.
  • We do not read SMS, MMS, call logs, calendars, photos or files outside the .vcf file you pick for an import.
  • We do not track your location or your browsing.

9. Secure data handling

  • All app data lives in the private, sandboxed storage area of the app; on Android, other apps cannot read it.
  • Every network transfer (Google Drive upload and download, analytics, crash reports, ads) uses encrypted HTTPS/TLS connections.
  • No hard-coded credentials, and no developer-owned storage bucket or database, are used anywhere in the app.
  • Access to your Google Drive is limited to the app's own hidden data folder, as described in section 6, and can be revoked by you at any time.
  • Contact data is never written to logs, never attached to a crash report, and never included in an analytics event.

10. Data retention and deletion

  • On your device: backups are kept for as long as the app is installed and you keep them. You can delete them at any time: delete an individual backup from the restore list (its window menu offers Delete), clear all app data in Android Settings > Apps > Contact Backup & Restore > Storage > Clear data, or uninstall the app, which removes its database, its backups and its preferences.
  • The contacts on your device: Wipe device contacts deletes the contacts in the address book (not the backup), and a restore replaces the contacts it restores. Both ask for confirmation and state the count first.
  • In your Google Drive: the cloud copy stays in your own Drive until you delete it - from inside the app, from your Google Account permissions page, or from Google Drive itself. We cannot delete it for you because we have no access to it.
  • Third-party data: analytics, crash reports, advertising and installation records held by Google are retained according to Google's own retention policies.
  • Deletion requests: because the app stores your content on your device and in your own Google Drive, uninstalling the app is normally the complete and immediate deletion. If you want help identifying data held by a third-party service, write to admin@hamatim.com and we will respond within 30 days.

11. Children's privacy

The app is not directed to children under 13 (or the equivalent minimum age in your country) and we do not knowingly collect personal information from children. Its purpose is to back up and restore the address book of the device owner, and it is intended for adult users. If you believe a child has used the app, please contact admin@hamatim.com.

12. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, or to lodge a complaint with your local data protection authority. Because we do not hold your contacts or your backups, most requests are satisfied directly on your device as described in section 10. For anything else, write to admin@hamatim.com and we will respond within a reasonable period, and no later than 30 days.

13. Changes to this Privacy Policy

We may update this Privacy Policy when the app's features or the applicable rules change. The updated version is published at this same URL with a new effective date. Material changes will also be noted in the app's release notes on Google Play. Continuing to use the app after a change means you accept the updated policy.

14. Related documents

  • This Privacy Policy: https://www.hamatim.com/app/privacy-policy-for-contact-backup-restore.html
  • Privacy Policy for Call Logs Backup & Restore, the sibling app: https://www.hamatim.com/app/privacy-policy-for-call-logs-backup-restore.html
  • All HMT Developer privacy policies: https://www.hamatim.com/type/privacy/all.html
  • Google Play listing of the app: https://play.google.com/store/apps/details?id=com.hamatim.contactcloudbackup

This Privacy Policy is labelled as a privacy policy, applies to the app named above, and is provided by the entity named in the app's Google Play listing.