Safeguards

Every Digiprofile opens at app.digiprofiles.com/p/… and nowhere else. We never use link shorteners or other addresses.

Downloaded and printed QR codes show their web address underneath, and so does the app. You can see where a code goes before you scan it, and a sticker placed over a real code is easy to spot.

Every page is served over an encrypted connection (https, with the padlock in your browser).

Every account's mobile number is checked with a 6-digit code, and each number can have only one account. Digiprofiles show a "Phone verified" badge.

Owners can prove they run a website (for example acme.com) or use a work email there. Their Digiprofile then shows "Verified: acme.com".

Owners can't attach files for you to download. The only downloads are ones Digiprofiles creates itself, such as a contacts file, a calendar entry or a wallet pass.

Every button on a Digiprofile says what it does, and nothing happens until you tap one.

Before a website link opens, you see the real address you're going to, in bold.

Website links are checked against lists of known scam and malware sites when they're added and regularly after. Link shorteners and lookalike addresses (such as "paypa1.com") are blocked or flagged.

If a link turns out to be harmful, we can switch it off once and it stops working on every QR code, wallet pass and shared link.

Every sign-in needs the password and a 6-digit code texted to the account's mobile, so a stolen password isn't enough.

A code to the account's mobile, then a link to its email. Saving the new password signs the account out everywhere.

Every new account needs a verified mobile number and a payment card, even for the free trial. That stops bots and throwaway scam accounts before they start.

Every sign-in to our own administration console needs the password and a 6-digit code texted to that staff member's mobile, and everything staff change is recorded.

After the free trial, every account is a paid subscription, which makes Digiprofiles a poor place for throwaway scam accounts.

Internet-only phone numbers can't be used to sign up.

Your data is never sold, passed on for marketing, or used for anything but running Digiprofiles. News and offers from us only if you opt in.

Your Digiprofiles show only what you put on them. Your private Digiprofile name is never shown to anyone else.

Each person can reach only their own information.

People share their details with you only by choice. Through Share your details they tick a consent box and confirm by email before you see anything (a Handshake is agreed in person). Their details are deleted after 12 months.

We never store card numbers.

Digiprofiles doesn't store help chat conversations.

Our terms of use forbid impersonation, scams, spam and collecting people's details without consent.

We can suspend an account at once, which switches off all its Digiprofiles.

Think a Digiprofile is fake, pretending to be someone else or a scam? Report it here with its link and what's wrong, or tap "Report this Digiprofile" at the bottom of its page. Our team reviews every report, lets the owner know, and emails you when it's done.

The name on a Contact profile is the account holder's own name, and changing it needs a code texted to their verified mobile. This makes it harder to pose as someone else.

Our emails are signed so email providers can tell they're really from Digiprofiles. We will never ask for your password or a sign-in code.

Email providers will be told to reject fake emails pretending to be from Digiprofiles.