Are NFC tags safe? What gets stored on them?
Short answer: yes, MYZO's use of NFC is safe. Here is what is actually happening so you can be confident answering the question if a peer asks.
What gets written to the tag
Only your MYZO profile URL, for example myzo.link/yourname. That is it. No phone number, no email, no password, no contact list. The tag is essentially a tiny piece of paper with one URL written on it.
Can someone steal data from my phone by tapping a tag?
No. NFC reading on phones is one-way: the phone reads what is on the tag and offers to open the URL. The tag has no power and no chip capable of pulling data from a phone. Even a malicious tag can only contain a URL or a small piece of text, exactly like the link you write yourself.
Can people overwrite my tag?
If the tag is unlocked, technically yes, but they would need physical access to the tag and an Android phone in writing mode. To prevent this, you can lock the tag after writing using a free app like NFC Tools. Locking is permanent: the tag becomes read-only forever. We recommend locking tags you give out or stick on public surfaces.
Can MYZO see who tapped my tag?
MYZO sees the same thing it sees for any visit to your profile: a profile view in your analytics, with the same anonymous data we collect for every visit (rough geolocation, device type, referrer if any). We do not see the tag itself or any unique tag ID.
What happens if I lose a tag?
Nothing bad. Whoever finds it taps it and lands on your public MYZO profile, the same profile anyone with the URL can already see. Your private data is never on the tag.
What if I want to change my profile later?
You never need to rewrite the tag. The tag holds the URL, and the URL points to your live MYZO profile. Whatever you change on your profile shows up the next time someone taps the tag. That is the entire point: the link stays the same, you change.
Is NFC a tracking device?
No. NFC tags have no battery, no GPS, no internet connection. They cannot transmit anything by themselves. They only respond when a phone is held within 4 cm. They are physically incapable of being a tracker.
TL;DR for skeptical peers
- Tag holds one URL, your MYZO link.
- Reading a tag cannot pull data off a phone.
- Lock the tag if you want it to be read-only.
- Losing a tag is no different from losing a printed business card.
- The tag never needs to be rewritten when your profile changes.