CloudSponge is a software-as-a-service product that imports all the major address books. Most websites use our product so that their users don’t have to type email addresses into their referral forms when they want to send an invitation, greeting card or coupon to someone they know.
What is CloudSponge?
Which contact sources does CloudSponge support?
Please visit our contact sources directory for an up to date list of our supported address books along with real time availability monitoring.
We continue to add support for more contact sources. If you would like to be notified when we have added support for a particular contact source, please send us feedback.
What browsers does CloudSponge support?
CloudSponge supports the major browsers on Windows, Mac and mobile systems:
- Internet Explorer 9+
- Mobile Safari
Do I have to be a programmer to use CloudSponge?
No. A little programming knowledge is helpful, but we give you a simple piece of code that you can paste into the page on your website with your referral form.
If you are a programmer, you will find dozens of customization options in our Developer Documentation including the ability to use our API so that you can have complete control over every pixel of the user experience.
What happens when my user click Get Contacts?
Your user will be securely granted access to their address book library, like Google Contacts. After your user selects and submits their contacts, the payload will be sent according to your use case and callbacks. For instance, if you have a referral form, the contacts can be configured to prefill the form with comma-separated email addresses that can then be sent out as email referrals.
Why did I get an email alert saying that I have given access to CloudSponge?
If you received a notice from your email service provider, it is likely that you used CloudSponge to access your contacts with one of our customers. Please rest assured that we do not store, use, or distribute your address book contents in any way other than to provide the service to our customers. We are a US-based company that takes fraud and privacy very seriously.
Do you support guest posts?
We accept guest posts that are relevant to CloudSponge.
Do you offer a bug bounty?
Yes. We offer a bug bounty. Please reach out to us at email@example.com with specific details.
Does CloudSponge also send emails to my users for me?
No. We’re only handling the address book importing part of the solution for you. You’ll have to send the invitations or coupons to your users’ friends yourself. For transactional email delivery we highly recommend SendGrid rather than using your own mail server.
Can I customize the CloudSponge widget?
Absolutely! There are tons of ways you can customize the widget, we’ve written a whole section about widget customizations in our Developer Documentation.
Do I have to use your “Choose Your Contacts” page?
No. You can let our widget guide the user through importing their contacts, then pass the contacts to your application to render them. The
My Google developer account shows that my app is verified, but I still see "This app isn't verified". How do I get Google to properly review my OAuth app?
There’s one critical step in the process, which is to add the
../auth/contacts.readonlyscope to your Google developer account. If this scope isn’t present, Google will just rubber stamp your verification and make everything look so good in your developer account, while reality is different.
There are a few gotchas in doing this properly, so I made a short video to show and describe how to do it. This video shows how to ensure your OAuth app is ready for a proper review including verifying your URLs and adding the appropriate scope.
Why doesn’t every contact in my address book appear in the widget?
You may not see every contact in the widget because CloudSponge only displays contacts that pass through some simple email validation. This ensures that your application only gets a list of contacts with reasonable looking email addresses.
One common address that is filtered is the Exchange address. These addresses generally follow this format:
If you would like all the emails to appear in the widget, you can set an option to override the filtering of these emails. Specifying:
csPageOptionswill display every contact with an email address, valid or not.
How do I brand the AOL import user experience?
Branding the AOL experience is only possible if you have an existing developer relationship with AOL.
How do I fix the “invalid client” error after I change the branding for Google Contacts?
After applying the changes to see your domain in the Google Authentication window, you may still get an invalid client error from Google.
That error is displayed when under “APIs & auth” -> “Consent screen” you have empty field. Make sure the field “Product Name” is correctly filled in and that you have also selected an e-mail address. You can find “Consent screen” by going to https://console.developers.google.com/project. Then, click on your project’s name and go to “APIs & auth” -> “Consent screen”.
Are you sure that the CloudSponge servers can handle my traffic?
The CloudSponge servers are hosted by Amazon Web Services with redundancy at every level of the stack and load balancing on our most critical parts.
Operating on thousands of websites for several years has given us all the data we need to know exactly how much activity each of our server instances can handle. Our monitoring thresholds are set at “better-safe-than-sorry” levels to make sure we are notified well in advance of any bottlenecks forming.
The ability to launch more server instances instantly coupled with our generous monitoring thresholds gives us full confidence that we can handle any amount of traffic that your website can send our way.
Does Yahoo return the name of the account owner through your API?
Yes it does. It requires that the user grant access to read the user’s Yahoo Mail during the OAuth flow.
In general, we return the contacts_owner whenever possible, but in some cases this is not possible, e.g. from a CSV upload or if your Yahoo credentials don’t include the Yahoo Mail scope.
I registered www.xyz.com. How can I make my domain key work on xyz.com?
When you register a domain xyz.com, the domain key will work on more specific subdomains like www.xyz.com. However the inverse is not true. If you register www.xyz.com, the domain key will not work on xyz.com.
The solution to this is to transfer your domain to be xyz.com. You can do that from the ‘Cancel’ tab of the domain details page.
If you are registering a new domain, we always recommend registering the apex domain (e.g. xyz.com) so it can also be used on subdomains. The exception to this is when your site is hosted on another service that uses a subdomain to redirect to your.
Exceptions: My site is hosted on herokuapp.com: Using the full subdomain is appropriate here. My site is always available on www.xyz.com. If your site has a url rewrite from xyz.com -> www.xyz.com or these domains point to different sites, then of course it makes sense to register the subdomain.
Are you a referral program?
No, in order to use the CloudSponge Contact Picker you will need an existing referral program. We integrate beautifully with referral programs. Check out our integrations and if you don’t see one you like, let us know.
Do development sites, aliases, and subdomains count towards my site limit?
We only count production domains towards your site limit. You can add as many dev sites, subdomains, and aliases as you need. In your CloudSpong customer portal, you can add, approve, deny, and delete your domains.
Security & Privacy
Does CloudSponge keep my users’ address books?
No. Your user’s address book will stay in memory on our servers for a few minutes so that your website has a chance to download it, but then it’s wiped from memory and never written to disk.
How does CloudSponge handle my users’ login credentials for the address book sources?
In most cases, we never see the credentials. AOL, Google, Yahoo and Microsoft all use the OAuth 2.0 delegated authentication frameworks that ensure that their users never have to give their credentials away to third parties like us. For the other address book sources, we never save their credentials to disk and we wipe it from our server’s memory after a few minutes.