If you don't find the answers to you questions here,
check our Developer Documentation.

CloudSponge is a software-as-a-service product that imports all the major address books. Most websites use our product so that their users don’t have to type email addresses into their referral forms when they want to send an invitation, greeting card or coupon to someone they know.

Please visit our contact sources directory for an up to date list of our supported address books along with real time availability monitoring.

We continue to add support for more contact sources. If you would like to be notified when we have added support for a particular contact source, please send us feedback.

CloudSponge supports the major browsers on Windows, Mac and mobile systems:

• Chrome
• FireFox
• Internet Explorer 9+
• Edge
• Safari
• Mobile Safari

No. A little programming knowledge is helpful, but we give you a simple piece of code that you can paste into the page on your website with your referral form.

If you are a programmer, you will find dozens of customization options in our Developer Documentation including the ability to use our API so that you can have complete control over every pixel of the user experience.

Your user will be securely granted access to their address book library, like Google Contacts. After your user selects and submits their contacts, the payload will be sent according to your use case and callbacks. For instance, if you have a referral form, the contacts can be configured to prefill the form with comma-separated email addresses that can then be sent out as email referrals.

If you received a notice from your email service provider, it is likely that you used CloudSponge to access your contacts with one of our customers. Please rest assured that we do not store, use, or distribute your address book contents in any way other than to provide the service to our customers. We are a US-based company that takes fraud and privacy very seriously.

We accept guest posts that are relevant to CloudSponge.

Yes. We offer a bug bounty. Please reach out to us at support@cloudsponge.com with specific details.

No. We’re only handling the address book importing part of the solution for you. You’ll have to send the invitations or coupons to your users’ friends yourself. For transactional email delivery we highly recommend SendGrid rather than using your own mail server.

Absolutely! There are tons of ways you can customize the widget, we’ve written a whole section about widget customizations in our Developer Documentation.

No. You can let our widget guide the user through importing their contacts, then pass the contacts to your application to render them. The beforeDisplayContacts callback lets you get the full list of contacts in JavaScript and suppress the display of the contact chooser. Find a minimal example here.

There’s one critical step in the process, which is to add the ../auth/contacts.readonly scope to your Google developer account. If this scope isn’t present, Google will just rubber stamp your verification and make everything look so good in your developer account, while reality is different.

There are a few gotchas in doing this properly, so I made a short video to show and describe how to do it. This video shows how to ensure your OAuth app is ready for a proper review including verifying your URLs and adding the appropriate scope.

You may not see every contact in the widget because CloudSponge only displays contacts that pass through some simple email validation. This ensures that your application only gets a list of contacts with reasonable looking email addresses.

One common address that is filtered is the Exchange address. These addresses generally follow this format:

/o=ORGANIZATION_NAME/ou=organizational group/cd=RECIPIENTS/cn=username</code>

If you would like all the emails to appear in the widget, you can set an option to override the filtering of these emails. Specifying:

performEmailValidation: false

in the csPageOptions will display every contact with an email address, valid or not.

Branding the AOL experience is only possible if you have an existing developer relationship with AOL.

After applying the changes to see your domain in the Google Authentication window, you may still get an invalid client error from Google.

That error is displayed when under “APIs & auth” -> “Consent screen” you have empty field. Make sure the field “Product Name” is correctly filled in and that you have also selected an e-mail address. You can find “Consent screen” by going to https://console.developers.google.com/project. Then, click on your project’s name and go to “APIs & auth” -> “Consent screen”.

The CloudSponge servers are hosted by Amazon Web Services with redundancy at every level of the stack and load balancing on our most critical parts.

Operating on thousands of websites for several years has given us all the data we need to know exactly how much activity each of our server instances can handle. Our monitoring thresholds are set at “better-safe-than-sorry” levels to make sure we are notified well in advance of any bottlenecks forming.

The ability to launch more server instances instantly coupled with our generous monitoring thresholds gives us full confidence that we can handle any amount of traffic that your website can send our way.

Yes it does. It requires that the user grant access to read the user’s Yahoo Mail during the OAuth flow.

In general, we return the contacts_owner whenever possible, but in some cases this is not possible, e.g. from a CSV upload or if your Yahoo credentials don’t include the Yahoo Mail scope.

When you register a domain xyz.com, the domain key will work on more specific subdomains like www.xyz.com. However the inverse is not true. If you register www.xyz.com, the domain key will not work on xyz.com.

The solution to this is to transfer your domain to be xyz.com. You can do that from the ‘Cancel’ tab of the domain details page.

If you are registering a new domain, we always recommend registering the apex domain (e.g. xyz.com) so it can also be used on subdomains. The exception to this is when your site is hosted on another service that uses a subdomain to redirect to your.

Exceptions: My site is hosted on herokuapp.com: Using the full subdomain is appropriate here. My site is always available on www.xyz.com. If your site has a url rewrite from xyz.com -> www.xyz.com or these domains point to different sites, then of course it makes sense to register the subdomain.

No, in order to use the CloudSponge Contact Picker you will need an existing referral program. We integrate beautifully with referral programs. Check out our integrations and if you don’t see one you like, let us know.

We only count production domains towards your site limit. You can add as many dev sites, subdomains, and aliases as you need. In your CloudSpong customer portal, you can add, approve, deny, and delete your domains.

No. Your user’s address book will stay in memory on our servers for a few minutes so that your website has a chance to download it, but then it’s wiped from memory and never written to disk.

In most cases, we never see the credentials. AOL, Google, Yahoo and Microsoft all use the OAuth 2.0 delegated authentication frameworks that ensure that their users never have to give their credentials away to third parties like us. For the other address book sources, we never save their credentials to disk and we wipe it from our server’s memory after a few minutes.