Política de privacidad (borrador)

Effective date: [INSERT DATE BEFORE PUBLISHING]
Last updated: [INSERT DATE BEFORE PUBLISHING]

Draft status: This document is a legal draft that requires review by a licensed attorney familiar with GDPR, CCPA, and LFPDPPP before publication. Do NOT publish without that review.

1. Introduction

Realcaller ("we," "us," or "our") is a caller identification and spam reporting service. This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, and your rights with respect to your personal data.

We take privacy seriously. Our product is designed around the principle of minimum necessary data collection. We do not sell your data. We do not build advertising profiles.

2. Legal basis and jurisdiction

We operate under the following applicable laws:

Mexico: Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and its Reglamento.
European Union / EEA: General Data Protection Regulation (GDPR), Regulation (EU) 2016/679.
California, USA: California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA).
India: Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025. Substantive obligations phase in through 14 May 2027; we are building toward full compliance ahead of that date, including notice-and-consent flows and data-principal rights handling.
Other jurisdictions: We comply with applicable local data protection laws for all users.

Controller: Not yet decided (legal entity name, address and registration number to be added).

DPO / Privacy Contact: Not yet decided.

3. What data we collect and why

3.1 Phone number lookups (core function)

What: When an incoming call needs a live lookup (for example, the number is not one of your contacts, is not on your own lists and is not already in the phone's cache), the calling party's E.164-formatted phone number is transmitted to our backend server for reputation lookup.

Why: This is the core function of the app: identifying whether a caller is likely spam.

How it's handled: The phone number is used only to look up its reputation score. It is NOT stored linked to your identity. It is NOT stored in a user profile. It is NOT combined with your contacts or call history. After the lookup response is returned, the number is:

Stored in your device's local cache for performance. You can remove it by clearing the app's data in Android settings.
If the number is not known to our database, or is known only from user reports, recorded on the server together with the caller country and the time, with no link to any device identifier or user identity, and deleted after 30 days.

Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)): providing the requested caller identification service.

3.2 Spam reports you submit

What: When you voluntarily submit a spam report, we collect: the reported E.164 phone number, a spam category (Robocall / Telemarketer / Scam / Phishing / Other), an optional short text note, and an anonymous device identifier (see 3.3 below).

Why: To improve the spam reputation database and protect other users.

Retention: No retention period has been decided yet. Reports are used for score computation under our locked v1 formula.

Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)) for community spam protection; consent (Art. 6(1)(a)) for voluntary submission.

3.3 Anonymous device identifier

What: On first launch, the app generates a random UUID (e.g., f47ac10b-58cc-4372-a567-0e02b2c3d479) and stores it in SharedPreferences. This UUID is sent with spam reports and with "Spam" / "Not spam" feedback (see 3.4) to prevent abuse (rate limiting, deduplication).

Why NOT linked to identity: This UUID is not associated with your name, email, phone number, Google account, or any other identifier. It is not transmitted to any third party. It cannot be used to re-identify you. It can be reset by clearing app data.

Retention: The UUID persists until you clear app data or uninstall.

Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)) for fraud prevention and rate limiting.

3.4 "Spam" / "Not spam" feedback on caller cards

What: When you tap "Spam" or "Not spam" on a caller card after a call, we collect: the caller's E.164 phone number, the time of that call, the verdict the app showed you (for example "suspicious"), your answer, and the anonymous device identifier (see 3.3). Nothing is sent unless you tap one of these buttons.

Why: To measure how often the app's verdicts are right, and to point a human reviewer at numbers that many users disagree with (for example a legitimate business wrongly flagged as spam). Feedback does not change any number's score automatically.

Retention: 180 days, then deleted automatically by a nightly cleanup job.

Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)) for service quality; consent (Art. 6(1)(a)) for the voluntary tap.

3.5 What we do NOT collect

We explicitly do NOT collect:

Your contacts list or address book.
Your call history or call log.
Your location.
Your Google account or email.
Financial information.
Health information.
Biometric data.
The content of calls.
SMS messages.
Any personally identifiable information beyond what is described in 3.1 to 3.4.

4. How we use your data

Purpose	Data used	Legal basis
Caller identification (core service)	E.164 number, caller_country	Legitimate interests
Spam score computation	E.164, report category, device UUID	Legitimate interests
Abuse prevention (rate limiting)	Device UUID, report timestamps	Legitimate interests
Verdict accuracy and human review of disputed numbers	"Spam" / "Not spam" feedback (3.4)	Legitimate interests; consent for the tap
Improving our database (aggregated)	Anonymized lookup miss counts	Legitimate interests
Legal compliance	As required by applicable law	Legal obligation

We do NOT use your data for:

Advertising or ad targeting.
Selling to data brokers.
Building behavioral profiles.
Cross-app tracking.

5. Data sharing and third-party processors

We use the following third-party processors. All are bound by Data Processing Agreements (DPAs) consistent with GDPR.

Processor	Purpose	Location	Legal mechanism
Vultr Holdings LLC	Backend server hosting	Region not yet confirmed	Standard Contractual Clauses (SCCs)

We do NOT share personal data with:

Advertising networks.
Social media platforms.
Analytics companies (no third-party analytics SDK).
Data brokers.
Law enforcement (except as legally required, see Section 8).

6. Data security

We implement the following technical and organizational measures:

In transit: All API traffic uses HTTPS. The app refuses plain HTTP connections.
Phone number masking in logs: Server request logs mask phone numbers to the format ***NNNN (last 4 digits only).
Access control: Only authorized personnel have access to production infrastructure.
Incident response: In the event of a data breach affecting personal data, we will notify affected users and relevant supervisory authorities within 72 hours as required by GDPR Art. 33.

7. Data retention

Data type	Retention period	Deletion mechanism
Lookup logs (anonymized)	30 days, then auto-deleted by nightly cleanup job	`cleanup_lookup_misses.py` runs nightly
Spam reports	Not yet decided	Manual deletion or scheduled cleanup
"Spam" / "Not spam" feedback	180 days	`cleanup_call_feedback.py` runs nightly
Device UUID (server-side)	Not yet decided	To be implemented
Local cache (on device)	30 days LRU, or until you clear app data	Android Room database with 30-day expiry

8. Your rights

Depending on your jurisdiction, you have some or all of the following rights:

All users:

Access: Request a copy of the data we hold about your device UUID and associated reports.
Deletion: Request deletion of your spam reports and device UUID from our records.
Portability: Receive your data in a machine-readable format.

GDPR users (EU/EEA):

All the above, plus:
Rectification (Art. 16): Correct inaccurate data.
Restriction (Art. 18): Restrict processing while a dispute is pending.
Object (Art. 21): Object to processing based on legitimate interests.
Supervisory authority complaint: Lodge a complaint with your national data protection authority (e.g., AEPD in Spain, CNIL in France, BfDI in Germany).

CCPA users (California, USA):

Right to know, right to delete, right to opt out of sale (we do not sell data), right to non-discrimination.

LFPDPPP users (Mexico):

Derechos ARCO (Acceso, Rectificación, Cancelación, Oposición).
To exercise ARCO rights, use the privacy contact, which has not been decided yet.
Response time: 20 business days as required by LFPDPPP Art. 23.

To exercise any right: Send a request to the privacy contact (not yet decided) titled "Privacy Request," with a description of your request. We will respond within 30 days (GDPR) or 20 business days (LFPDPPP).

9. Children

Realcaller is not directed at children under 13 (or under 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided data, contact the privacy contact (not yet decided) and we will delete it promptly.

10. International transfers

Our server is hosted at Vultr; the region is not yet confirmed. If you are located in the EU/EEA and data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs) as the transfer mechanism per GDPR Chapter V.

11. Changes to this policy

We will notify users of material changes by updating the "Last updated" date and, for significant changes, via an in-app notification. Continued use after the effective date constitutes acceptance.

12. Contact

Privacy inquiries and data rights requests: Not yet decided.

For EU/EEA users, representative (if required under GDPR Art. 27): Not yet decided. If there are EU users and we are not established in the EU, an EU representative may need to be appointed.

This privacy policy was drafted as a starting point and requires review by a licensed attorney before publication. Realcaller is not providing legal advice.