Privacy Policy

Everything you enter — names, addresses, phone numbers, notes, visit dates, study details and service hours — is written to an encrypted database file inside the app's own storage on your device.

That database is encrypted with SQLCipher. The encryption key is random, and is itself protected by the password you choose when you create your account: your password derives a key (via scrypt) that unwraps the database key using AES-256-GCM.

Your password is never sent anywhere. When you sign in, your device derives two separate values from it: one stays and produces the encryption key; the other — which cannot be turned back into your password or into the key — is what the sign-in service verifies. So there is something that checks you typed the right password, and it still never sees the password: a wrong one is refused at sign-in and, more fundamentally, produces bytes that do not decrypt. The same password works on a second device because it is the only thing your devices share.

The wrapped key is stored in two places: the system's own secure storage — the Keychain on iPhone and iPad, the Android Keystore on Android — and a file in the app's own storage. Both copies are wrapped: they are useless without your password.

On iPhone and iPad the Keychain copy is marked so that it never leaves that device, and the file copy is the one that is included in an iCloud Backup — deliberately, because otherwise restoring a new phone from a backup would give you the encrypted database and nothing to open it with.

On Android there is no automatic cloud backup at all. Android would otherwise copy an app's data directory to the user's Google Drive on its own schedule; Callbook switches that off, because it would be a fourth place your data goes and this policy names three. The practical consequence is worth knowing: restoring a new Android phone from a Google backup does not bring your callbook with it. Use the app's own encrypted backup, or turn on sync, before you change device.

• It never sends your callbook — the people you visit, your notes, your hours — anywhere anyone else can read. Not the developer, not Google, not Apple. The one exception is the email address on your account, described below.
• It never transmits your password. Sign-in verifies a value derived from it on your device, and that value cannot recreate the password or the encryption key.
• Nothing anywhere holds your password or anything that recovers it. A breach of the sign-in service would expose no key and none of your data.
• It contains no analytics, advertising or tracking of any kind. The one diagnostic it sends is a crash report, described below, and it carries nothing of yours.
• It contains no third-party advertising or marketing SDKs.
• It does not share, sell or disclose your information to anyone.

Callbook needs an account only so that sync and sign-in on a second device have something to be keyed to. There is no approval step and no administrator: whoever signs in is in. Accounts are held by Google's Firebase Authentication (project callbook-access). When you create one you give an email address and choose a password — or, on iPhone and iPad, use Sign in with Apple, in which case Apple vouches for the account and, if you choose Hide My Email, gives a private forwarding address so Callbook never sees your real one — or, from version 1.2.5, Sign in with Google, in which case Google vouches for the account and the address it gives is your real one (Google has no forwarding option). With Google, Callbook keeps your address and your name and nothing else it is offered. Your Google picture is shown on the account screen from the sign-in record while you are signed in and is not stored by Callbook, and the Google account identifier is used as nothing but a label. A name you type at sign-up stays on your device, inside the same encrypted record as everything else, and is used only to greet you; it is never sent to the sign-in service or anywhere else.

The password is not part of your identity and is never sent with it. See above: it stays on your device and produces your encryption key.

You can sign out at any time, from Settings. That removes Callbook's callbook, its encrypted database and the stored key from the device. If sync is on, the copy in the cloud is left untouched and signing back in with the same email and password brings your callbook back — though anything that had not synced yet does not. Erasing everything, also in Settings, destroys both.

The account record is stored in Google's Firebase, in a database belonging to this app. Nobody reads a list of who signed up — there is no such screen in the app and no person whose job that is — and it is not shared with anyone or used for anything except signing you in. Google acts as a processor and its practices are described at firebase.google.com/support/privacy.

Callbook can keep two of your own devices in step, and let a new phone pick up your callbook without restoring from a backup. Sync is off until you turn it on.

When it is on, Callbook stores a single encrypted copy of your callbook in the app's Firebase database, filed under your account and readable by no other account. There is no administrator account with a different rule.

Because the key comes from that passphrase, each device asks for it once when you enable sync. And the warning applies with full force: forget it and the copy in the cloud is as permanently unreadable as the one on your phone.

The database that holds the copy is Google Cloud Firestore in the nam5 multi-region, which is in the United States. If you use Callbook from another country, turning sync on sends that encrypted copy there. It is ciphertext sealed with a key that never left your device, so nobody at the other end — Google, the developer, or anyone with access to the server — can read it; but it is stored there, and you should know where.

Turning sync off, in Settings, stops any further uploads and leaves the copy alone. Deleting that copy is a separate action on the same screen.

With sync off, your callbook exists on your device and nowhere else. Whatever country you are in, that is where it is: no server holds a copy, so nothing about your calls is subject to anyone's data rules but your own phone's. It also means the device is the only copy. Lose it, reset it, or sign out, and the callbook is gone. Settings says so, under Where your data lives.

With sync on, there is exactly one more copy: the encrypted one described above, in the United States. Laws about personal data differ from country to country; wherever you are, this data is yours alone, and you can export it as a file or erase it from inside the app at any time.

If you choose to save a location for a person, Callbook asks for permission to read your device's current coordinates once, at that moment. The coordinates are stored in the same encrypted database and used only to place a pin on the map inside the app.

Location is never transmitted to the developer or to anyone else: if sync is on, coordinates travel inside the same encrypted copy as everything else, unreadable to Google and to the developer alike. The permission is optional — declining it only means you cannot capture coordinates automatically. Callbook does not track your location in the background.

This is an iPhone and iPad feature. The Android version has no calendar in it: it asks for no calendar permission, the option does not appear in its Settings, and it cannot write an event even if something asked it to.

On iPhone and iPad, if you ask Callbook to add an appointment to your calendar, it writes the event on your device and can never read your calendar back. The permission it asks for is the write-only one iOS offers, and it is asked for once, only when you turn the option on in Settings. What your calendar does after that is Apple's sync and your own settings, not Callbook's.

By default the event says only that you have a visit; it names the person only if you turn that on, and it never carries an address or a note. Callbook never proposes a free slot, never checks for a clash and never imports anything: it has no use for what is already on your calendar, so it does not ask to see it.

If you enable it, the check is performed entirely by the operating system — Face ID or Touch ID on iPhone and iPad, your fingerprint or face on Android. Callbook receives only a yes-or-no answer and never has access to your biometric data, which never leaves the secure hardware that holds it: Apple's Secure Enclave, or the equivalent on your Android device. Callbook cannot read it, and neither can anyone it talks to.

Callbook uses Expo's update service so improvements can be delivered without a full App Store or Google Play release. On launch it contacts u.expo.dev to ask whether a newer version of the app's code exists.

That request carries technical information only — the platform, the app's runtime and update identifiers — and, as with any internet request, your device's IP address is visible to the server. No part of your callbook is included, and none of your entries, notes, contacts or locations are sent.

Callbook sends no push notifications. The one notification it can show — that an update has been downloaded and is ready — is created on your device and never leaves it; nothing registers your device with any notification service.

Expo's own privacy practices are described at expo.dev/privacy.

From version 1.2.4, when Callbook crashes or hits an error it did not expect, it sends a report to Sentry, an error-reporting service, so the fault can be fixed without you having to describe it. The report contains the error and where in the program it happened, the app version, the operating system version, the device model, and the sequence of screens and taps just before it.

Sentry acts as a processor and its practices are described at sentry.io/privacy. Reports are kept for thirty days.

Callbook can export a copy of everything as a JSON file through the system share sheet. This happens only when you ask for it, and you choose where the file goes.

The exported file is not encrypted, so that you can open it on a computer. Once it leaves the app it is an ordinary file on your device, and this policy no longer governs it — handle it accordingly.

"Erase everything" in Settings deletes the encrypted database and the stored key on the device, the encrypted copy on the server, and the account itself. A server-side routine removes anything that step could not reach. Deleting the app from your device erases the device's copy; the account and anything synced remain until you erase them from inside the app or ask via the contact below.

Erasing needs a connection to reach the server. If your device is offline at that moment, Callbook tells you so and the server copy stays until you try again — though it is already unreadable by then, because the key that opened it was destroyed with everything else.

Callbook is a personal record-keeping tool intended for adults. It is not directed at children and does not knowingly gather information about them.

If this policy changes, the revised version will be published at this address with a new date below. Material changes to how data is handled would also be described in the app's release notes.

Callbook is made by Bermudez Systems LLC. Questions about this policy, and any request about your data, go to support@bermudezsystems.com. There is also a support page.