Privacy Policy

Everything you enter — names, addresses, phone numbers, notes, visit dates, study details and service hours — is written to an encrypted database file inside the app's own storage on your device.

That database is encrypted with SQLCipher. The encryption key is random, and is itself protected by the password you choose when you create your account: your password derives a key (via scrypt) that unwraps the database key using AES-256-GCM.

Your password is never sent anywhere. When you sign in, your device derives two separate values from it: one stays and produces the encryption key; the other — which cannot be turned back into your password or into the key — is what the sign-in service verifies. So there is something that checks you typed the right password, and it still never sees the password: a wrong one is refused at sign-in and, more fundamentally, produces bytes that do not decrypt. The same password works on a second device because it is the only thing your devices share.

The wrapped key is stored in two places. One copy is in the iOS Keychain, marked so that it never leaves this device. A second copy is written to a file in the app's own storage, which means it is included in an iCloud Backup of your iPhone — deliberately, because otherwise restoring a new phone from a backup would give you the encrypted database and nothing to open it with. Both copies are wrapped: they are useless without your password.

• It never sends your callbook — the people you visit, your notes, your hours — anywhere anyone else can read. Not the developer, not Google, not Apple. The one exception is the email address on your account, described below.
• It never transmits your password. Sign-in verifies a value derived from it on your device, and that value cannot recreate the password or the encryption key.
• Nothing anywhere holds your password or anything that recovers it. A breach of the sign-in service would expose no key and none of your data.
• It contains no analytics, advertising or tracking of any kind. The one diagnostic it sends is a crash report, described below, and it carries nothing of yours.
• It contains no third-party advertising or marketing SDKs.
• It does not share, sell or disclose your information to anyone.

Callbook needs an account only so that sync and sign-in on a second device have something to be keyed to. There is no approval step and no administrator: whoever signs in is in. Accounts are held by Google's Firebase Authentication (project callbook-access). When you create one you give an email address and choose a password — or use Sign in with Apple, in which case Apple vouches for the account and, if you choose Hide My Email, gives a private forwarding address so Callbook never sees your real one. A name you type at sign-up stays on your device, inside the same encrypted record as everything else, and is used only to greet you; it is never sent to the sign-in service or anywhere else.

The password is not part of your identity and is never sent with it. See above: it stays on your device and produces your encryption key.

You can sign out at any time, from Settings. That removes Callbook's callbook, its encrypted database and the stored key from the device. If sync is on, the copy in the cloud is left untouched and signing back in with the same email and password brings your callbook back — though anything that had not synced yet does not. Erasing everything, also in Settings, destroys both.

The account record is stored in Google's Firebase, in a database belonging to this app. Nobody reads a list of who signed up — there is no such screen in the app and no person whose job that is — and it is not shared with anyone or used for anything except signing you in. Google acts as a processor and its practices are described at firebase.google.com/support/privacy.

Callbook can keep two of your own devices in step, and let a new iPhone pick up your callbook without restoring from a backup. Sync is off until you turn it on.

When it is on, Callbook stores a single encrypted copy of your callbook in the app's Firebase database, filed under your account and readable by no other account. There is no administrator account with a different rule.

Because the key comes from that passphrase, each device asks for it once when you enable sync. And the warning applies with full force: forget it and the copy in the cloud is as permanently unreadable as the one on your phone.

The database that holds the copy is Google Cloud Firestore in the nam5 multi-region, which is in the United States. If you use Callbook from another country, turning sync on sends that encrypted copy there. It is ciphertext sealed with a key that never left your device, so nobody at the other end — Google, the developer, or anyone with access to the server — can read it; but it is stored there, and you should know where.

Turning sync off, in Settings, stops any further uploads and leaves the copy alone. Deleting that copy is a separate action on the same screen.

With sync off, your callbook exists on your device and nowhere else. Whatever country you are in, that is where it is: no server holds a copy, so nothing about your calls is subject to anyone's data rules but your own phone's. It also means the device is the only copy. Lose it, reset it, or sign out, and the callbook is gone. Settings says so, under Where your data lives.

With sync on, there is exactly one more copy: the encrypted one described above, in the United States. Laws about personal data differ from country to country; wherever you are, this data is yours alone, and you can export it as a file or erase it from inside the app at any time.

If you choose to save a location for a person, Callbook asks for permission to read your device's current coordinates once, at that moment. The coordinates are stored in the same encrypted database and used only to place a pin on the map inside the app.

Location is never transmitted to the developer or to anyone else: if sync is on, coordinates travel inside the same encrypted copy as everything else, unreadable to Google and to the developer alike. The permission is optional — declining it only means you cannot capture coordinates automatically. Callbook does not track your location in the background.

If you enable Face ID, the check is performed entirely by iOS. Callbook receives only a yes-or-no answer and never has access to your biometric data, which never leaves Apple's Secure Enclave.

Callbook uses Expo's update service so improvements can be delivered without a full App Store release. On launch it contacts u.expo.dev to ask whether a newer version of the app's code exists.

That request carries technical information only — the platform, the app's runtime and update identifiers — and, as with any internet request, your device's IP address is visible to the server. No part of your callbook is included, and none of your entries, notes, contacts or locations are sent.

Callbook sends no push notifications. The one notification it can show — that an update has been downloaded and is ready — is created on your device and never leaves it; nothing registers your device with any notification service.

Expo's own privacy practices are described at expo.dev/privacy.

From version 1.2.4, when Callbook crashes or hits an error it did not expect, it sends a report to Sentry, an error-reporting service, so the fault can be fixed without you having to describe it. The report contains the error and where in the program it happened, the app version, the iOS version, the device model, and the sequence of screens and taps just before it.

Sentry acts as a processor and its practices are described at sentry.io/privacy. Reports are kept for thirty days.

Callbook can export a copy of everything as a JSON file through the iOS share sheet. This happens only when you ask for it, and you choose where the file goes.

The exported file is not encrypted, so that you can open it on a computer. Once it leaves the app it is an ordinary file on your device, and this policy no longer governs it — handle it accordingly.

"Erase everything" in Settings deletes the encrypted database and the stored key on the device, the encrypted copy on the server, and the account itself. A server-side routine removes anything that step could not reach. Deleting the app from your iPhone erases the device's copy; the account and anything synced remain until you erase them from inside the app or ask via the contact below.

Erasing needs a connection to reach the server. If your iPhone is offline at that moment, Callbook tells you so and the server copy stays until you try again — though it is already unreadable by then, because the key that opened it was destroyed with everything else.

Callbook is a personal record-keeping tool intended for adults. It is not directed at children and does not knowingly gather information about them.

If this policy changes, the revised version will be published at this address with a new date below. Material changes to how data is handled would also be described in the app's release notes.

Callbook is made by Bermudez Systems LLC. Questions about this policy, and any request about your data, go to support@bermudezsystems.com. There is also a support page.