Privacy Policy

1. Who this policy is about

Phone Screen handles information about three kinds of people, and this policy is organized around them:

• You, the person who installed the app and whose calls are screened.
• The people in your contacts, whose names and numbers the app syncs so they can ring straight through.
• People who call you, whose words are transcribed while the assistant screens them. Most of them are not Phone Screen users. There is a section written for them below.

2. Information about you

Your account

You sign in with Apple. We receive and store the stable identifier Apple assigns to you for our app, the email address you chose to share (which may be an Apple “Hide My Email” relay address), and, on your first sign-in only, the name you shared. We use your first name to personalize the default greeting callers hear (“Hi — you’ve reached Maya’s assistant”). We store your email so we can identify your account if you contact us. We do not send marketing email.

Your phone number and carrier

You tell us your own mobile number and carrier. We use them to show you the right call-forwarding codes, to place the one-time test call that verifies forwarding is working, to recognize when you dial your own screening number, and to pick a screening number in your area code.

Your screening number

We rent a phone number for your account from our carrier partner (Telnyx) and attach it to your account. Calls forwarded to that number are what the assistant answers. It is released when you delete your account, and about a month after a lapsed subscription.

Your settings

• Screening mode (Safety Net or Gatekeeper), whether screening is on or paused, notification preferences, and what should happen if our systems fail mid-call (ring you, or take a message).
• Screening rules: up to 1,000 characters of plain-English instructions for the assistant (“I’m selling a car this week”). These are sent to the AI classifier on every screened call, so write them with that in mind.
• Allow and block rules: phone numbers you have marked as always allowed or always blocked, with an optional label.
• Quiet Mode: whether it is on, whether you turned it on by hand, on a schedule, or through an iOS Focus, your schedule (time zone and windows), and per-number overrides (VIPs who ring through, or numbers whose emergency override you revoked). If you link a Focus, the app tells our server only that Quiet Mode should be on or off.
• Greetings: for each of the three greetings (screening, voicemail, Quiet Mode), the voice you chose and either the stock script, your own script (up to 500 characters), or a recording of your own voice (up to 45 seconds).

Your devices

For each iPhone and Apple Watch signed in to your account: an installation identifier the app generates, Apple push notification tokens (one for alerts, one for incoming-call pushes), device model, iOS or watchOS version, and app version. These exist so we can ring your devices and send notifications.

Your subscription

Apple handles payment. We receive a signed receipt from Apple containing the transaction identifier, the plan you bought, its status and expiry date, and whether it is a sandbox or production purchase. We never see your card or bank details.

Your call records

Every call to your screening number creates a record in your call log. What it contains is described in section 4, because most of it is about the caller.

Technical information

• Your IP address is used to rate-limit sign-in and other sensitive endpoints. Those counters are kept for about a day. Cloudflare, which hosts our service, also sees IP addresses as part of operating its network.
• Our server logs contain event names, internal record identifiers, timing measurements, error messages, and a keyed one-way hash of the caller’s number for correlation. They are designed never to contain phone numbers, names, transcripts, message contents, or session tokens.
• On your device, the app keeps your session tokens in the iOS keychain, a fingerprint of your contact list so unchanged lists are not re-sent, and ordinary preferences. Your Apple Watch keeps a copy of your session tokens in its own keychain.

3. Your contacts

If you grant the app access to Contacts, it reads each contact’s name (first and last, or the organization name if there is no personal name) and phone numbers. It normalizes the numbers and sends the list, up to 10,000 numbers, to our server, where it is stored against your account. When your contacts change, the app sends the updated list. iOS “Limited Access” to selected contacts is supported and works the same way for the contacts you selected.

Your contact list is used for exactly these things:

• When a call arrives, checking whether the caller’s number is in your contacts, so they ring straight through without being screened.
• Showing the contact’s name on the incoming call, in your call log, and in the notification if you miss them.
• In Quiet Mode, recognizing that a caller is a contact, so they hear your quiet greeting and can press 1 for an emergency, unless you have marked them as a VIP, in which case they ring through.

It is not used for anything else. It is never used for marketing, never matched against other users’ data, never sent to an AI vendor, and never sold or shared. No other user can see your contacts. Contacts are stored only so that the routing decision can be made on our server, where the call arrives; it happens before your phone is involved.

You can turn off Contacts access for Phone Screen in iOS Settings at any time. The app then stops syncing; the last list we received stays on your account until you delete the account, and callers on it continue to ring through. Deleting your account deletes the list.

4. People who call you

For each call to your screening number, we record:

• The caller’s phone number as delivered by the phone network (or “anonymous” if they withheld it), when the call started and ended, how long it lasted, and how it was handled (rang through, blocked, went to voicemail, missed, and why).
• If the assistant screened the call: a transcript of what the caller said in reply to the greeting, the assistant’s decision (allow, reject, or uncertain), a category (such as healthcare, delivery, sales, robocall, or scam), a confidence score, a one-sentence reason, the name the caller gave, and a short summary of why they were calling. The transcript covers only the screening window, at most about 30 seconds of speech.
• If the caller left a message: the recording (up to two minutes) and its transcript. For priority messages left in Quiet Mode, also a one-line AI summary used in the notification.
• If you create an allow or block rule from the call: the caller’s number and the label you chose.

The transcript is written as it forms during the call so you can watch the screening live in the app. Push notifications about blocked calls never include transcript content; notifications about calls that rang through include the caller’s name and purpose.

5. What happens on a screened call, step by step

1. Your carrier forwards the call to your screening number. Our carrier partner tells our server the caller’s number and the number they dialed.
2. Known callers are routed without screening: contacts and allow-rules ring straight through (or hear your quiet greeting in Quiet Mode); block-rules are hung up on. Nothing is transcribed or recorded for these calls.
3. Unknown callers hear your greeting. The default one says: “Hi — you’ve reached [your first name]’s assistant. Please say your name and the reason you’re calling.” It identifies itself as an assistant and does not claim to record, because nothing is recorded in this step.
4. The caller’s audio streams to our server, where it is held in memory only and converted to text in real time by a speech-recognition model (Deepgram Flux, with Deepgram Nova-3 as a fallback) running on Cloudflare Workers AI. The audio is never written to disk or storage. Screening ends when the caller has explained themselves, or after about 30 seconds at most. If the line carries no speech at all for six seconds, the call is treated as a robocall.
5. The transcript, together with any screening rules you wrote, goes to the classifier. A short list of known robocall phrases is checked first; otherwise a language model (Google Gemini 2.5 Flash Lite, reached through OpenRouter, with Google Gemma on Cloudflare Workers AI as a fallback) returns a decision, category, confidence, reason, the caller’s stated name, and their purpose. The model never receives the caller’s number, your name, or your number.
6. If the decision is allow, the caller hears “connecting you now” and your iPhone (and Apple Watch, if you have one) rings, with the caller’s name and reason on screen. If it is reject, the call is ended. If the model is unsure, the caller is put through after a short pause.
7. About a second and a half after the decision, the audio held in memory is discarded and the call session’s temporary storage is wiped.
8. If you do not answer, or you decline, the caller is offered voicemail (section 7).
9. If speech recognition or the classifier fails mid-call, the call “fails open”: depending on your setting, the caller rings through or is sent to voicemail, and the record notes that no decision was made.

6. Once you are connected

When a call rings through and you answer on your iPhone, the audio is bridged by our carrier partner directly between the caller’s line and the calling software inside the app. The leg between your phone and the carrier is encrypted (WebRTC with DTLS-SRTP). Our servers only exchange call-control messages; they are not in the audio path and cannot hear, record, or transcribe the conversation. The screening transcript ends where you picked up.

iOS reports the call through CallKit, so it appears in your Phone app’s recents like any other call. That history lives on your device and is managed by iOS.

Apple Watch is different. The watch has no direct line to the carrier, so when you answer on your wrist the caller’s audio and your voice are relayed through our server, one 20-millisecond frame at a time, in memory. Nothing is recorded, transcribed, or stored; each frame is discarded as soon as it is passed on. If you would rather our servers never carry live audio, answer on your iPhone.

7. Voicemail

A caller is offered voicemail when a call that rang through goes unanswered or you decline it, when no device of yours is registered to ring, when they leave a priority message in Quiet Mode, and when a failed screening is configured to take a message. Before any recording starts, the caller hears the voicemail prompt. The default says: “You’ve reached [your first name]’s voicemail. Leave your name, your number, and a short message after the tone, and they’ll get back to you.” In Quiet Mode, the greeting itself says that callers can leave a message after the tone, and the recorder then plays only the tone.

The carrier records the message (up to two minutes). We copy the recording to our own storage, delete the carrier’s copy, transcribe it with OpenAI’s Whisper model running on Cloudflare Workers AI, store the transcript with the call record, and notify you. In the rare case that our copy fails, the carrier’s copy is kept until we recover the message, then deleted. Priority messages are also summarized to one line by Google Gemma on Workers AI so the notification can show it silently.

The recording is deleted automatically after 30 days. The transcript stays with the call record until you delete the call or the record expires. Deleting a call removes both immediately.

8. How we use information

We use personal information only to run Phone Screen. Where the GDPR or UK GDPR applies, the legal basis for each purpose is shown.

We do not use your information, your contacts, transcripts, or voicemails to train AI models, and we do not permit the vendors that process transcripts or voicemails to. The assistant’s screening decisions are automated, but they decide only whether a particular call rings your phone; they have no legal or similarly significant effect on you, every decision is shown to you with its reasoning, and you can overrule any of them with a rule.

9. AI processing and service providers

These are the only companies that process personal information for us. Each acts on our instructions as a service provider (a “processor” under the GDPR) and receives only what the table says.

There are no other third parties. The app contains no analytics, advertising, attribution, or crash-reporting SDKs; the only third-party code in it is the carrier’s calling library and the open-source components it depends on.

10. Sharing, selling, and advertising

Apart from the service providers above, we disclose personal information only:

• when you direct us to (for example, a caller’s name and purpose shown on your watch);
• when the law requires it, in response to a valid legal process, or to protect someone’s safety or our rights;
• if Phone Screen is acquired or merged, in which case this policy continues to apply and we will notify you in the app before your data is subject to a different one.

We do not sell personal information, and we have not in the past 12 months. We do not share it for cross-context behavioral advertising, and we do not serve targeted advertising. Because we do none of these things, there is no “Do Not Sell or Share My Personal Information” switch to flip; the answer is already no for everyone. We also do not use your information for profiling that produces legal or similarly significant effects.

11. Where data lives and how it is protected

• Our servers run on Cloudflare. Records are stored in Cloudflare D1 (a database) and audio in Cloudflare R2 (object storage). We operate from the United States, and your data is processed there.
• Everything is encrypted in transit: the app talks to our servers only over HTTPS and secure WebSockets; the carrier legs use TLS, and the leg between your phone and the carrier uses DTLS-SRTP. There are no unencrypted endpoints.
• Stored data is encrypted at rest by Cloudflare. Voicemail recordings are additionally encrypted with a key specific to your account before they are stored, so they cannot be read without it.
• Screening audio lives only in the memory of the call session handling that one call; the session’s temporary storage is wiped when the call decision is made, and again by an alarm if the session is interrupted.
• Every API request is authenticated with a short-lived session token (15 minutes) that is refreshed with a rotating refresh token; reuse of a stolen refresh token revokes the whole session family. Every record is checked against the signed-in account before it is returned.
• Live audio streams from the carrier into our service are authenticated per call with short-lived credentials, and every webhook from the carrier is signature-verified before it is acted on.
• Greeting audio must be fetchable by the carrier to be played, so it is served from unguessable, one-time URLs that change every time a greeting is re-rendered. Voicemail audio is never served that way: it is available only through the authenticated API, only to the account that owns the call.
• Logs are designed to contain no phone numbers, names, transcripts, or tokens. Debugging endpoints that can originate calls exist only in our development environment and are not registered in production.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

12. How long we keep things

13. Your controls in the app

• Delete a call. Open the call and choose Delete call. The record, its transcript, and any voicemail audio are removed immediately.
• Delete your account. Settings → Delete account. This immediately signs out every device, releases your screening number, and deletes your calls, transcripts, voicemails, greetings and recordings, contacts, rules, Quiet Mode settings, device registrations, subscription record, and profile, including any archived call records. Only a 30-day placeholder keyed to your Apple identifier remains, then it is purged too. Dial your carrier’s disable code first, or forwarded calls will go nowhere.
• Pause screening. Assistant → Pause screening. Every call rings you directly and nothing is screened, transcribed, or recorded while paused. You can also switch off forwarding at your carrier, which stops calls reaching us at all.
• Contacts. Grant, limit, or revoke access in iOS Settings → Phone Screen → Contacts.
• Notifications. Control them in iOS Settings, and in the app choose whether blocked calls and call summaries notify you at all.
• Screening rules and greetings. Edit or clear them at any time under Assistant.
• Allow and block rules, Quiet Mode overrides. Add or remove them from any call or from the People screen.
• Your data. Settings → Export my data gives you a machine-readable copy of everything on your account. You can also email [CONTACT EMAIL].
• Sign out. Signing out removes that device’s push registration, so it stops ringing for your calls.

14. Your privacy rights

United States

Depending on where you live (including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws), you may have the right to know what personal information we hold about you and receive a copy, to correct it, to delete it, to receive it in a portable format, to opt out of sales, sharing for targeted advertising, and profiling (none of which we do), and to limit the use of sensitive personal information. We will never discriminate against you for exercising these rights.

The quickest way to exercise them is in the app: Export my data, Delete account, and Delete call do exactly what they say, immediately. You can also email [CONTACT EMAIL]. We verify requests by asking you to write from the email address on your Apple account or from inside the app; an authorized agent may act for you if they can show your written permission. We respond within 45 days, and will tell you if we need longer. If we decline a request, you can appeal by replying to our decision, and we will answer within 45 days; you may also contact your state attorney general.

Notice at collection. In the last 12 months we have collected these categories of personal information, from you, your device, Apple, the phone network, and the people who call you, for the purposes in section 8, and disclosed them for business purposes only to the providers in section 9: identifiers (Apple identifier, email, phone numbers, device and push identifiers, IP address); customer records (name, phone number); commercial information (subscription history); internet and device activity (app and OS versions, minimal request logs); audio and electronic information (voicemail recordings, screening transcripts); and inferences (the assistant’s categorization of a call, which is about the caller, not you). Sensitive personal information we hold consists of the contents of communications (transcripts and voicemails), which we use only to provide the service to you. We do not collect precise geolocation, health, financial-account, government-ID, or biometric information; recordings of your voice are used to play your greeting and never to identify anyone. We do not sell or share personal information. California residents may also request, under the “Shine the Light” law, a list of third parties to whom we disclosed personal information for their direct marketing: there are none.

European Economic Area, United Kingdom, and Switzerland

Phone Screen supports US and Canadian phone numbers only, but if you use it from the EEA, UK, or Switzerland, the controller of your personal information is [LEGAL ENTITY NAME], and our representative in the EU/UK is [EU/UK REPRESENTATIVE NAME AND ADDRESS, if required]. Our legal bases are listed in section 8. You have the rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent where we rely on it, and the right to lodge a complaint with your supervisory authority. Your data is transferred to and processed in the United States; we rely on Standard Contractual Clauses and, where our providers are certified, the EU-US Data Privacy Framework. Contact [DATA PROTECTION CONTACT / DPO EMAIL].

15. If you called a Phone Screen user

You reached this page because you called someone who uses Phone Screen. Here is what happened and what we hold about you.

• You heard an assistant say you had reached the person’s assistant and ask who you were and why you were calling. What you said next was transcribed by software in real time so the assistant could decide whether to ring the person. Your voice was not recorded during that step.
• If you were put through, your conversation with the person ran directly over the phone network and was not recorded or transcribed by us.
• If you were told you had reached voicemail and left a message after the tone, that message was recorded, transcribed, and delivered to the person, exactly as a voicemail would be.

What we hold, on that person’s account only: your phone number, the time of the call, the transcript of what you said to the assistant, the name and reason you gave, the assistant’s assessment, and any voicemail (audio for 30 days, transcript with the call record). The person you called controls it: they can read it, delete it, and use it to decide whether to let your future calls through. We process it on their behalf, in their interest of managing their own calls, and for nothing else: no marketing, no sharing, and no pooled database of callers. Blocking your number for one user has no effect on any other user.

To ask what we hold or to request deletion, email [CONTACT EMAIL] with the number you called from and roughly when you called. We may need to verify that the number is yours, and because the record belongs to the person you called, we may need to involve them. If your number was withheld, we have nothing to identify you by.

16. Call recording and consent

Because recording laws differ from place to place, here is exactly which parts of a call are recorded, which are only transcribed, and what callers are told.

The default screening greeting does not say “this call may be recorded”, because it is not; the transcript is produced live and no audio is kept. Recording happens only after a caller has been told they have reached voicemail (or, in Quiet Mode, that they can leave a message after the tone) and has chosen to speak after the tone. That announcement is emitted together with the recorder as one unit, so there is no path to a recording that skips it.

Some US states, including California, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington, require the consent of everyone on a call before it is recorded. Leaving a voicemail after being told it is voicemail is generally understood as consent. If you customize your greetings, keep the parts that tell callers they have reached an assistant and that a message will be recorded after the tone. The app warns you when a screening greeting no longer asks for a name and reason, and when a Quiet Mode greeting drops the “press 1” instruction, but it does not check greetings for legal disclosures. You are responsible for your configuration complying with the recording and consent laws that apply where you and your callers are. This section is information, not legal advice.

17. Children

Phone Screen is not directed to children under 13, and we do not knowingly collect personal information from them. The App Store rates the app [APP STORE AGE RATING]. If you believe a child under 13 has created an account, email [CONTACT EMAIL] and we will delete it. A child who calls a Phone Screen user is treated like any other caller, and the record is deleted on request as described in section 15.

18. This website

This site sets no cookies, runs no analytics or tracking scripts, loads nothing from third-party servers (its fonts are served from the site itself), and asks you for nothing. Its only outbound link is to the App Store. It is hosted on Cloudflare, which may keep short-lived request logs (such as IP address and browser type) to operate and protect its network. Because we do not track visitors, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off; we honor both by default.

19. Changes to this policy

When we change this policy we will post the new version here with a new effective date. If a change materially reduces your rights or expands what we collect, we will tell you in the app before it takes effect.

20. Contact

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
[CONTACT EMAIL]

Data protection contact: [DATA PROTECTION CONTACT / DPO EMAIL]