Privacy Policy
Effective Date: September 18, 2026 · Last Updated: October 20, 2026
Operated by: Vindication Inc., 7901 4th St N Ste 300, St. Petersburg, FL 33702
support@getcallro.com · +1 (727) 354-3133 · getcallro.com
1. Introduction
Callro is an Android call screening application operated by Vindication Inc. This Privacy Policy explains precisely what data Callro collects, what it does not collect, how we use your information, and your rights as a user.
This policy is written to address the requirements of the Google Play Developer Program Policy, the California Consumer Privacy Act as amended (CCPA/CPRA), the Virginia Consumer Data Protection Act, and comparable United States state privacy laws.
By installing or using Callro, you agree to the practices described in this Privacy Policy.
2. Information We Do NOT Collect
Callro is built on a privacy-first architecture. We explicitly do not collect or request access to:
- Your contacts list or address book
- Your device call log or call history. Callro only records its own screening decisions (whether an incoming call was blocked or silenced by the App); see Sections 3.4 and 3.17.
- Voicemail content or any audio recordings
- Your name, email address, or physical address — the Android app never collects these. If you contact us by email or submit the contact form on getcallro.com, you provide this information to us directly; see Section 3.16.
- Precise location data (GPS, Wi-Fi triangulation, or cell tower positioning)
- SMS or text message content
- Any data from outbound calls you make
- Your payment card details (Google Play and Paddle process payments; Callro does not receive card numbers)
None of these permissions are requested at install time. You can verify this at any time in Android Settings → Apps → Callro → Permissions.
3. Information We Collect
3.1 Incoming Call Metadata
When a call arrives, Android's CallScreeningService API provides Callro with the incoming call information for the duration of the screening decision. Callro does not look up caller names from an online directory. If your carrier sends a caller-ID name with a call, Callro may use it as one of its signals. Callro decides whether to block a call on your phone, without contacting a server. Callro keeps the number of each screened call in your Shield Log on your device, encrypted. When Callro blocks or silences a call, it sends our servers a record containing the final four digits of the number (the other digits replaced by asterisks), the action (blocked or silenced), the reason, a score, the signal breakdown, the filter name, a hashed device identifier, your phone's manufacturer and a timestamp. These records are uploaded only for blocked and silenced calls and are kept for 90 days.
3.2 Your Phone Number (Optional)
During onboarding, you may choose to provide your phone number via the Google Phone Number Hint API.
- You can share your phone number during setup or enter just an area code instead.
- Your three-digit area code is sent to our servers to retrieve local medical-facility prefixes (see 3.3).
- If you share your number, it is stored on our servers (Supabase Inc.) in encrypted form.
- Authorized Vindication Inc. personnel can decrypt it through an access-controlled, logged process.
- Your phone number is used to (a) extract your area code to enable neighbor-spoof detection, and (b) with your consent, allow a Callro team member to call you during your first week.
- If you pick your number in the Google prompt (during setup, or later if the app asks again or you re-detect it in Settings), an encrypted copy is stored on our servers until you ask us to delete it. Agreeing to a follow-up call is a separate choice.
- To have your phone number deleted, email support@getcallro.com.
3.3 Area Code
Your three-digit area code is sent to our servers to retrieve local medical-facility phone prefixes. The request does not include your phone number or a device identifier.
3.4 Shield Log (Local Call History)
Call screening decisions (ALLOW, SILENCE, BLOCK) and associated risk scores are stored locally in your Shield Log on your device. For calls that are blocked or silenced, a separate per-call record is transmitted as described in Section 3.17 to diagnose screening accuracy.
Shield Log feedback. If you tap a feedback option on a Shield Log entry, the app sends a hashed device identifier, a one-way SHA-256 hash of the caller's phone number, your selection, and Callro's score for that call. These values are pseudonymous, not anonymous: a hash can be matched to a number by anyone who already has that number. Records are deleted after 180 days or on a verified deletion request.
3.5 Support Chat (App and Website)
Callro provides users with an optional AI-powered support assistant called Shield, available both inside the Android app and on getcallro.com. When you send a message, the message text, a session identifier, your pseudonymous device identifier hash where available, and the page you were viewing are transmitted to our servers (Supabase Inc.) and to Anthropic, PBC, whose Claude AI generates the response. Messages are stored to maintain conversation continuity. Using Shield is entirely optional. You can request deletion of your chat history at any time by emailing support@getcallro.com.
3.6 Device Identifier Hash
A one-way cryptographic hash (SHA-256) of your device's Android device identifier is generated on your device. This hash is used for trial management, subscription state, install attribution, referral and promo-code validation, push-notification delivery and aggregate product analytics. Your Android device identifier is converted on your phone into a one-way hash. Only the hash is sent to our servers. The raw Android identifier cannot be recovered from the hash, but the hash itself acts as a persistent pseudonymous identifier for your device within Callro's systems.
3.7 Trial Management
To provide a free trial without requiring a payment method and to prevent unlimited trial abuse, a one-time code issued by our server is sent to Google's Play Integrity API, and the resulting integrity token is sent to our secure servers together with the device identifier hash (described in Section 3.6) to record whether this device has previously redeemed a free trial. This hash is stored on our servers for the duration described in Section 7.
3.8 Subscription and Purchase Data
Purchases on getcallro.com are processed by Paddle; see section 3.18. We receive and store a Google Play purchase token (a unique identifier for your subscription transaction) to manage your subscription status, process referral rewards, and handle billing state synchronization. We also store your subscription status (active, expired, or cancelled) and the date your subscription started. Vindication Inc. does not collect, store, or process your payment card information. To manage or cancel your subscription, or for billing and refund assistance, visit our Subscription Management page.
3.9 Referral Program Data
If you participate in the referral program, we store your unique referral code linked to your device identifier hash, records of referral attributions (which devices used your code), referral reward statuses (pending, granted, held), and the purchase tokens needed to apply billing deferrals. When someone clicks your referral link, we record the click along with the country derived from the Cloudflare IP country header (a two-letter country code only — no IP address, city, or precise location is stored).
3.10 Community Spam Reports (Discontinued)
Earlier versions of Callro included an optional, off-by-default Community Verdict feature that transmitted hashes of spam caller numbers to our servers. This feature has been discontinued and removed from the App. No community spam hashes are collected from current versions. Raw phone numbers were never transmitted under any circumstances. If you previously opted in, any historical hashes remain subject to your deletion rights under Section 9.
3.11 Push Notification Token
Your Firebase Cloud Messaging (FCM) device token is transmitted to and stored on our secure servers to deliver push notifications including daily summaries of blocked calls, trial status updates, subscription reminders, and referral reward confirmations. The FCM token is a device-level identifier assigned by Google and is not linked to your personal identity. It is updated automatically when your device rotates tokens.
3.12 App Usage Analytics
Callro collects device-level behavioral analytics linked to your device identifier hash to improve the subscription experience and measure app effectiveness. These include paywall interaction events (paywall viewed, subscribe tapped, subscribe succeeded, subscribe failed, remind later tapped) and onboarding and activation milestone events (app first open, screening role granted, screening role denied, first call screened). All analytics are linked only to your device identifier hash — never to your name, email, or phone number. No analytics data is sold or shared with third parties for advertising purposes.
3.13 Crash and Performance Diagnostics
If the app crashes, diagnostic data is automatically transmitted to Firebase Crashlytics (Google LLC). Firebase Performance Monitoring receives app performance data, such as app start time and how long the app's network requests take. Callro does not intentionally send call data or contact information to these services. Crash reports can include technical details such as your device model, Android version and the app's own error messages, and the services use an identifier that Firebase generates for your app installation.
3.14 Meta (Facebook) App Events
Callro uses the Meta SDK to measure whether ads led to installs, trials and subscriptions. The SDK can collect your device's advertising ID and receives app events such as app activation, trial start and subscription. You can reset or delete your advertising ID in your Android settings. Meta does not receive your phone number, contacts, call data, or any call screening information. You can limit Meta's data collection via your device's advertising settings (Settings → Privacy → Ads on Android). For more information, see Meta's Data Policy at facebook.com/privacy/policy.
3.15 Website Analytics (Google Analytics 4)
On getcallro.com, we use Google Analytics 4 (Google LLC) to measure aggregate website usage, page views, referrer sources, and outbound Google Play Store clicks. It collects page views, on-site interactions, approximate region derived from IP, device or browser identifiers, and referrer URLs, and it does not receive call data, contacts, or screening records. Google Analytics 4 is loaded only for visitors identified as located in the Americas (based on the time zone their browser reports), and only when the browser is not sending a Global Privacy Control signal. It is completely suppressed on our privacy policy, terms and conditions, do not call policy, contact, data deletion, refund policy, and subscription management pages, and on the checkout pages (/pay/ and /app/checkout-return/). Our website does not load the Meta Pixel.
3.16 Website Contact Form
If you submit the contact form at getcallro.com/contact/, we collect the name, email address, phone number, subject category, and message you provide. This information is transmitted to Google Apps Script (Google LLC), recorded in a private internal spreadsheet, and emailed to our support address so that we can respond to you. It is used only to respond to your inquiry. It is not used for marketing or advertising and is not sold or shared with third parties. You can request deletion at any time by emailing support@getcallro.com.
3.17 Blocked Call Telemetry
When Callro blocks or silences a call, a record of that screening decision is transmitted to our servers (Supabase Inc.) to diagnose screening accuracy and improve spam detection. This record includes your device identifier hash (device_id_hash), the decision taken (action: BLOCK or SILENCE), event timestamp (blocked_at), the final four digits of the number, with the other digits replaced by asterisks (for example, ******1234), the triggering filter rule (filter_source), reputation score (reputation_score), explanation reason (reason), score breakdown (breakdown), and device manufacturer (manufacturer). Blocked and silenced call records contain only the final four digits of the number. These records are linked only to your device identifier hash, are automatically deleted after 90 days by an automated daily purge job, and are deleted within 30 days of a verified request.
3.18 Payments
Paddle.com is the Merchant of Record for purchases on getcallro.com and collects your payment details; Callro does not receive card numbers. Callro stores a Paddle customer id, a Paddle subscription id and, where Google reporting applies, the Google transaction identifier against your device record, and uses the transaction status, amount, tax and country code that Paddle sends.
Callro attaches a signed token containing a hashed device identifier to the Paddle transaction so the payment can be matched to your app installation.
Paddle's handling of your payment data is described in Paddle's privacy notice: https://www.paddle.com/legal/privacy
4. How We Use Your Information
| Data | Purpose | Legal Basis |
|---|---|---|
| Call metadata | Screen incoming calls | App functionality |
| Phone number (encrypted) | Area code detection, follow-up support call | Consent (you opt in) |
| Area code | Neighbor-spoof detection, medical facility lookup | App functionality |
| Device identifier hash | Trial management, subscription tracking, referral attribution | App functionality |
| Purchase token | Subscription state sync, referral reward billing deferral | App functionality |
| FCM token | Push notifications (summaries, reminders, rewards) | App functionality |
| Referral data | Referral attribution, reward tracking, fraud prevention | App functionality |
| Paywall analytics | Improve subscription experience | Legitimate interest |
| Crash diagnostics | Fix bugs and improve stability | Legitimate interest |
| Performance metrics | Optimize app speed | Legitimate interest |
| Support chat messages | Respond via Claude AI | Consent (you initiate) |
| Blocked call telemetry (server) | Screening accuracy diagnostics | Legitimate interest |
| Community hashes (historical) | Spam model analysis (feature discontinued) | Legitimate interest |
| Meta app events | Measure advertising effectiveness | Legitimate interest |
| Referral click country | Fraud prevention, regional analytics | Legitimate interest |
We do not use any data for personalized advertising within the App, behavioral profiling for third parties, or sale of personal information to data brokers.
5. Third-Party Services
| Service | Provider | Data Received | Purpose |
|---|---|---|---|
| Firebase Crashlytics | Google LLC | Crash diagnostics | Stability monitoring |
| Firebase Performance | Google LLC | Performance metrics | Speed optimization |
| Firebase Cloud Messaging | Google LLC | FCM device token | Push notifications |
| Firebase Remote Config | Google LLC | No user data | App configuration |
| Claude AI | Anthropic, PBC | Support chat messages | AI support responses |
| Paddle | Paddle.com | Payment and transaction details, device hash token | Merchant of Record and payment processing for purchases on getcallro.com (see section 3.18). |
| Supabase | Supabase Inc. | Device hash, encrypted phone, trial data, referral data, FCM token, support messages, analytics | Backend infrastructure |
| Google Play Integrity | Google LLC | A one-time code issued by our server | Trial fraud prevention |
| Google Play Billing | Google LLC | Purchase tokens; a one-way hash of your device identifier, supplied as the purchase's account identifier | Subscription management; linking a purchase to your subscription record |
| Meta SDK | Meta Platforms, Inc. | App events, device advertising ID | Advertising measurement |
| Google Analytics 4 | Google LLC | Page views, clicks, referrer, approximate region derived from IP, device and browser type | Website usage measurement |
| Google Apps Script | Google LLC | Contact form name, email, phone number, subject, message | Processing and routing support inquiries |
Prior to app version 1.13.0 (June 2026), Callro transmitted the incoming caller's number to a third-party caller-ID lookup service. That lookup was removed in version 1.13.0 and no longer occurs in any current version.
6. Permissions Requested by Callro
ROLE_CALL_SCREENING: Required to receive incoming call information from Android and make screening decisions. Does not grant access to contacts, call logs, microphone, or location data.
POST_NOTIFICATIONS: Required to display alerts about screened or blocked calls and subscription status updates.
RECEIVE_BOOT_COMPLETED: Required to automatically restart call screening protection after the device reboots.
INTERNET: Required to download spam database updates, sync medical facility prefixes, deliver push notifications, and enable the optional AI support chat feature.
FOREGROUND_SERVICE: Required to maintain continuous call screening when the App is not in the foreground.
FOREGROUND_SERVICE_SPECIAL_USE: Required on Android 14+ to maintain uninterrupted call screening execution in the background.
WAKE_LOCK: Required to ensure the device processor stays awake briefly to complete call screening decisions.
com.android.vending.BILLING: Required for Google Play subscription processing, billing management, and transaction status verification.
com.google.android.gms.permission.AD_ID: Advertising identifier used by Google Play services and Firebase for install attribution and marketing campaign measurement.
REQUEST_IGNORE_BATTERY_OPTIMIZATIONS: Prevents the operating system from terminating call screening.
7. Data Retention
| Data | Retention |
|---|---|
| On-device Shield Log | Shield Log entries older than 30 days are deleted automatically (the cleanup runs about weekly while your phone is charging and idle). |
| Calls blocked records (server) | 90 days, automatically purged daily |
| Shield feedback records (server) | 180 days, automatically purged daily |
| Encrypted phone number (server) | Retained until you request deletion |
| Area code (on-device) | Until you delete the app's data or uninstall. |
| Crash diagnostics | 90 days (Firebase default) |
| Performance metrics | 90 days (Firebase default) |
| Support chat messages | Retained until you request deletion |
| Device identifier hash | Retained until you request deletion |
| Trial management record | Retained until you request deletion (our servers) |
| Purchase token | Duration of subscription or until you request deletion |
| Paddle customer id and Paddle subscription id | Duration of subscription or until you request deletion. Paddle keeps its own transaction records as Merchant of Record. |
| FCM token | Until token rotation or you request deletion |
| Referral records | Duration of subscription or until you request deletion |
| Referral click data | Retained until you request deletion or manual database maintenance |
| Paywall analytics | Retained until you request deletion |
| Community spam reports | Retained until you request deletion or manual database maintenance |
| Meta app events | Per Meta's data retention policy |
| Website contact form submissions | Retained in private internal records until you request deletion |
| Google Analytics 4 (website) | 14 months (event and user data) |
8. Data Security
We implement commercially reasonable security measures including:
- TLS 1.2 or TLS 1.3 encryption for data transmitted between your device and our servers
- Encrypted on-device storage using Android Keystore for sensitive local data, including stored preferences, encryption salt, and caller phone numbers in the Shield Log
- Server-side write controls — most server-side writes are routed through authenticated Edge Functions using service-role credentials; some screening decision telemetry is written directly from the App using a publishable API key
- Function isolation for sensitive operations — sensitive actions (including phone number encryption, trial claims, support chat, and account deletion) are processed through isolated Edge Functions rather than direct database writes
- Pseudonymous identifiers — a one-way hash replaces the raw Android device identifier
- SHA-256 one-way hashing for device identification
- Google Play Integrity API validation for trial claims — prevents emulator and rooted device abuse
9. Your Privacy Rights
9.1 All Users
- Request deletion of all server-side data by emailing support@getcallro.com or visiting getcallro.com/delete-data
- Request deletion of support chat history by emailing support@getcallro.com
- Uninstall the App to immediately remove all on-device data
- Revoke follow-up call consent at any time by emailing support@getcallro.com
9.2 Do Not Sell or Share My Personal Information
Callro does not sell, rent, or trade your personal information. As described in Section 3.14, the Callro Android app transmits a device advertising identifier and app event data to Meta Platforms, Inc. for advertising measurement. Depending on your state of residence, this may qualify as "sharing" for cross-context behavioral advertising. To opt out, email support@getcallro.com with the subject "Do Not Share My Personal Information," limit your device advertising identifier in Android Settings → Privacy → Ads.
9.3 California Residents (CCPA/CPRA)
You have the right to know what personal information we collect, request deletion, correct inaccurate data, opt-out of sale (we do not sell), and non-discrimination for exercising your rights. Contact support@getcallro.com with subject "CCPA Privacy Request." We respond within 45 days.
9.4 Virginia Residents (CDPA)
You have the right to access, correct, delete, and obtain a copy of your personal data. Contact support@getcallro.com with subject "CDPA Privacy Request." If we decline your request, you may appeal by replying to our response or emailing support@getcallro.com with the subject "Privacy Request Appeal." We will respond to your appeal within 60 days. If your appeal is denied, you may submit a complaint to the Virginia Attorney General at oag.state.va.us/consumer-protection.
9.5 Residents of Other U.S. States
Residents of Colorado, Connecticut, Texas, Oregon, Montana, Utah, and other states with comprehensive consumer privacy laws have similar rights of access, correction, deletion, and portability. We extend the rights described in Sections 9.3 and 9.4 to all United States residents regardless of state of residence. Contact support@getcallro.com with the subject "Privacy Request."
9.6 Visitors from the EU, EEA and United Kingdom
Callro is offered only in the United States and is not marketed to or intended for users in the European Union, European Economic Area, or United Kingdom. Google Analytics is loaded only for visitors our website identifies as located in the Americas (based on the time zone their browser reports); all other visitors are excluded. If you are located in the EU, EEA, or UK and believe we hold personal data about you, contact support@getcallro.com and we will delete it.
10. Children's Privacy
Callro is not directed at children under 13. We do not knowingly collect personal information from minors. If you believe a child under 13 has provided information through the App, contact us at support@getcallro.com and we will delete it promptly.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through a notice within the App and on our website. Material changes will not take effect until 14 days after notification. We review and update this policy at least once every 12 months in compliance with CCPA requirements.
12. Contact Us
Vindication Inc.
7901 4th St N Ste 300, St. Petersburg, FL 33702
support@getcallro.com
+1 (727) 354-3133
getcallro.com
This Privacy Policy is governed by the laws of the State of Florida, United States.
For a granular, technical breakdown of all data flows, on-device processing, and third-party interactions, view our Data Flow & Privacy Architecture Matrix.