← Back to Privacy Policy
Transparency Matrix
Data Flow & Privacy Architecture
Callro is architected around strict data minimization. Every decision to block or allow an incoming call executes locally on your device using Android's native screening APIs. Read how this works in our guide to what is on-device call screening, or review our independent comparison in the spam call blocker privacy audit. Below is our comprehensive data flow matrix.
Umer Mustafa
Founder & Architect
| Data Category | Form | Destination | Purpose | Retention | Requirement | How to Delete |
|---|---|---|---|---|---|---|
| Incoming Call Metadata (§3.1) | on-device | Processed on device (Android CallScreeningService API) | Incoming call information provided by Android CallScreeningService API for screening analysis on device. Callro does not look up caller names from an online directory. If your carrier sends a caller-ID name with a call, Callro may use it as one of its signals. | Stored encrypted in your Shield Log on your device (§3.1) | Required | — |
| Your Phone Number (§3.2) | encrypted | Callro Servers (Supabase Inc.) | Stored on our servers (Supabase Inc.) in encrypted form. Authorized Vindication Inc. personnel can decrypt it through an access-controlled, logged process. Used to extract your area code for neighbor-spoof detection and, with your consent, for a call from a Callro team member during your first week. | Retained until you request deletion (§7) | Optional | Email support@getcallro.com (§3.2, §7) |
| Area Code (§3.3) | Plain 3-digit code | Stored on your phone; sent to Callro's servers to look up local medical-facility phone prefixes | Your three-digit area code is sent to our servers to retrieve local medical-facility phone prefixes. The request does not include your phone number or a device identifier. | On your phone until you delete the app's data or uninstall. The lookup does not save it. | Optional | Email support@getcallro.com (§7) |
| Shield Log (Local Call History) (§3.4) | on-device | Stored on device (local storage) | Call screening decisions (ALLOW, SILENCE, BLOCK) and associated risk scores stored locally on your device. | Shield Log entries older than 30 days are deleted automatically (the cleanup runs about weekly while your phone is charging and idle). | Optional | — |
| Support Chat (§3.5) | raw | Callro Servers (Supabase Inc.) & Anthropic, PBC (Claude AI) | Message text, session identifier, pseudonymous device identifier hash where available, and page viewed to generate AI support responses via Shield and maintain conversation continuity. | Retained until you request deletion (§7) | Optional | Email support@getcallro.com to request deletion (§3.5, §7) |
| Device Identifier Hash (§3.6) | hashed | Callro Servers (Supabase Inc.) | Your Android device identifier is converted on your phone into a one-way hash. Only the hash is sent to our servers. It is used for trial management, subscription state, install attribution, referral and promo-code validation, push-notification delivery and aggregate product analytics. The hash is a persistent device identifier. | Retained until you request deletion (§7) | Required | Email support@getcallro.com (§7) |
| Trial Management (§3.7) | hashed | Callro Servers (Supabase Inc.) | Device identifier hash transmitted to prevent unlimited free trial abuse and record whether device previously redeemed a free trial without requiring payment method. | Retained until you request deletion (§7) | Required | Email support@getcallro.com (§7) |
| Subscription & Purchase Data (§3.8) | raw | Callro Servers (Supabase Inc.) & Google Play Billing | Google Play purchase token, subscription status (active, expired, cancelled), and start date to manage subscription status, process referral rewards, and sync billing. Payment card details never received or stored. | Duration of subscription or until you request deletion (§7) | Required | Cancel your subscription, then email support@getcallro.com to request deletion (§7) |
| Referral Program Data (§3.9) | hashed | Callro Servers (Supabase Inc.) | Unique referral code linked to device identifier hash, attribution records, reward statuses, purchase tokens for deferrals, and Cloudflare IP two-letter country code (no IP address or precise location). | Duration of subscription or until you request deletion; click data until deletion or manual maintenance (§7) | Optional | Email support@getcallro.com (§7) |
| Community Spam Reports (Discontinued) (§3.10) | hashed | Callro Servers (historical only) | Discontinued and removed from App. Earlier versions transmitted optional hashes of spam numbers. No hashes collected from current versions. | Retained until you request deletion or manual database maintenance (§7) | Optional | Email support@getcallro.com to request deletion under Section 9 (§3.10, §7) |
| Shield Log Feedback (§3.4) | Hashed number | Callro Servers | When you tap a feedback button on a Shield Log entry (for example 'not spam' or 'was spam'), the app sends a hashed device identifier, a one-way SHA-256 hash of the caller's number, your choice, and Callro's score. | Kept 180 days; removed on a deletion request. | Optional | Email support@getcallro.com (§7) |
| Push Notification Token (§3.11) | raw | Callro Servers (Supabase Inc.) & Firebase Cloud Messaging (Google LLC) | Firebase Cloud Messaging (FCM) token to deliver push notifications (daily blocked call summaries, trial status, subscription reminders, referral reward confirmations). | Until token rotation or you request deletion (§7) | Optional | Disable push notifications in Android Settings or email support@getcallro.com (§7) |
| App Usage Analytics (§3.12) | pseudonymized | Callro Servers (Supabase Inc.) | Paywall interaction events and onboarding/activation milestones linked only to pseudonymous device identifier hash — never to name, email, or phone. Never sold or shared for advertising. | Retained until you request deletion (§7) | Required | Email support@getcallro.com (§7) |
| Crash & Performance Diagnostics (§3.13) | pseudonymized | Firebase Crashlytics & Firebase Performance Monitoring (Google LLC) | Diagnostic stack traces and performance metrics to monitor app stability and speed. Callro does not intentionally send call data or contact information to these services. Crash reports can include technical details such as your device model, Android version and the app's own error messages, and the services use an identifier that Firebase generates for your app installation. | 90 days (Firebase default) (§7) | Required | Automatically purged after 90 days by Firebase; or uninstall app (§7) |
| Meta App Events (§3.14) | pseudonymized | Meta Platforms, Inc. | Device-level advertising identifier and event data (app install, trial activation, subscription purchase, app open) to measure ad campaigns. No phone number, contacts, or call data. | Per Meta data retention policy (§7) | Required | Android Settings → Privacy → Ads or request via Meta Data Policy (§3.14) |
| Website Analytics & Tracking (§3.15) | pseudonymized | Google Analytics 4 (Google LLC) | Page views, interactions, approximate region from IP, device/browser identifiers, referrer URLs on getcallro.com. Suppressed on legal/contact pages and outside the Americas. | 14 months for GA4 (§7) | Optional | Clear browser cookies, configure browser privacy settings, or email support@getcallro.com (§7) |
| Website Contact Form (§3.16) | raw | Google Apps Script (Google LLC) / internal spreadsheet & support email | Name, email address, phone number, subject category, and message submitted at getcallro.com/contact/ to respond to inquiries. Not used for marketing or advertising. | Retained in private internal records until you request deletion (§7) | Optional | Email support@getcallro.com to request deletion (§3.16, §7) |
| Blocked Call Telemetry (calls_blocked) (§3.17) | last four digits | Callro Servers (Supabase Inc.) | Sent when Callro blocks or silences a call, and only then. The record contains the final four digits of the number (the other digits replaced by asterisks), the action (blocked or silenced), the reason, a score, the signal breakdown, the filter name, a hashed device identifier, your phone's manufacturer and a timestamp. Used to diagnose screening accuracy. Allowed calls are not recorded. | Deleted automatically after 90 days | Required | Email support@getcallro.com |
| Contacts & Address Book (§2) | — | Not requested | Callro does not request access to your contacts. | Not applicable: Callro does not request access to your contacts | Optional | Controlled entirely by device settings; uninstalled with app |
| Call Audio & Recordings (§2) | — | Not requested | Callro never answers calls. | Never collected or retained | Optional | N/A — zero collection |
Zero Address Book Reads
Unlike legacy caller ID apps that crowd-source directory listings by uploading user contact books, Callro never requests access to your contacts. Your personal address book stays private on your phone.
Hashed Trial ID Validation
Trial validation uses a hashed trial ID stored in Supabase. Raw personal identifiers and persistent account records are never maintained.