Privacy, explained by feature.

Overview

Caller One provides caller identification, call screening, a dialer, fraud and spam context, profiles, local service discovery, and an on-device document viewer. This policy describes what data is processed, why it is used, and the choices available to you.

Data we process

Phone and caller identifiers

Incoming or manually searched numbers may be sent over encrypted transport to return caller-name and risk information. We may process community name contributions, fraud reports, business attributes, confidence signals, abuse-prevention metadata, and de-identified aggregates.

Account and profile information

When provided, we process your name, username, profile description, city, work details, education level or field, industry, role, email address, social profile links, visibility choices, business or service listing, and account security/session information. A service provider enters a listing-specific public contact number and explicitly confirms that customers may see it and use it to call or message the service. The service contact is encrypted at rest and is not treated as an OTP-verified personal-profile identity. A new listing is not published until this contact is enabled. The provider can replace or hide it from the listing editor; when it is unavailable, the detail page says that contact has not been added. The full number is returned only when a customer opens that provider's detail page, not in bulk search results. Self-declared structured categories support profiles, search, and aggregate product analytics. Any future advertising-profile use requires a separate choice that is off by default. Third-party phonebook classifications remain attributed candidate evidence, are not self-declared facts, and are never eligible for advertising profiles. Caller One does not build advertising categories from health conditions, religion, caste, politics, sexuality, or financial hardship.

Approximate service location

Foreground location may be processed for nearby service search or a provider service radius. Results return an approximate distance bucket or selected city. Exact coordinates are not shown to customers or profile owners.

Contacts and caller-name sync

Caller One retains Android Contacts access for local contact search, saved-name matching, and caller-name contribution. Granting that Android permission enables an initial snapshot of saved names and phone numbers over encrypted transport, followed by automatic sync of contact additions, edits, and deletions in the background while Android Contacts access remains granted. Sync remains blocked until the current Terms and Privacy notice have been accepted. The server attributes each observation to its account and device source, deduplicates repeated snapshots, and uses confidence-scored evidence to calculate candidate caller names. Contact data is not used for advertising, sold, or exposed to other users as an address-book list.

Android permissions and roles

• Caller screening/default dialer: used to identify, display, manage, and screen calls when you grant the relevant Android role.
• Call log: used after prominent disclosure to show recent calls. Call time, direction, duration, SIM label, and private contact name remain on-device.
• Contacts: used for your contact list and “My contacts” visibility and, when Android access is granted, initial and automatic incremental caller-name sync.
• Foreground location: used for nearby services. City search remains available when denied.
• Display over other apps: used for the floating caller card.
• Notifications: used for call-related status and reminders that you enable.

Caller One does not read your SMS inbox, collect background location, silently monitor the clipboard, or use Accessibility Service scraping.

Sharing and sale

Caller One does not sell personal data. Data may be processed by infrastructure, security, delivery, payment, advertising, consent-management, or verification providers acting for Caller One under appropriate safeguards. Google Mobile Ads may process IP-derived general location, advertising or device/account identifiers, app interactions, diagnostics, and consent choices to provide, measure, secure, and—where you consent—personalize ads. Ad privacy choices are available in Caller One settings whenever required. We may disclose information when legally required or to protect people, the service, and the public from abuse.

Security and retention

Data is encrypted in transit. Access controls, audit logs, rate limits, pseudonymous identifiers, and encrypted backups are used where applicable. Retention depends on the feature, security requirement, dispute period, and legal obligation.

Ordinary account deletion removes account-linked personal data, active sessions, public profiles, listings, raw contact contributions, raw reports, caller-name votes, and advertising profiles. Independent evidence submitted by other users remains theirs and is recalculated without the deleted account's evidence. Non-account-linked aggregate statistics may remain only when they cannot be used to identify or relink the deleted user.

A restricted pseudonymous security case may be retained only for documented account compromise, unsafe-device abuse, sustained contribution abuse, or sustained reporting abuse. A review is due after 90 days, it permanently expires after 180 days, it cannot influence public caller identity or risk, and it cannot be used for advertising or personalization. Financial, dispute, or legal records may be retained separately only when law requires it.

Your choices and deletion

You can deny optional permissions, keep optional profile fields private, correct profile information, hide a previously published provider phone number, appeal identity information, or request account deletion. Revoking Android Contacts access stops future contact reads; when Caller One detects the revocation, it withdraws that device's active contact evidence from caller-name calculation. There is no separate contact-contribution toggle in Caller One settings. Turning off Show contact number revokes public-number access after the server confirms the change; the app keeps an unresolved state visible and offers retry if confirmation fails. In app settings, Deactivate account reversibly hides the personal public profile, Digital ID, and professional discovery listings while preserving the account and stored source data for later reactivation. Request data deletion records a full-deletion request without an immediate destructive tap. Caller One verifies account ownership, then executes every valid request promptly; review is not used to retain eligible data indefinitely. The same request path is available on the account deletion page.

Age eligibility

Caller One is intended for people aged 18 or older. The app asks for an age-range confirmation and current Terms/Privacy acceptance before account or user-generated-content participation; the age-range answer remains on the device.

Policy changes

Material changes will be reflected by the effective date and, when appropriate, an in-app notice.