The whole product depends on knowing that a call happened and nothing else. This page lists exactly what we hold, for how long, and who can see it.
| Data | Why | Kept |
|---|---|---|
| Your phone number | To place your leg of the call and to confirm it is not a virtual number | Until you delete your account |
| Relative's phone number | To send the consent text and place their leg | Until consent is withdrawn, then 30 days |
| Consent record | To prove the relative agreed | Duration of consent plus 2 years, for disputes |
| Call summary | Start, end, connected time, live-audio ratio, confirmation result | 90 days |
| Device integrity result | Pass or fail from the platform attestation service | Per call, 90 days |
| Wallet addresses | To pay out | Until account deletion |
Call summaries are deleted after 90 days. That window exists so a disputed payout can be reviewed. Consent records are kept two years past withdrawal because they are the evidence that the calls were welcome. Everything else goes when you delete your account.
Two wallet addresses, a stock ticker, a fragment amount, and an opaque call ID. The chain never sees a phone number, a name, or a time of day beyond the block timestamp. A determined person who knows your wallet could see that you receive fragments of Coca-Cola on a schedule. They could not learn who you are calling.
| Party | Sees |
|---|---|
| Telephony provider | Both numbers, call duration. Standard for any call. Bound by their own terms. |
| Attestation service (Apple, Google) | A device token. Not your number, not your calls. |
| Sponsors | An on-chain event. No personal data. |
| Your relative | That you called. They were there. |
| Anyone reading the chain | Wallets, stock, fragment, call ID. |
Export everything we hold about you, delete your account, or ask a question, from the settings screen or the support address at the project domain. Deletion removes your numbers, summaries, and mapping within 30 days. It cannot remove on-chain transactions, because nobody can.