Privacy Policy

01Our core principle: your call data stays on your phone

CallVault is built as a replacement for your phone's default dialer app, which means it needs access to call-related data to function. Your call log, contacts, blocklists, call flow rules, and Esports Mode session history are stored locally on your device in CallVault's own database. None of it is uploaded to our servers, shared with third parties, or used for advertising. The only information that leaves your device is your subscription status, basic app diagnostics, and advertising data, described in Sections 5, 7, and 8.

02Every permission CallVault requests, and exactly why

Android requires apps to declare every sensitive capability they use. Below is the complete list of permissions CallVault requests, grouped by what they're for, with the specific in-app feature each one powers.

Making and managing calls

Call history

Contacts

SMS

Notifications and on-screen display

Keeping call handling reliable in the background

Audio and haptics

Network

03Data inventory, in one table

Every category of personal data CallVault touches, where it's collected, why, how long it's kept, where it's stored, and who else (if anyone) receives it. This is a literal inventory of what's already described throughout this policy — nothing here is a new disclosure.

Call log, contacts, block list, rules, Esports sessions

Anonymous account ID

Subscription / purchase status

Consent history

Inactive-account deletion: account/subscription data and consent history are both automatically deleted after 12 months with no relevant activity — a subscription that lapsed and was never renewed, or a consent setting nobody's touched since. This runs regardless of whether you ever use "Delete My Data" yourself.

Crash diagnostics opt-in, adults only

Usage analytics opt-in, adults only

Advertising ID opt-in, adults only

04Auto-delete and the data you control

Auto Delete lets you configure automatic, permanent deletion of call log entries on a schedule you choose, processed entirely on your device. You can also manually clear your call history, blocklist, and Esports session history at any time from the app's settings. Uninstalling CallVault removes all locally stored app data from your device, per standard Android behavior.

05Information used for your subscription

CallVault offers optional premium features through a subscription processed via Google Play's billing system. To keep your premium status accurate and tamper-resistant, we use Firebase (a Google service) for exactly this purpose:

• Firebase Authentication — creates an anonymous account identifier for your installation so your subscription can be associated with your device.
• Cloud Firestore — stores your subscription status: which plan you're on, whether it's currently active, which features it unlocks, when it expires, and a purchase reference token issued by Google Play (used to re-verify your subscription — this token is not your card or UPI details).
• Firebase Functions — runs on our servers to verify, directly with Google's Play Developer API, that a purchase is genuine before activating premium features, and automatically re-checks every active subscription roughly every 12 hours so cancellations and refunds are reflected promptly.

We do not transmit your call log, contacts, SMS content, or any call metadata to Firebase or any other server. The data sent to Firebase for subscription purposes is limited to the information above. Payment details (card numbers, UPI IDs, etc.) are handled entirely by Google Play Billing — Codinja Nexus Private Limited never sees or stores your payment information.

06What we don't do

• We do not sell your data to anyone, under any circumstances.
• We do not use your call log, contacts, or SMS data for advertising or analytics.
• We do not share your call log, contacts, or SMS data with third parties.
• We do not use crash or usage analytics data for advertising — that data stays entirely separate from the ads described in Section 8. CallVault does use the Android Advertising ID for showing ads via Google AdMob (see Section 8). Neither analytics nor advertising data is ever combined with your call log, contacts, or SMS content — see Section 7 for exactly what's collected and why.

07Analytics, crash reporting & service providers

We rely on a small number of infrastructure providers to operate CallVault, keep it stable, and understand how it's used. They process data only as needed to provide their service to us, under their own privacy and security commitments, and are not independent third parties we share your data with for their own purposes:

• Firebase Crashlytics — for crash and diagnostic reporting. When CallVault crashes, this collects your device model, OS version, app version, the crash stack trace, and internal diagnostic flags describing which feature was active at the time (for example, whether Esports Mode or a Call Flow Rule was on). It does not collect the content of your calls, contacts, or messages.
• Google Analytics for Firebase — for usage analytics, so we can see how the app is used and where it can be improved. This automatically collects app opens, session length, which screens you visit and how you move between them, device model, OS version, language/region, and an approximate location derived from your IP address (not precise GPS). It does not collect the content of your calls, contacts, or messages, and is not used for advertising.
• Google Firebase (Authentication, Firestore, Functions) — for subscription/entitlement management, as described in Section 5.
• Google Play Billing — for processing subscription payments. See Google's Privacy Policy.

Crashlytics and Analytics both use a per-install identifier to group this data by device. This identifier is not linked to your name, email, or any other personal identifier we collect — we don't collect a name or email from you anywhere in the app. See Firebase's privacy and security documentation for how Google handles this data on our behalf.

Cross-border transfer: our own backend logic (Cloud Functions) runs in India (asia-south1), but Google's infrastructure for Firebase, Analytics, Crashlytics, AdMob, and Play Billing operates globally and may process or store data outside India, including in the United States, as part of providing these services to us. Under the Digital Personal Data Protection Act, 2023, cross-border transfer is permitted to any country except one the Indian government specifically restricts by notification — as of this policy's last-updated date, no countries are restricted.

08Advertising

CallVault shows ads — small banner ads on certain premium feature screens, and optional rewarded video ads — to support the app's development and offer more ways to access premium features.

Ads are served through Google AdMob. AdMob may use the Android Advertising ID and other device information to show ads relevant to you and measure how they perform. You can reset or opt out of ad personalization at any time in your device's Google Settings ▸ Ads. See Google's Ads Policy for how Google itself handles this data.

Watching a rewarded ad is entirely optional and unlocks the corresponding premium feature for 4 hours. Skipping or closing an ad never affects your access to any feature you already own or have purchased. Ads never have access to your call log, contacts, SMS content, or any other data described in Section 2.

09Default phone app status and why CallVault asks first

In line with Google Play policy, CallVault prompts you to set it as your device's default Phone app before requesting Call Log permissions, and only uses its SMS-sending capability while registered as your default Phone app for the features described in Section 2. If you remove CallVault as your default Phone app, it stops using these permissions for any new activity.

10Children's privacy

CallVault is not directed at children — under the Digital Personal Data Protection Act, 2023, that means anyone under 18 in India, or the relevant minimum age (typically 13) under the law of your own country — and we do not knowingly collect personal information from a child or process a child's data for advertising or behavioral tracking. If you believe a child has used CallVault or provided us with personal information, please contact us using the details in Section 15 and we will take appropriate action, including deleting any data involved.

11Data retention

Call log, contacts, blocklist, rules, and session data remain on your device until you delete them (manually or via Auto Delete) or uninstall the app. Subscription/entitlement data in Firebase is retained for as long as your account is active and for a reasonable period afterward to handle billing disputes, restores, and legal/tax requirements, after which it is deleted or anonymized. Crash and usage analytics data is retained by Google Firebase per its standard retention periods before automatic deletion or anonymization — see Firebase's own documentation linked in Section 7 for current specifics. Advertising data collected by Google AdMob is retained per Google's own policies — see Google's Ads Policy linked in Section 8.

12Your choices and rights

• You can review and revoke any Android permission for CallVault at any time via your device's Settings → Apps → CallVault → Permissions.
• You can delete locally stored data (call log, contacts cache, rules, sessions) from within the app, or by uninstalling CallVault.
• You can permanently delete your subscription/account data held with us at any time using "Delete My Data" in the app's Settings → About screen, or by contacting us at the email below. See our Data Deletion Request page for full step-by-step instructions. This does not cancel an active Google Play subscription, which is managed through Google Play directly.
• You can withdraw ad-personalization consent at any time, as easily as you gave it, using Settings → About → "Ads & Personalization" inside the app, or via your device's Google Settings ▸ Ads. Withdrawing consent doesn't affect the lawfulness of anything already done based on it.
• You can withdraw crash and usage analytics consent at any time using Settings → About → "Analytics" inside the app — this stops analytics collection immediately.
• If you are in the European Economic Area, UK, or a jurisdiction with similar data protection laws, you may have additional rights (access, correction, portability, objection) under applicable law — contact us to exercise them.

If you are in India — your rights under the DPDP Act, 2023

Your data is handled in line with the Digital Personal Data Protection Act, 2023, to the extent applicable to the limited account/subscription and diagnostic data described above. As a Data Principal under the Act, you specifically have the right to:

• Access a summary of the personal data we hold about you and how it's been processed — available anytime in the app under Settings → About → "Your Data."
• Correction and erasure of your personal data — see "Delete My Data" above for the fastest path.
• Grievance redressal — raise a complaint with our designated Grievance Officer (contact details in Section 15). We aim to resolve grievances within 90 days, in line with the DPDP Rules, 2025.
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by contacting us with the nominee's details.
• Escalate to the Data Protection Board of India if you're not satisfied with how we've handled your grievance, once the Board's complaint mechanism is operational.

13Security

We use industry-standard measures to protect the limited data CallVault does transmit, including encrypted connections (HTTPS/TLS) to Firebase and Google Play services, and application-level safeguards against tampering with subscription/purchase verification. No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable means.

14Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect new features or changes in legal requirements. We will update the "Last updated" date at the top of this page when we do, and material changes will be highlighted in the app's update notes where appropriate.

15Contact us

If you have questions about this Privacy Policy, how CallVault handles your data, or want to raise a grievance, contact us at:

We aim to acknowledge and resolve grievances within 90 days, in line with the Digital Personal Data Protection Rules, 2025.