In short
- You sign up with a line number and a password. We do not ask for your email, your real name, your location or your phone's contacts.
- Calls are not recorded. They are encrypted in transit, and relays only forward encrypted packets.
- Chat messages, call history and voice or video messages are stored on our server so that they appear on any device you sign in on. They are not end-to-end encrypted.
- There are no ads, no advertising IDs and no analytics or tracking tools. We do not sell or rent your data.
- You can delete your line, with its data, at any time from the app or the web.
Who we are
Callixy is a calling service made of the Callixy apps for Android and iPhone, the web app at voip.3dar4.org with its backup server lifeline.3dar4.org, and this website. "Callixy", "we" and "us" mean the team that develops and runs the service and decides how its data is used. You can reach us as described under Contact.
What we collect and why
Your account
Your Callixy line number, which is also your username: a number you choose when you join. It can be your own phone number or any other number; Callixy does not check it, does not treat it as a phone number and never calls or messages it outside Callixy (lines created in October 2026 before this change were given a number by Callixy). Also the display name you choose, your password stored only as a one-way bcrypt hash, a one-way hash of your recovery code (the code itself is shown to you once and kept in your Safe box), the links to choose a new password that you or an administrator asked for (as one-way hashes, with when they were made, by whom, from which network address, and when they were used), the date you signed up, the invite code your line was created with and the invite codes given to your line (which code was used by which line, when, and from which network address), and a counter of failed sign-ins that can lock the account for 15 minutes. We use these to create your line, sign you in, protect it, let you choose a new password, and keep the invitation chain honest. No email address or real name is asked for.
Safe box (optional)
Notes you write in your Safe box in Chat are stored on our server encrypted (AES-256-GCM, with a key kept on the server), and only you can read them in the app. They stay until you delete them or delete your line.
Messages from Callixy Support
Callixy may write to every line, or to yours (for example the link to choose a new password you asked for on another device). These messages appear in Chat as Callixy Support; we store the text, when it was sent and when you last read them, for up to 180 days.
Profile photo (optional)
If you add a photo, the app resizes it to a smaller image and stores it on our server. You decide whether others see it (see Who can see what).
Contacts you save in Callixy
The number of a line and the name you gave it, up to 500 contacts. These names are private to you. Saving a contact also lets the two of you chat.
Call history and call records
- Your history: for each call, the other line, the time, the length, whether it was answered, missed or declined, the direction, and the data it used. You see it in History; we keep your 500 most recent entries.
- The server's call record: both lines (internal ID, number, name), the times, how the call ended and technical events of the call. We use it to run calls and to investigate faults and abuse.
Chat messages
The text of each message, who sent it to whom, when it was sent, edited and read, the call it belongs to if it was sent during one, the message it answers if it is a reply, and the reactions (one emoji per person) the two of you gave it. Messages are stored on our server so they reach the other person and appear on your devices. The sender can edit a message for 48 hours and delete it for both people at any time. When a message is edited or deleted, the text it had is kept for 30 days, shown to nobody, only so that it can go into a report the recipient makes. A reaction can be taken away at any time and goes with its message. Either of you can pin one message of the conversation; both of you see the pin, and we store which message is pinned, who pinned it and when, until it is unpinned or the message or a line is deleted. A message you forward to someone else becomes a new message from you to that person, marked "Forwarded"; the name of whoever wrote it first is not passed on. Save to Safe box copies the text of a message into your own Safe box. When you are typing, the other person is told so; this is not stored.
Voice and video messages
When a call is not answered, the caller can leave a recording, and in a chat either person can record one with the microphone or the camera. The recording appears in the chat. We store it, who sent it to whom, its length and when it was sent, and delete it after the time the Callixy administrators set (30 days unless they changed it), or sooner when the sender deletes the message. The longest recording is also their setting (two minutes unless changed). Only the two people of the chat can play it.
Photos, videos and files you send in a chat
In a chat you can send a photo, a video or any other file you choose on your device, or that you share into Callixy from another app. We store the file, its name, size and type, who sent it to whom and when. A photo is made smaller on your device before it is sent, and our server rebuilds it from the picture alone, so the location, camera details and any other metadata inside it are removed. Only the two people of the chat can open a file. A file you forward to someone else is not copied on our server: the new message points to the same stored file, which is deleted only when the last message that points to it is gone. A file is deleted with its message, when either person deletes their line, and after the time the Callixy administrators set for media (30 days unless they changed it). The administrators also set which kinds may be sent and how large they may be.
Notification addresses
To ring and to notify you when the app is closed, we store a notification address for each device you allow: on Android a Firebase Cloud Messaging registration token (app versions before 1.5.1 used a Firebase installation ID), on iPhone an Apple Push Notification service (APNs) device token for messages and a separate VoIP token for incoming calls, and in a browser a push subscription (an address and encryption keys created by your browser). We keep up to 20 per account. An address belongs to the device that registered it and is removed when that device signs out (on itself or from your list of devices), when the push service reports it dead, or when you delete your line.
Sign-in sessions
For each device you sign in on: a one-way hash of its sign-in token, when it was created, when it was last used, whether it is the Android app, iPhone app or a browser, and a short device name (for the app its model; for a browser its name and operating system, taken from what the browser sends). We do not store your IP address with it. A session does not expire by itself: it ends when you sign that device out, from the device or from the list of devices in Profile, when an administrator signs your line out, or when your password or number changes. You can be signed in on several devices at once; every one of them rings when you are called.
Call quality reports
Each app and browser automatically collects bounded technical measurements during calls, including failed calls: the route and connection states, packet loss, delay, jitter, quality steps, repairs, backup paths, bytes and packets sent and received, microphone and playback states, numerical audio energy and decoded/concealed sample counts, and the app version. Audio energy is a number, not recorded sound. Reports are associated with the call and your internal account ID so we can compare both sides and diagnose one-way audio and disconnections.
Reports contain no call audio, video, screen images, message text, IP addresses, connection credentials or raw session descriptions. Up to 96 technical samples are kept per report. Upload starts after a randomized delay while no call is active and retries after a connection failure. Up to ten pending reports may remain on your device for seven days, including checkpoints if the app stopped unexpectedly. Authorized administrators can inspect reports; server reports are retained for up to 90 days and removed when you delete your line. We use these first-party diagnostics to operate and improve calls, not for advertising.
Safety: blocks, reports and terms
The lines you block; reports you send (the reported line, the reason, the details you write and, when you report a message, a copy of that message and when it was sent; and a copy of what the reported line sent you in the 30 days before, at most 20 messages, including earlier text of messages it edited or deleted); which version of the Terms of Use you accepted and when; and, if an administrator closes a line for breaking the Terms of Use, when and why.
Messages to the Callixy team
When you write to us with the contact form, we store the topic, your message and, if you give them, the line number it is about and the address where you want an answer. You do not need a line to write. We use the message only to answer you and to look into your request. Your IP address is held in memory for one hour to limit how many messages one network can send; it is not stored with the message.
Technical logs and network data
Our server writes technical log lines (error codes, call IDs and internal user IDs, never message content). Your IP address is used while you are connected, to deliver data and to limit abuse such as repeated failed sign-ins; Callixy does not store it in its database or logs. Our hosting and network providers may keep standard connection logs of their own. When the backup server carries a call, it keeps a short record of the call (both lines, times, length and data used) until the main server has received it.
What we do not collect
- No email address, real name, date of birth or identity documents.
- No location. No access to your phone's address book, photos or files, except a photo or file you choose to send or upload, or something you choose to share into Callixy.
- No recordings of calls. The only recordings we store are voice and video messages that someone chose to leave.
- No advertising ID, third-party analytics, third-party crash-reporting service or advertising trackers. Firebase Analytics is switched off in the Android app. Our own bounded call diagnostics are described above.
How calls and data are protected
- All connections between your device and Callixy use TLS (HTTPS and secure WebSockets). The Android app refuses unencrypted connections.
- Call audio and video use WebRTC encryption (DTLS-SRTP) between the two devices. When a call goes through a relay, the relay only forwards encrypted packets.
- When audio has to travel over the Callixy server connection as a backup, it is encrypted on the device with keys the two devices agree on. This protects it from anyone on the network; because the server passes on the key exchange, it is not designed to protect against the operator of the Callixy server.
- Chat messages, voice and video messages, photos and files are stored on our server in readable form, protected by access controls, so that they can be shown on your devices. They are not end-to-end encrypted.
- Passwords are stored as bcrypt hashes. Sign-ins are rate-limited, and repeated failures lock an account for a short time.
Who can see what
Other Callixy users
- Anyone signed in to Callixy who knows your number can see that the number has a line, your display name, and whether you are online or busy in a call.
- People you call or who call you see your number and display name. Your photo is shown only to someone in a call with you or who has you in their History, and only if you have not chosen Hide my photo from others.
- The person you chat with sees your messages, your reactions to messages, when you read theirs, and when you are typing.
- The names you give your contacts are visible only to you. Nobody is told who reported or blocked them.
The Callixy team
A small number of administrators can see account details (number, name, role, dates, counts of calls and messages), profile photos including hidden ones, call records and quality reports, technical logs, reports with the message copies attached to them, and messages sent through the contact form. The administration tools do not show chat conversations or play voice and video messages. Administrators use this access only to run the service, help users who ask, and handle reports.
Service providers
We use the following providers to run Callixy. They process data only to provide their service. We do not share data with anyone for advertising.
| Provider | What it does | What it receives |
|---|---|---|
| Our hosting provider | Runs the Callixy servers and stores their data | All service data described in this policy |
| Google Firebase Cloud Messaging (Android app) | Wakes the app for calls and messages | The device's notification address; for a call, the caller's name and number; for a chat message, the sender's name and number and the first 80 characters of the message; for a voice or video message, the sender's name and number (never the message itself) |
| Apple Push Notification service (iPhone app) | Delivers incoming call signals and message notifications, including while the screen is locked | The device notification token; caller or sender name and Callixy number; call or message identifiers; a short text preview for chat messages. Call audio, video and attachments are not sent through APNs. You can hide previews in iOS notification settings. |
| Browser push services (Google, Apple, Mozilla, Microsoft) | Deliver notifications to browsers | Notifications encrypted for your browser, which the push service cannot read |
| Google STUN servers | Help two devices find a direct route at the start of a call | Your IP address |
| Google Fonts | Serves the fonts of the app's pages | Your IP address and browser details |
| Cloudflare | A second relay network for call media, the DNS of our domain, and the hosting of this website | Encrypted call packets and IP addresses; for the relay, a code per line that is not your number or name (to find misuse); visits to this website |
We may disclose information when the law requires it, or when it is needed to protect someone from serious harm, for example to report child sexual abuse material to the authorities.
Data on your device
To start quickly and to work on weak networks, the app keeps a copy of some of your data on your device: your profile, contact names, recent history, the theme you chose, recent emoji, unsent chat drafts, a sign-in ticket for the backup server that expires after 72 hours, records of calls made through the backup server until the main server has them, and short-lived connection settings. The sign-in cookie is not readable by scripts. Signing out clears the account data; the theme and recent emoji stay. The Android app also keeps its permission and setup choices, and it does not copy any of its data to Google's cloud backups. Uninstalling the Android app removes its local app data. On iPhone, the session and device credentials are stored in the iOS Keychain with device-only protection; Keychain entries can remain after uninstalling. Sign out or delete your line to revoke access. The iPhone app also stores notification tokens and local preferences, and keeps short diagnostic call logs on the device. These logs contain technical events, not call recordings.
Android permissions
The Android app asks only for what calls need: the microphone (so the other person hears you), the camera (only for video calls), notifications and full-screen calls (to ring, also on the lock screen), nearby devices (Bluetooth headsets and cars), display over other apps (to bring a ringing call to the front), the local network (direct calls on the same Wi-Fi), and permission to run a phone-call service while a call or a screen share is active. It also registers its calls with Android so headsets and cars show the caller. The guide explains each one.
iPhone permissions and screen sharing
The iPhone app asks for the microphone for calls and voice messages, the camera for video calls and media you choose to capture, and notifications for messages and missed calls. Local network permission is used when connecting to a Callixy server on your network. The system photo and file pickers provide only the items you select. CallKit displays incoming calls on the lock screen and can include calls in the system Recents list. Screen sharing starts only after you confirm the iOS broadcast prompt; visible screen content is sent to the other participant during the call and is not recorded by Callixy. You can stop the broadcast from iOS or end the call.
How long data is kept
| Data | Kept |
|---|---|
| Account, photo, contacts | Until you change or delete them, or delete your line |
| Your call history | Your 500 most recent entries, until you delete your line |
| Server call records | 90 days after the call |
| Chat messages | Until the sender deletes them or either person deletes their line; at most 5,000 per conversation, oldest removed first |
| The earlier text of an edited or deleted chat message | 30 days, or until either person deletes their line |
| Voice and video messages | 30 days unless the administrators set another time, or until the sender deletes the message (older messages: until the recipient deletes them) |
| Photos, videos and files sent in a chat | 30 days unless the administrators set another time, or until the sender deletes the message or either person deletes their line |
| Safe box notes | Until you delete them or delete your line |
| Messages from Callixy Support | 180 days |
| Links to choose a new password | Usable once, for 30 minutes (24 hours when made by an administrator); their record 30 days |
| Call quality reports | 90 days |
| Blocks | Until you unblock, or either line is deleted |
| Reports | Until handled, then 180 days |
| Messages to the team | Until handled, then 180 days |
| The record that a line was closed | Until the line is reopened or deleted |
| Notification addresses and sessions | Until you sign out, sign in on another device, or delete your line |
| Technical logs | Overwritten on a rolling basis (a few megabytes in total) |
| Backups of the database | Replaced on a rolling basis, within about five weeks |
When you delete your line, the data above is deleted at once, except as described on Delete your line.
Your choices and rights
- Change your name, photo, photo visibility and contact names in the app at any time.
- Delete your own chat messages for both people, and delete voice or video messages left for you.
- Turn notifications, the camera or the microphone off in your phone or browser settings.
- Delete your line and its data, in the app or on the web: see Delete your line.
- Ask us for a copy of your data, to correct it, or to stop a particular use of it, by contacting us.
Depending on where you live, for example in the European Union or the United Kingdom, you may have rights to access, correct, delete, restrict or object to the use of your data, to receive it in a portable form, and to complain to your data protection authority. We will answer such requests within one month.
Legal bases
We use your data to provide the service you signed up for (contract); to keep Callixy secure, prevent abuse and improve call quality (legitimate interests); with your permission for notifications, the microphone and the camera, which you can withdraw in your settings (consent); and where the law requires it (legal obligation).
Children
Callixy is for people aged 13 and over who meet the age and consent requirements in their country or territory. We do not knowingly collect personal data from anyone under 13. If we learn that a line belongs to someone who does not meet the age requirements, we close the line and delete its personal data, subject to any legal retention obligations. Our Child safety standards explain how we handle abuse involving minors.
International transfers
Our servers and the providers above may process data in countries other than yours, which may have different data protection laws. We use only what each provider needs to do its job.
Changes to this policy
When we change this policy we update the date at the top of this page. If a change matters for how your data is used, we will also tell you in the app before it applies.
Contact
For questions about this policy or your data, or to use your rights, write to the Callixy team at callixy@ibi.bz or with the contact form and choose Privacy or my data. You do not need a line to write. To report a person or a message, use Report in the app.