Callmate Privacy Notice
Effective Date: June 2026
This notice should be read together with our Terms of Use. If anything in the two documents conflicts, this notice prevails.
Callmate Technologies Pvt. Ltd. (“Callmate”, “we”, “us”) builds a voice and video calling product designed for one-on-one conversations between adults in India. This notice explains, in plain language, what we keep on our servers about you, why we keep it, and what you can do about it.
We try to keep data collection narrow on purpose. Wherever a feature works without a piece of information, we don't ask for it. Wherever a feature requires it, we ask the operating system for permission first.
Questions, requests, or complaints can go to support@callmate.co.in.
What data we keep and why
The table groups every category we touch. We do not sell any of this to a third party.
| Category | What we keep | Why |
|---|---|---|
| Account & sign-in | Phone number (hashed for lookup), country, language, gender, session token (stored as SHA-256 hash only) | Authenticate you on every device switch; route OTPs; show you the right language; prevent token theft if our DB is ever leaked. |
| Profile | Display name you choose, optional birth year, profile picture (if uploaded), bio | Show your card to other users you call. Everything here is opt-in. |
| Call ledger | Start/end time, duration, peer user id, coin charge, who picked up or declined | Bill the right wallet; refund missed calls; let you and the listener see history. We do NOT store the audio/video stream itself. |
| Safety & moderation | Reports raised against your profile, blocks placed, abuse flags, suspension reason | Investigate complaints and remove repeat offenders. Visible to admins only. |
| Device & push | Push token (FCM), OS version, app version, free storage, last app open time | Ring you for an incoming call; tune notification delivery; ship the right bundle for your OS. |
| Network | IP address (last two octets stored), ISP / mobile carrier, time zone | Detect SMS-pumping attacks; block sign-up storms from a single network; pick the closest media server. |
| Permissions you grant | Microphone, camera, contacts (only if you choose to invite friends) | Power audio/video calling. Permission is asked in-line and can be revoked from OS settings any time. |
| Listener KYC (only listeners) | PAN, UPI VPA, bank account number, name on bank account | Settle weekly payouts; comply with tax-deduction rules and anti-money-laundering checks. Held in encrypted form, deleted after legal retention period. |
| Customer support | Whatever you write into a support ticket or email | Solve your issue. Tickets are auto-archived 12 months after closure. |
| Aggregated analytics | De-identified counts: DAU, call success rate, crash rate, average call length | Tune the product. Cannot be tied back to you. |
| Cookies (web only) | Strictly-necessary session cookie on callmate.co.in | Keep you signed in on the admin console; the marketing site uses no cookies at all. |
How we share it
- With the person you call. They see your username and avatar — never your phone number, email, or location.
- With our infrastructure providers. Cloud hosting, calling SDKs, push gateways, payment partners, KYC providers. They are bound by data-processing agreements and may only act on our instructions.
- When the law requires us to. Valid court orders, FIR-backed police requests, and similar. We push back on overbroad demands and try to notify you where lawful.
- In a corporate event. Merger, acquisition, or asset sale — the new owner inherits these obligations and we will email you before any change.
- De-identified, anywhere. We may publish aggregate stats (e.g. “India made X million calls in May”) that contain no personal information.
How we protect it
Session tokens are stored as SHA-256 hashes only — a database leak does not reveal usable login credentials. Mobile clients keep their tokens in the platform secure enclave (iOS Keychain / Android Keystore). Payment details never touch our servers; they are tokenised by our PCI-compliant payment partner. Logs are scrubbed of phone numbers, emails, and IPs before storage. Servers run inside a private Kubernetes network behind security headers, rate limits, body-size caps, and host validation.
None of this makes us breach-proof. If something does happen, we will notify you and the regulator within the timeline that the law requires.
How long we keep it
Call ledger entries are retained for 90 days and then permanently deleted. Reports, blocks, and safety flags are kept while the related account is active. Listener KYC data is retained for as long as Indian tax law requires (typically 8 years after the financial year of the last payout) and then deleted. If you delete your account, your profile, contacts, and feedback are removed immediately; call ledger entries are anonymised within 24 hours.
Your controls
- Export. Settings → Account & Data → Download my data gives you a JSON dump of everything we hold about you.
- Delete. Same screen, Delete my account. Irreversible. Withdraw unpaid earnings first — they are forfeited on deletion.
- Correct. Username, language, and gender can be edited from Settings → Profile. Phone number is fixed at sign-up; contact support for a number-change request.
- Withdraw consent. Revoke microphone, camera, or contacts permission from your OS settings. Some features will stop working accordingly.
- Marketing opt-out. Email support@callmate.co.in to stop promotional messages. Account-critical alerts (security, billing) continue.
Children
Callmate is strictly for adults. We show a hard 18+ gate on first launch. If a minor account is reported, we suspend it immediately and delete all associated data unless we are required to retain it for an investigation.
Changes to this notice
We will update this page when our practices change. Material changes that affect your rights trigger an in-app notification 30 days before they take effect, so you have time to delete your account if you disagree.
Grievance officer
For complaints about how your data is handled, write to our Grievance Officer at grievance@callmate.co.in. Please include the phone number on the account so we can verify ownership.
Callmate Technologies Pvt. Ltd., Bengaluru, Karnataka, India