Call'em is a one-tap "call for help" button for your home, villa, restaurant or office. It sends short messages to people you choose. The app has no accounts, no analytics and no advertising. Everything you set up lives on your phone. Messages pass through our relay server in encrypted form — the server cannot read them.

In short

1. Who we are

Call'em is developed and published by an independent developer (the "developer", "we"). Contact: support@callemapp.com.

2. Data stored on your device

The app stores the following only in its private storage on your phone. It is not accessible to other apps and is excluded from Android cloud backup.

Data	Purpose	Notes
Places, buttons, folders, groups, layout	Your configuration: what the buttons say and whom they reach.	Plain JSON files in app storage.
People	Names you enter and the delivery address for each person: the random identifier of their Call'em device.	Names are whatever you type; the app does not read your contacts.
Encryption keys	A key pair identifying this device and one secret key per place, shared with recipients through the QR code.	Stored encrypted (Android Keystore‑backed encrypted preferences). Never sent to our server.
Rooms	Optional. A Wi‑Fi fingerprint (nearby access point identifiers and signal strengths) per room so the app can add "📍 Kitchen" to a message.	Processed on the device only. Never transmitted; only the room name you typed is added to a message.
Call history	The last 200 sent calls (button, recipients, time, delivered/accepted/failed) so you can see what went out.	Can be cleared any time in Settings → General → Clear call history.
Received calls	If you receive alerts: the places you joined and the calls you received (text, place, room, time, accepted or not).	Removed when you leave a place or the owner removes you.
Preferences	Theme, accent colour, language, widget layout, your display name as a recipient.
Pro licence	Whether Pro is active: a Google Play purchase flag or the activation code you entered.	Stored encrypted. See Purchases.

3. What leaves your device

Nothing leaves your device until you press a button or connect with someone. When you do, the app sends one message per recipient:

Our relay server

Recipients use the Call'em app too. Messages travel over HTTPS to our relay server at relay.callemapp.com, which forwards them to the recipient's phone through Google's Firebase Cloud Messaging or, where that is unavailable, over a direct encrypted connection from the recipient's app.

Messages are end‑to‑end encrypted. The message text, the place name, the room name, the button name and the names of the people involved are encrypted on your phone with a key that only the owner's and the recipients' phones have (it is exchanged through the QR code, never through our server). The server stores and forwards ciphertext it cannot decrypt.

To do its job, the relay server stores:

Data	Why	How long
Device identifier and public key	A random identifier created by the app on first use, not tied to your name, Google account or phone number. The public key lets the server verify that requests come from that device.	Until deleted on request (see Your choices). It contains nothing that identifies you.
Push token	A token issued by Firebase so the server can wake up the recipient's app when a call arrives.	Replaced when it changes; cleared automatically once Firebase reports it invalid (for example after the app is uninstalled).
App version and platform	"android" and the app version, to keep old and new apps compatible.	Same as the device.
Links	Which recipient device is connected to which owner device and place (identifiers only), and whether the owner has confirmed the person.	Until the owner removes the person or deletes the place, or the recipient leaves.
Owner phones of a place	If you copy your setup to a second phone (Settings → Other phones), the server records that both devices are owners of the same place (identifiers only), so people you add on either phone can be reached from both.	Until a phone is removed from the place or the place is deleted.
Encrypted messages	The encrypted call, who sent it to whom (device identifiers), timestamps and delivery status ("delivered", "accepted"). Settings copied to another phone and later changes travel the same way — end‑to‑end encrypted with a key exchanged through the QR code.	Undelivered calls expire after at most 24 hours. Delivered calls are deleted after 7 days, accepted ones after 30 days, so the sender can see the status after a restart.
Server logs	Standard technical logs (request path, status code, time, IP address) used to keep the service running and detect abuse.	Limited in size and rotated automatically; typically a few days.

The server is hosted on Hetzner in Germany (EU). We do not sell, share or analyse this data, and we do not use it for anything other than delivering your calls. Firebase Cloud Messaging is operated by Google; the push message it carries contains only encrypted data and identifiers. See the Firebase privacy information.

4. Permissions

Permission	Why
Internet	Deliver and receive messages.
Notifications	Show incoming calls to people who receive alerts, and the "Sending…" status.
Full‑screen notifications	Show an incoming call on top of the lock screen so staff do not miss it. Only used when you receive alerts.
Camera	Scan the QR code to connect to a place. Images are processed on the device and never stored or sent.
Vibrate	Haptic feedback when a button is pressed or a call arrives.
Foreground service, run at startup	Keep a connection to the relay open on phones without Google services, so calls still arrive instantly. Only used when you receive alerts.
Wi‑Fi state / Nearby Wi‑Fi devices / Location	Only for the optional Rooms feature. Android requires location permission to read nearby Wi‑Fi networks. The app does not use GPS, does not compute your geographic position and does not send any location or Wi‑Fi data anywhere.

If you never set up rooms, the app never asks for location access. If you only send calls, it never asks for the camera.

5. Analytics, advertising, tracking

None. The app contains no analytics, crash‑reporting or advertising SDKs and does not generate or use any advertising identifiers. The random device identifier used by the relay exists only to route your calls and is deleted together with the device record.

6. Purchases

Pro is an optional one‑time purchase. Where it is bought through Google Play, payment is handled entirely by Google Play Billing; we receive no payment details. Google's processing is described in the Google Privacy Policy.

Where Google Play purchases are not available, Pro can be bought by e‑mail. In that case we receive what you send us: your e‑mail address, the phone code shown on the Pro screen (eight characters derived from the random device identifier; it does not identify you) and the payment confirmation. We keep this correspondence and a record of the sale (date, phone code, amount) for as long as tax law requires, use it only to issue the activation code and to help you if you change phones, and never share it. The activation code is checked and stored on your phone only; nothing about the purchase is sent to our server. It is included when you copy your setup to another phone of yours.

7. Children

The app is not directed at children under 13 and does not knowingly collect any personal data from anyone.

8. Your choices

• Clear history — Settings → General → Clear call history.
• Remove a person or place — delete it in Settings. The data is removed from the device immediately; the connection on the relay is deleted and the person's app forgets the place.
• Leave a place (as a recipient) — in Incoming alerts. The connection is removed from the relay and calls for that place can no longer be delivered to you.
• Everything — uninstall the app or clear its storage in Android settings. The relay keeps nothing that can identify you; remaining encrypted messages expire within the periods above, and the push token is cleared once it becomes invalid. If you would like the anonymous device record deleted as well, write to us and we will do it.
• Messages already delivered stay in the recipient's Call'em app until they delete them.

9. Changes

If this policy changes, the new version will be published at this address with an updated effective date.

10. Contact

Questions about privacy: support@callemapp.com.