Privacy Policy

Who we are

Idyno is a caller identification and reverse phone lookup service, available as iOS and Android apps and as a public website. We act as the data controller for everything processed through the service.

What we collect

• Phone numbers and the names attached to them, as received from the address books of users who explicitly agreed to share.
• Basic device data: operating system, device model, app version, and SIM country code — used to determine your region and ensure compatibility.
• Activity records: lookups, spam reports, and deletion requests, with their time and origin.
• Upload attribution for every record: who uploaded it, from which device, when, and from which app version.
• Network address and the country code Cloudflare derives from it — used to route you to your region and to prevent abuse.

What we never collect or do

• We show no ads and embed no advertising or marketing-tracking library — not in the apps and not on the website.
• We do not sell, rent, or share your data for marketing purposes.
• We do not read your call log: on Android we use CallScreeningService and never request the READ_CALL_LOG permission.
• We do not read your clipboard contents; we only detect that a number is present, and reading happens only on an explicit tap from you.
• We never message your contacts and never expose them to any third party.
• We use no artificial intelligence to process your data — a final product decision.

Upload attribution — who uploaded your number

For every record we store who uploaded it, from which device, and when. This data is necessary for compliance, for abuse prevention, and for responding to lawful requests.

It is never shown to any user — not in the app, not on the website, not in any export. Access is limited to our administration console, and every access is written to an audit log capturing who looked, when, and for what stated reason.

Individual names are never published

Names received from address books never appear on a public page or in search engine results. Number pages on our website show only number facts and aggregate community signals.

Caller names appear inside the app while the phone rings, and to users who meet the sharing requirement when performing a manual lookup. Verified business identity is a declared exception: a business identifies itself and asks for its name to be shown.

The contact sharing requirement

The caller ID database is built from user contributions, so manual lookup inside the app requires sharing your address book. Sharing is optional, but manual lookup does not work without it.

The requirement never touches three things: caller identification during an incoming call, deletion of your number, and the privacy centre. Those are open to everyone with no condition attached.

You may withdraw sharing at any time, and we then delete what was uploaded from your address book.

How your data is stored

Every number is normalised to international format before storage, then stored in two forms: a stable fingerprint used for fast lookup, and an AES-256-GCM encrypted value that can be decrypted.

The encryption keys belong to us and live in a hardware vault per region. We can decrypt when required, our administration console reads the full data, and we respond to lawful requests.

What the encryption clearly protects against: a leaked disk or backup. What it does not claim: that it prevents us from access. We state this plainly, because claiming otherwise would be a lie.

Where your data is stored

We run two fully independent regions: Riyadh in Saudi Arabia and Frankfurt in Germany. Each has its own database, its own keys, and its own backups.

Your region is fixed at registration from your number’s country code: Gulf countries and the rest of the world go to Riyadh; the European Union, the EEA, the United Kingdom, and Switzerland go to Frankfurt.

The two regions do not talk to each other and no personal data moves between them. The only exception is non-personal aggregate statistics, which sync one way to the administration console.

Countries we do not serve

We do not accept registration from country codes that impose localisation we cannot satisfy or that are subject to sanctions: Russia and Kazakhstan (+7), China (+86), Vietnam (+84), and Iran (+98). We neither process nor store data for users in those countries.

Deleting your number — instant and free

Deletion is a statutory right that we attach to no condition: no account, no subscription, no contact sharing, no fee.

From inside the app: verify ownership with a WhatsApp code, and deletion executes automatically in under a minute with no human in the loop.

From the website: fill in the removal request form with no account and no app. We open a ticket immediately, verify, and execute.

After deletion your number enters a permanent suppression list checked on both write and read, so it never returns even if a thousand people upload it later.

Your rights

These rights are exercised free of charge and without requiring the app. If you believe a request was not handled properly, you may lodge a complaint with the supervisory authority in your country.

• Access: request a copy of everything we store about your number.
• Rectification: request a correction to a name attached to your number.
• Erasure: delete your number permanently at any time.
• Restriction: ask us to hide your number from lookup results without full deletion.
• Objection and withdrawal of consent: withdraw contact sharing whenever you wish.

Retention

• Raw contact batches are deleted after aggregation, within thirty days at most.
• Aggregated records persist while the account exists or until deletion of the number is requested.
• The suppression list is permanent by design — it is what guarantees a deleted number never returns.
• Audit logs are retained for the period the law requires.

Security

• Encrypted transport over TLS 1.3 only, with certificate pinning in both apps.
• Encryption at rest with keys held in a hardware vault per region.
• Administration console access via passkeys, a one-time code, and an IP allow list.
• Every administrative access to personal data requires a stated reason and is written to the audit log.
• Rate limiting on every API per device, per account, and per address.

Children

The service is not directed at anyone under sixteen, and we do not knowingly collect their data.

Changes to this policy

Any material change is announced in the app and on this page well before it takes effect, together with a plain statement of exactly what changed.

Contact

For any question or request about your privacy, use the form on the removal request page or the privacy address published in the app.