Your data stays on your phone.

SpamCallynx processes on your device the phone numbers, call history, contacts, rules and preferences needed to protect you. These data are not sent to our servers. The app does not read notifications from other apps or analyse other content on your phone.

The controller is Mirko Bongiovanni, operating under the Bytedare Tech brand. For privacy enquiries, use the privacy request form linked below.

The app uses only the data required for features requested by the user and after Android permissions have been granted.

To verify a purchase, an HTTPS connection sends a random installation identifier, technical app and product identifiers, the purchase token supplied by Google Play, and the app’s signed certificate. We do not receive or store payment-card details. Payments and refunds are handled by Google Play.

SpamCallynx is designed to minimise data use.

The activity log is retained for up to 30 days. Internal history and items useful for on-device learning may remain for up to 5 years; rules and preferences remain until the user changes or deletes them, or clears the app data. Rules and local data can be deleted from within the app.

SpamCallynx does not create user accounts. To erase data stored by SpamCallynx on this device, open Options → Data, privacy and backup → Privacy notice, then choose “Erase app data”. This permanently deletes rules, preferences, internal history, Analysis results, notes, diagnostics and temporary copies stored by SpamCallynx.

Backups and exports are initiated and controlled by the user. They may contain phone numbers or patterns in plain text and should be stored securely. A diagnostic export may include technical information, country codes and travel-mode status, but no SIM identifiers. Android may also create backups according to the user’s account and device settings.

The website does not use analytics, advertising or profiling cookies. It stores the language choice locally in your browser (localStorage) to remember it on future visits. The support form loads Cloudflare Turnstile, a technical anti-abuse check that may use strictly necessary Cloudflare technologies; they are not used for advertising or profiling. If you voluntarily use the online support form, we process your email address, topic, subject, message, optional name and any JPG, PNG or PDF attachments to answer you. Cloudflare hosts the service, validates Turnstile and temporarily stores the unconfirmed request for up to 24 hours. Resend sends the verification email and, after you confirm the address, transmits the confirmed request and any attachments to our private support mailbox. Unconfirmed requests expire. Ordinary technical request data is used to prevent abuse. Support correspondence is kept only as long as needed to handle the request and meet applicable obligations. Do not send unnecessary sensitive information; you may request deletion through the privacy request form.

On-device processing, licence verification and support are necessary to provide the features or assistance you request (Article 6(1)(b) GDPR). Security, fraud prevention and service protection rely on our legitimate interest in operating SpamCallynx safely (Article 6(1)(f)); legal and privacy obligations rely on Article 6(1)(c). Android permissions are device controls and are not treated as consent to unrelated processing.

Google Play handles purchases and provides the purchase token. Cloudflare provides website hosting, network security, Workers, temporary storage, Turnstile and email routing. Resend delivers both support verification emails and confirmed support requests, including any attachments, to the relevant recipient. Google provides the private Gmail mailbox used to receive and answer support requests. These providers may process limited data outside the EEA under their contractual safeguards, including standard contractual clauses where applicable. They act under their own terms or as processors for the relevant service. We do not sell personal data.

Unconfirmed support requests expire from Cloudflare within 24 hours. Short-lived confirmation records expire within 48 hours. The keyed, non-readable value used for daily anti-abuse limits expires with that daily window. Under Resend’s current standard policy, email content and logs it processes are retained for 30 days while the account is active. Confirmed support correspondence is normally deleted within 12 months after the request is closed; attachments are removed as soon as no longer needed and in any event within 90 days, unless a longer period is necessary for a legal claim, security investigation or binding obligation. Licence records are kept while needed to verify or restore an entitlement and to prevent fraud, then deleted or anonymised when no longer necessary.

Where applicable, you may use the privacy request form to request access, rectification, erasure, restriction, portability or object to processing. We normally reply within one month and may ask for proportionate proof of identity. You may also complain to the Italian Data Protection Authority or your local supervisory authority. Call protection follows the rules and profile you choose; you can review, change or reverse them. SpamCallynx does not make solely automated decisions that produce legal or similarly significant effects.

Licence verification uses encrypted connections and technical abuse-prevention controls. The app is not intended for children. This policy may be updated when features or legal requirements change; its date and version will always be shown here.