Privacy and data protection
This policy explains how the Wcall mobile application and related services access, collect, use, disclose, protect, retain, and delete information.
Effective date: July 24, 2026
Wcall helps a user check whether another party can access a claimed phone number or registered Wcall device during a suspicious call or conversation. A Match result shows access at that moment; it does not prove a person's identity.
In this policy, “Wcall,” “we,” and “us” mean the developer and service identified as Wcall in the Google Play listing. Privacy questions can be sent to team@wcall.me.
When you register, we process your phone number in international format, Firebase user identifier, authentication status, and authentication tokens. Firebase Authentication processes the phone verification request and verification code. We use this information to create and secure your Wcall account and prevent unauthorized access.
If you grant contact permission, Wcall reads contacts on your device so you can choose who to check or add to Close Circle. Your complete address book is not uploaded to Wcall.
When you deliberately add a person to Close Circle, the selected name, phone label, and phone number are synchronized with your verified account. Recoverable Close Circle phone data is encrypted before server storage. Phone lookup indexes use one-way keyed hashes.
To deliver push checks, we process an app installation identifier, Firebase Cloud Messaging token, device platform, device label, account identifier, masked phone number, and device registration timestamps. Removing a device deletes that device registration and push token while leaving the Wcall account available on other devices.
To perform a check, we process the selected or entered phone number, the contact name shown for that check, check method (SMS or push), verification session identifiers, short-lived verification codes or caller tokens, timestamps, delivery state, direction, and result such as Match, Not match, or timeout.
For SMS checks, Twilio processes the destination phone number and message needed to deliver the four-digit code. Wcall stores authoritative history using masked phone data where possible. We do not use OTPs, raw phone numbers, FCM tokens, or caller tokens for analytics or advertising.
Google Play processes payments. Wcall receives product identifiers, purchase tokens, purchase state, account-binding identifiers, and entitlement records needed to grant SMS packs or Close Circle slots, prevent duplicate grants, restore purchases, handle refunds, and investigate fraud. Wcall does not receive your full payment-card details.
Wcall uses Firebase Analytics and Firebase Crashlytics to understand app reliability and basic feature outcomes. These services may process app and device identifiers, app version, operating system, device characteristics, approximate region, event timestamps, usage events, crash traces, and diagnostic information.
Wcall analytics events are categorical. We do not intentionally include phone numbers, contact names, OTPs, Firebase user IDs, FCM tokens, caller tokens, or free-form message content in analytics events. We do not use this information for targeted advertising.
If you contact us or submit the Wcall website form, we process the email address, message, survey responses, and other information you choose to provide. Website infrastructure may process IP address, browser information, request time, country inferred from the request, and security logs.
We disclose information only as needed to operate Wcall, comply with law, or protect rights and safety. Service providers include:
If you choose to share an installation invitation through another app, Android sends the content to the app you select, and that provider's privacy policy applies. We may also disclose information when legally required, to investigate abuse or fraud, or as part of a business transfer subject to appropriate safeguards.
Wcall does not sell personal or sensitive information and does not share it for targeted advertising.
You can remove the current device from Wcall without deleting the whole account. You can also edit or remove your registered number through the available account controls.
Wcall uses authenticated API requests, encrypted network transport, access controls, UID-scoped records, installation ownership checks, encryption for recoverable Close Circle phone data, keyed hashes for phone lookup, masked history data, secret management, and server-side entitlement enforcement. No system is perfectly secure, but we limit data and access according to the service's needs.
Account data, registered devices, synchronized Close Circle records, verification history, and entitlements are retained while your Wcall account is active or as needed to provide the service. Temporary verification credentials are retained only as needed to complete, secure, and troubleshoot a check.
Support communications, fraud-prevention records, payment evidence, and security logs may be kept for as long as reasonably necessary for support, disputes, abuse prevention, accounting, or legal obligations. The anti-abuse balance record described in Section 14 is retained after account deletion. Deleted information may remain for a limited period in protected backups or provider logs before automatic expiration and is not used to provide an active account.
In the app, open Profile → Delete Wcall account and follow the confirmation steps. You can also use the public account deletion page if you cannot access the app.
Account deletion removes the Firebase Authentication identity, registered devices and push tokens, synchronized Close Circle data, Wcall verification history and sessions associated with the account, and Wcall purchase-transaction records. Google Play, Twilio, and other providers may retain records they independently need for billing, security, dispute handling, or legal compliance under their own policies.
Anti-abuse balance record. To prevent abuse of free allowances through repeated deletion and re-registration, Wcall retains one limited record after account deletion: a one-way keyed hash of the verified phone number together with usage counters and the remaining balance (for example, SMS checks used and remaining, purchased slots). This record contains no name, no contact or history data, and no readable phone number, and cannot be used to contact you. If the same phone number is verified again, the saved balance is restored to the new account instead of granting a fresh free allowance. The record is used for no other purpose.
Where the GDPR or UK GDPR applies, we process information as necessary to perform our agreement with you and provide Wcall; with your consent where required, including device permissions; for legitimate interests such as security, fraud prevention, service reliability, and support; and to comply with legal obligations. You may withdraw consent through device settings or by contacting us, without affecting earlier lawful processing.
Depending on your location, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of your personal information, and to complain to a data-protection authority. To make a request, email team@wcall.me. We may need to verify that you control the relevant account or phone number.
Wcall and its service providers may process information in countries other than your own. Where required, we rely on recognized transfer mechanisms and contractual or organizational safeguards provided by our service providers.
Wcall is not directed to children under 13 or any higher minimum age required by local law. We do not knowingly collect a child's personal information without appropriate authorization. Contact us if you believe a child has provided information improperly.
We may update this policy when Wcall's features, providers, or legal obligations change. We will publish the revised policy here and update the effective date. Material changes may also be communicated in the app or through another appropriate channel.
Wcall privacy contact
team@wcall.me
https://wcall.me
