Kalum Privacy Policy

NeuEra Apps LLC ("NeuEra Apps," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Kalum mobile application and related services (collectively, the "Service").

Please read this Privacy Policy carefully. By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

1. Who We Are

Data Controller: NeuEra Apps LLC, United States of America.

Privacy contact: hello@neuera.app

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, NeuEra Apps LLC acts as the data controller for the personal information collected through Kalum.

2. Information We Collect

2.1 Personal Information You Provide

• Phone Number: Required for account creation and verification through Firebase Authentication (Google). It is not shown to the people you call: calls are placed from a shared outbound number we control, and the caller ID the person you call sees is that number, not yours (see Section 4.3 of the Terms of Use).
• Email Address: Optional. You may provide an email for account recovery and customer-support correspondence.
• Country of Residence: Selected during registration to determine the legal market and the currency for purchases.

2.2 Information Collected Automatically

• Call Metadata: Destination phone numbers you dial, call duration, call status (completed, failed, busy, no answer, canceled), call start/end timestamps, and the country code of each destination. After some calls the app shows an optional one-tap rating (thumbs up or down). If you answer, the rating and any issue you tag from a fixed list (call dropped, one-way audio, choppy audio, delay, echo, noise) are handled as described in Sections 2.7 and 4.1; skipping the rating records only that it was skipped. While a call is in progress we reserve credit for the next minute or two and release what is not used when the call ends; for each call we keep how much was reserved and charged, for how many minutes, and which balance it came from (yours, or a family wallet you belong to, Section 2.11).
• Transaction Data: Credit purchases, amounts in your local currency and in USD, payment method type (Apple in-app purchase, card via Stripe, Google Pay via Stripe), and transaction timestamps. On iOS, purchases are processed by Apple and we receive an Apple transaction identifier, the product identifier, and a signed receipt. Each iOS purchase also carries an account token: a code derived from your account identifier that Apple cannot turn back into it. We use it only to credit a purchase to the Kalum account that made it, even when someone else signs in to Kalum on the same device before the purchase is credited. On Android and the web, purchases are processed by Stripe and we receive a payment method type but never the card number itself.
• Device and App Information: Operating system and version, app version, model information, and language preference, used to deliver correct app behavior and to investigate bugs.
• Device Attestation Tokens: Firebase App Check (Play Integrity on Android, DeviceCheck on iOS) generates a token confirming that requests come from a genuine, unmodified Kalum app. The token is verified by Firebase and does not identify you personally.
• Crash Diagnostics: If the app crashes, Firebase Crashlytics captures a stack trace, the device model, the OS version, and the app state at the moment of the crash. Crashlytics installation IDs are pseudonymous and not linked to your phone number by us.
• Network Address: Your IP address is observed transiently when you connect, and is used for rate limiting and abuse prevention. We do not build a long-term profile from your IP.

2.3 Information Stored on Your Device

The following data lives only on your device. It does not leave the device unless you explicitly send it (for example, in a customer-support email):

• Authentication Tokens: Encrypted and stored in your device's secure storage — iOS Keychain (hardware-backed where available) or Android EncryptedSharedPreferences (AES-256).
• Saved Contacts: A list of contacts you have added inside Kalum (name, phone number, country code). Contacts may be added manually or imported from your device's address book when you tap "Import from contacts" — see Section 2.5 for details.
• Recent Numbers: A short list of the most recently dialed phone numbers, kept for quick redial.
• Cached Account Metadata: Your phone number, account identifier, and balance, kept locally so the app can show your account state quickly when you return.
• Last Number Called: The last number you called and when, kept so that the after-call rating (Section 2.7) is not asked again when you redial it straight away. It is removed when you sign out.

2.4 Information We Do Not Collect by Default

We do not collect, transmit to our servers, or share with third parties (except as described in this Privacy Policy):

• The audio of your voice calls — voice flows directly between your device and Twilio and is not routed through our servers.
• The contents of your device's address book — see Section 2.5 for the opt-in contact-import flow.
• Your microphone audio outside of an active call, your calendar, your browsing history, or your files.
• Advertising identifiers — the Android AD_ID permission is explicitly removed from the app.
• Biometric data or government identifiers — Face ID / Touch ID, where used to confirm a payment, are evaluated on-device by the operating system; we receive only a "succeeded" or "failed" result, never your biometric template.
• Your geographic location is not used to track you. The Stripe SDK on iOS declares an optional location permission that is only invoked at the moment you take a card-payment action; we do not receive your coordinates and we do not store location data.

2.5 Optional Permission-Gated Flows

Some features require an operating-system permission and only run when you actively use them. We list these so it is clear what triggers them and what we receive:

• Import from contacts (iOS Contacts / Android READ_CONTACTS). When you tap "Import from contacts" we ask your operating system for access to your address book. We read only the name and phone number of the contact you select and save it as a Kalum saved contact on your device. We do not upload your address book to our servers.
• Scan card during top-up (iOS Camera, optionally Photo Library). If you choose to scan a payment card during checkout, the Stripe mobile SDK opens your camera, recognizes the card number on-device, and sends the resulting card details directly to Stripe. We never see the card number or the image.
• Approximate location during a card payment (iOS Location When-In-Use). The Stripe mobile SDK may briefly request approximate location to satisfy card-network fraud-risk requirements. The location is used by Stripe; we do not receive or store it.
• Authorize a sensitive payment action (iOS Face ID / Touch ID, Android biometric prompt). The operating system evaluates your biometric on-device and returns only "succeeded" or "failed" to the app. We never receive your biometric data.

These permissions are declared in the app so that the operating system can ask you for consent at the moment a feature is used. Declining a prompt does not affect your ability to place calls.

2.6 Aggregate Demand Measurement

When you look up the price of calling a destination, we add one to a running count for that destination. The count records the destination's country calling code and at most the first three digits of the national number — never the full number you entered, and never who entered it. Where a country's calling code is four digits or longer, no national digits are recorded at all. Alongside those, each count records whether the request came from a verified copy of the app, whether it arrived with a sign-in token attached, and whether the device was iOS or Android. Nothing in that identifies the device or the person using it.

This measurement carries no identifier, no timestamp on any count and no record of individual events. It cannot be connected to your account, to a call you placed, or to any other lookup. What we hold is a total per destination, and it cannot be separated back out — by us or by anyone else. A small total may reflect a single lookup; even then it records nothing about who made it or when. We keep one date for the measurement as a whole — when the current counting period began — which says nothing about any individual lookup.

We use it to learn which destinations people actually want to call, including the ones they price and then decide against, so that we can negotiate better rates on those routes. It is not used to build a profile of you, to target advertising, or for any automated decision affecting you.

Because this data identifies no one, there is no record within it that we can retrieve or delete in response to an access or erasure request. That is a consequence of the design rather than a limit on our willingness. See the NeuEra Apps Data Practices Charter for the standard we apply to measurements of this kind.

2.7 Aggregate Call-Quality Measurement

After some calls the app asks, with a single tap, how the call was. It asks more often after a call that appears to have gone wrong — one that dropped, reconnected, or ended within seconds of connecting — and only occasionally after a call that went well. You can skip it, and it disappears on its own after ten seconds. It is never a question about the app, and it never leads to a request to rate the app in an app store.

Your answer is counted, not recorded. We add one to a running count for the destination's country calling code, the device platform (iOS or Android), the answer (up, down or skipped) and, for a thumbs-down, each issue you tagged. As in Section 2.6, this carries no identifier, no timestamp on any count and no record of individual answers. It cannot be connected to your account or to the call you rated, and it cannot be separated back out. There is deliberately no free-text field: a fixed list of issues is what keeps this measurement anonymous.

We use it to see which routes have quality problems and of what kind, so that a pattern of dropped or one-way calls to one destination becomes a routing or carrier decision rather than a complaint we never heard. Because this data identifies no one, there is no record within it that we can retrieve or delete in response to an access or erasure request.

Separately from this count, and only if you answer, the same rating and the first issue you tagged are attached to the record of that call held by Twilio, our voice carrier, so that your experience can be compared against Twilio's own network measurements for that call. Section 4.1 describes this sharing and Section 9 its retention.

2.8 Campaign Landing Pages

Some links to Kalum — in a video description, on a creator's page, in a printed QR code — open a short landing page of ours before the app store. When you open one, we add one to a daily count for that campaign, and when you tap a store button we add one to a daily count for that button. That is the whole record: the campaign name, the day, and a total. No visit is recorded on its own, and no identifier, IP address, browser detail or referring page is kept.

We use these counts to see which campaigns bring people to the app. The app stores separately report installs per campaign to us in aggregate under their own privacy terms (Section 5); we never receive who installed. Because this data identifies no one, there is no record within it that we can retrieve or delete in response to an access or erasure request.

2.9 Aggregate Setup Measurement

As you set the app up for the first time, we add one to a running count at each step you reach: opening the app for the first time, looking at a destination's rate, creating an account, looking at the credit packs, starting a purchase, completing one, and placing a first call. Each count records the step, the destination's country calling code where the step has one, the device platform (iOS or Android) and the app version. If your phone is set to a country where we cannot open accounts yet, the app also counts that, recording that country's calling code in place of a destination's; this is the only count here that says where a phone is set rather than where a call would go. We also try two versions of the first-run experience; which one a device sees is decided by a coin flip made on the device itself, stored only there, and the counts record which of the two it was as a single letter. No server chooses it and no server learns which device drew what.

As in Section 2.6, this carries no identifier, no timestamp on any count and no record of individual events. It cannot be connected to your account, to a call you placed, or to any other step you took — including the other steps in your own setup, which is why this measurement can say how many people reached a step but never that any particular person did. Opening the app for the first time, and a phone set to a country where we cannot open accounts yet, are each sent at most once from a device. A first purchase and a first call are sent at most once for an account created on that device, and never for an existing account that signs in there. So each of those totals is a number of devices or of new accounts, not a number of taps. We keep one date for the measurement as a whole, when the current counting period began, which says nothing about any individual step.

We use it to find where setting the app up goes wrong — the step where people stop — and to tell whether a change to the first-run experience actually helps. It is not used to build a profile of you, to target advertising, or for any automated decision affecting you.

Because this data identifies no one, there is no record within it that we can retrieve or delete in response to an access or erasure request.

2.10 Aggregate Refused-Call Measurement

A small number of destinations are ones we do not connect calls to, because they are routes that exist mainly to generate charges rather than to carry conversations. When a call is refused for that reason, we add one to a running count for the destination's country calling code and the reason it was refused. The number you dialled is not recorded, and neither is the fact that it was you who dialled it.

As in Section 2.6, this carries no identifier, no timestamp on any count and no record of individual refusals. It cannot be connected to your account or to any call attempt, and it cannot be separated back out. A refused call is not charged to you, and a refusal is not a judgement about you — the same destination is refused for everyone.

We use it to see which routes are being probed and how often, so that the list of refused destinations stays as short as the problem allows rather than growing by guesswork. It is not used to build a profile of you, to target advertising, or for any automated decision affecting you.

Because this data identifies no one, there is no record within it that we can retrieve or delete in response to an access or erasure request.

2.11 Family Wallet

You can let up to five other Kalum users call on your balance, or join someone else's family wallet. No money moves between accounts: a member's call is charged to the member's own balance first and then to the family wallet's.

If you use it, we keep: which accounts belong to which family wallet, and when each joined or left; the monthly limit the owner set for each member; the single-use invite codes, which are valid for 48 hours, and which account used each one; and, for each call a member places, how much of it the family wallet paid.

What each side sees: the owner sees each member's phone number reduced to its last four digits and how much that member has spent from the family wallet this month. A member sees the owner's last four digits and how much they have left to spend. No one sees the numbers or countries anyone else called. A member is shown this before accepting an invitation.

We use this information to run the feature and to prevent its abuse: a family wallet is frozen if a payment by its owner is disputed. It is not used to build a profile of you, to target advertising, or for any automated decision affecting you beyond that freeze.

Leaving, being removed, the owner ending the family wallet, or deleting your account ends your membership. The records above are deleted with your account; what a member spent from the family wallet stays on the owner's transaction record, without any link to the member's calls.

3. How We Use Your Information

We use the information we collect for the following purposes. For users in the EEA, the United Kingdom, and Switzerland, the legal basis under the GDPR is shown in the third column.

We do not use your information for:

• Advertising, marketing to third parties, or building advertising profiles.
• Selling, renting, or sharing personal information for cross-context behavioral advertising.
• Profiling that produces legal or similarly significant effects on you.

4. Information Sharing and Disclosure

We share your information only in the following circumstances.

4.1 Service Providers (Sub-processors)

Kalum relies on the following providers to operate the Service. Each provider acts as our processor and may only use your information for the purposes described below.

We have data-processing agreements in place with these providers and rely on appropriate safeguards (including the European Commission's Standard Contractual Clauses where applicable) for international transfers.

Important:

• Voice call audio flows directly between your device and Twilio's servers using encrypted media streams. Our servers never receive, decode, or store call audio.
• Payment card details (PAN, CVV, expiry) are submitted from your device directly to Apple (iOS) or Stripe (Android, web). We never receive, process, or store card numbers.
• We do not integrate any analytics, telemetry, or advertising SDKs (no Sentry, Mixpanel, Amplitude, AppsFlyer, Adjust, Facebook SDK, or similar).

4.2 Legal Requirements

We may disclose your information if required by law, regulation, legal process, or enforceable governmental request — for example, in response to a court order, subpoena, or lawful request from a public authority. We will challenge requests we believe are unlawful, overbroad, or improper.

4.3 Business Transfers

If NeuEra Apps is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will provide notice in the app and on this Privacy Policy page before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information for other purposes only with your explicit consent.

5. Third-Party Privacy Notices

The providers listed above maintain their own privacy policies:

• Firebase / Google: https://firebase.google.com/support/privacy and https://policies.google.com/privacy
• Twilio: https://www.twilio.com/legal/privacy
• Apple: https://www.apple.com/legal/privacy/
• Stripe: https://stripe.com/privacy
• Fly.io: https://fly.io/legal/privacy-policy

We are not responsible for the privacy practices of these providers; we are responsible for the categories of data we share with them and the purposes of that sharing as described in this Privacy Policy.

6. Permissions Used by the App

Kalum requests only the permissions it needs. Some permissions are required for the calling experience; others are optional and only used by specific features, as described in Section 2.5.

6.1 iOS

Required for calling:

• Microphone — to capture your voice during an active call.
• Background Audio / VoIP — to keep an active call connected when the app is not in the foreground.

Optional, only invoked when you use the corresponding feature:

• Contacts — to import a name and phone number when you tap "Import from contacts".
• Camera — to scan a payment card during credit top-up, if you choose to.
• Photo Library — declared by the Stripe payment SDK; used only if you opt into a flow that requires selecting an image (for example, sharing a screenshot with support).
• Face ID / Touch ID — to authorize a sensitive payment action when you choose biometric confirmation.
• Approximate Location (When-In-Use) — declared by the Stripe payment SDK and only used at the moment of a card payment for card-network fraud-risk checks. Kalum does not track your location.

6.2 Android

Required for calling:

• RECORD_AUDIO, MODIFY_AUDIO_SETTINGS — microphone and audio routing during calls.
• BLUETOOTH, BLUETOOTH_CONNECT — to use Bluetooth headsets and car kits during calls.
• POST_NOTIFICATIONS — to show in-call notifications.
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_MICROPHONE — to keep an active call alive when the app is backgrounded.
• INTERNET — to reach our servers and Twilio's.

Optional, only requested when you use the corresponding feature:

• READ_CONTACTS — to import a name and phone number when you tap "Import from contacts".

Kalum does not request the Android advertising ID (AD_ID), background location, the device camera, photo storage, or unrestricted contacts read.

7. Data Security

7.1 In Transit

• All traffic between your device and our servers uses HTTPS / TLS 1.2+.
• Webhook callbacks from Stripe and Twilio are verified using cryptographic signatures (HMAC-SHA256 / Stripe signature scheme) and replay-window checks.
• App Store server notifications and Apple receipt validations are verified against Apple's signed responses.
• Voice media between your device and Twilio uses Twilio's encrypted media transport.

7.2 At Rest

• Authentication tokens are stored in platform-secured storage (iOS Keychain, Android EncryptedSharedPreferences with AES-256).
• Backend databases are hosted on managed PostgreSQL with encryption at rest and access restricted to operational staff under principle of least privilege.
• We do not store passwords — authentication is delegated to Firebase Authentication.

7.3 Application-Level Controls

• JWT-based authentication with RS256 signature verification on every request.
• Per-user and per-IP rate limiting.
• Device attestation via Firebase App Check.
• Optimistic locking on financial records to prevent race conditions on credit balances.
• Webhook and receipt idempotency to ensure double-charges and duplicate credits cannot be created by replayed events or replayed App Store receipts.

While we strive to use commercially acceptable means to protect your information, no method of transmission over the Internet or electronic storage is 100% secure. If we become aware of a breach affecting your personal information, we will notify you without undue delay and within the timeframes required by applicable law.

8. Your Privacy Rights

The rights available to you depend on where you live. To exercise any right, contact hello@neuera.app. We may verify your identity using the phone number associated with your account and one or more details about recent activity.

We will respond within the timeframes required by applicable law (typically 30 days under GDPR/UK GDPR; up to 45 days under the CCPA, with one extension permitted).

8.1 Rights Available to All Users

• Access: Ask us what personal information we hold about you.
• Correction: Ask us to correct inaccurate personal information.
• Deletion: Ask us to delete your account and personal information. You may also delete your account at any time from Settings → Delete Account inside the Kalum app. Deletion is subject to limited legal exceptions (such as records we are required to keep for tax or anti-fraud purposes).
• Portability: Request a copy of your account information and call/transaction history in a portable format.
• Objection / Restriction: Object to or restrict certain processing.

8.2 EEA, UK, and Swiss Residents (GDPR / UK GDPR)

You also have the right to:

• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority. EEA authorities are listed at edpb.europa.eu; UK residents may complain to the ICO at ico.org.uk.

8.3 California Residents (CCPA / CPRA)

If you are a California resident, you have the rights listed in 8.1, plus:

• Right to know the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purposes, and the categories of third parties with whom we share it.
• Right to non-discrimination for exercising your CCPA rights.
• Right to limit use of sensitive personal information — the only category of "sensitive personal information" Kalum collects is your phone number, used to log you in and to bill calls.

We do not sell your personal information and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA. We have not done so in the preceding twelve months.

8.4 Authorized Agents

You may authorize an agent to make a request on your behalf. We will require written authorization from you and proof of the agent's identity.

9. Data Retention

We keep your information for as long as your account is active and for the periods listed below after account closure.

After the retention periods expire, we either delete the data or de-identify it so it can no longer be linked to you.

10. Children's Privacy

Kalum is intended for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you are a parent or guardian and believe your child under 18 has provided us with personal information, please contact hello@neuera.app and we will take steps to delete that information.

11. International Data Transfers

We are based in the United States, and our service providers operate primarily in the United States and the European Union. Your information may be transferred to, processed in, and stored in countries other than your country of residence.

For transfers from the EEA, the United Kingdom, or Switzerland to countries that are not the subject of an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) put in place by our service providers, together with supplementary technical measures such as encryption in transit and at rest.

By using the Service, you understand that your information will be transferred to the United States and other countries where our service providers operate.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Post the updated policy at legal.neuera.app/kalum/privacy/.
• Update the "Last Updated" date and the version number.
• Maintain the previous version in our public archive at /kalum/privacy/archive.html.
• For material changes, give you advance notice in the app and, where you have provided one, by email.

You are encouraged to review this Privacy Policy periodically. Continued use of the Service after a non-material change takes effect signifies your acceptance of the updated policy.

13. Contact

For privacy questions or to exercise your rights:

We will respond to all privacy-related inquiries within the time required by applicable law and, in any case, no later than 45 days from receipt.

14. Summary

We never collect or have access to:

• Voice call audio
• Card numbers
• Geographic location (Stripe SDK may request it during card payment, but we do not receive it)
• Your full address book (only the contacts you explicitly import)
• Photos beyond what you choose to share with support
• Browsing history
• Advertising identifiers
• Biometric data

Last Updated: October 6, 2026
Version: 2026-10-06
Effective Date: October 6, 2026