Call Me Awake Start free

DRAFT — founder/legal review. This page was drafted from our specifications and has not been reviewed by a lawyer. Text in [square brackets] is still to be filled in or confirmed.

Privacy policy

Draft of 2026-10-05.

This policy explains what Call Me Awake collects when you use our website, apps and API, why, who helps us, how long we keep it, and what you can do about it. Call Me Awake is operated by [operator legal name and postal address]. You can reach us at staging@callmeawake.com.

What we collect, and why

  • Your email address and name. To sign you in (we email you a code, or you use Sign in with Apple or Google), to send the messages you ask for, and to greet you by the name you choose on calls.
  • Phone numbers. The numbers you add, so we can call and text you. Each number is verified with a code by text message before we call it. The number whose verification started your free trial is also remembered as a keyed hash, so that one number gets one free trial (see "How long we keep things").
  • Your wake-up calls. The times, places (time zones), repeat rules and notes you set, and a record of each call we placed and how it ended (answered, confirmed, not answered). We never record the audio of a call.
  • Time zone reports. When your phone or browser tells us which time zone it is in, so we can ask whether to move a call. We keep only the most recent 30.
  • Device and push details. A push notification token and the platform, so we can send the backup notification and cancel the backup alarm.
  • Billing records. Your plan, call credits and usage. Card payments are handled by Stripe; we never see or store your card number.
  • Demo calls. If you try a demo call without an account, the number you entered and your IP address, to check codes and limit abuse.
  • API keys and connections. Keys are stored only as a hash, with a short prefix so you can recognise them. We record which assistant or app you connected through OAuth.
  • Technical logs. Standard server logs and error reports to keep the service running. We configure our logging and error monitoring so they do not capture the contents of requests, and we avoid keeping phone numbers in them.

We do not show ads, we do not sell or rent your data, and we do not put marketing in calls. The legal basis for handling your data in the EU and UK is that it is necessary to provide the service you asked for (contract) [counsel: confirm bases for fraud and abuse prevention and for legal obligations].

Cookies and tracking

The public pages of this site set no cookies and run no analytics or third-party trackers, so there is no cookie banner. When you sign in, or start a demo call, we set the cookies that keep you signed in (or remember your demo for the next steps) and protect forms from forgery. They are strictly necessary and are not used to track you. [If privacy-friendly analytics is added later, this section will change first.]

Phone numbers we keep after a STOP, a complaint or a block

If a phone number texts STOP to us, is reported as a complaint, or is blocked by our staff, we keep that number in plain text on a do-not-contact list, with no link to any account, even after the account is deleted. We must remember the number to honour the request: if we forgot it, anyone could add it again and we would call or text it. The list is used for nothing else. A block that is later lifted (the person texted START, our staff lifted it, or, for a press 9 on a demo call, the number's owner verified it on an account) is deleted two years after it was lifted. A block that is still in force is kept for as long as it is in force. If you want a number removed from the list sooner, write to us from or about that number and we will look at it. [Counsel: confirm the retention period and the lawful basis for this list.]

How long we keep things

What How long
Your account, numbers, calls and settings Until you delete your account.
An account that was created but never signed in Deleted after 7 days.
Deleted account: email, name, home time zone, phone numbers, sign-in identities and queued notifications Erased immediately when you delete, except the keyed hash of the number that started your free trial (next row).
Deleted account: the number that started its free trial Kept for 2 years as a keyed one-way code with no link to any account; we can only check whether a number matches it. This is so the same number does not get a second free trial. Then deleted.
Deleted account: API keys and devices API keys are revoked immediately and a device's time zone and push token are cleared; the rows are removed within 30 days.
Deleted account: everything else in your account Removed within 30 days.
Records of calls and call attempts 13 months.
Time zone reports per device The last 30.
Demo call number and IP address IP address: 30 days. The number: 30 days, except that a number whose holder pressed 9 on the demo call stays on our do-not-call list, like a STOP, until its owner adds it to an account and verifies it with a code.
Payment and call-provider messages (the notices Stripe, RevenueCat and Twilio send our server about your subscription, your calls and your texts) The content is emptied when you delete your account, or 30 days after we receive it at the latest. We keep only the message's identifier, so that a message sent to us twice is acted on once.
Billing records (plan, credits, usage) 7 years [counsel: confirm the legal basis for this period], kept without your name or email once your account is deleted and purged after the 7 years.
Numbers on the do-not-contact list (STOP, complaint, staff block) While the block is in force, and for 2 years after it is lifted. They stay after account deletion.
Sign-in and deletion codes Valid for 10 minutes and not reusable.

Our providers keep their own records under their own policies (for example, Twilio's call logs contain phone numbers). We do not export those logs.

Who processes your data for us

  • Twilio: places calls, sends and receives text messages, verifies phone numbers.
  • Amazon Polly (through Twilio): turns the words of a call into the spoken voice. It receives the text of the call, which can include your name and the time and place you set.
  • Stripe: card payments and billing portal.
  • Apple: Sign in with Apple, and push notifications to iPhones through the Apple Push Notification service.
  • Google: Sign in with Google.
  • Opalstack: hosting of the servers and the database, and the outgoing email service. [Confirm the data centre location.]
  • When in-app purchase is offered in the mobile app: Apple, Google and RevenueCat process the purchase records. [Confirm when M7 ships.]

We have data processing agreements with Twilio, Stripe and Apple. [Counsel: confirm each agreement is signed and add the transfer mechanism for data that leaves the UK or EU.]

Your rights

  • Get a copy. Settings has a data export that downloads everything we hold about you as JSON.
  • Delete it. Delete your account in the app or on the web: see how to delete your account.
  • Correct it. Change your name, numbers and time zone in Settings, or write to us.
  • Object or complain. Under the GDPR and UK GDPR you can ask us to restrict or stop using your data, and complain to your data protection authority. We would like the chance to fix it first.

Children

Call Me Awake is for people aged 16 and over. We do not knowingly collect data from younger children.

Changes

If we change this policy in a way that matters, we will tell signed-in users by email before it takes effect.

See also the calls policy and the terms of service.