• English
• Русский

Callmar Privacy Policy

Last updated: August 4, 2026

This Privacy Policy describes how Callmar ("Callmar", "we", "us") handles information when you use the Callmar iOS app or visit callmar.online. Callmar is a professional SIP/VoIP softphone that connects to SIP accounts provided by you or your employer. The app is built with privacy as a primary design goal.

1. Data We Access On Your Device

The following data is processed locally on your device. None of it is uploaded to Callmar servers, except the upstream SIP credentials of an account you explicitly enable for 24/7 background calls — see §2.6.

2. Data We Transmit Off Your Device

The only situations in which data leaves your device are:

2.1 SIP traffic to your SIP provider

To make calls, the app sends SIP signalling and audio (RTP) to the SIP server that you configure. Signalling is sent over TLS when you select transport "TLS" (port 5061). Audio is encrypted with SRTP when your provider supports it.

2.2 Callmar Push Proxy (optional, enabled by default)

To receive incoming calls while the app is in the background, SIP signalling is routed through sip.callmar.online. The proxy only forwards SIP messages and does not decrypt your audio. For ordinary push routing the only registration data the proxy handles is your phone number / SIP AoR.

You can disable the push proxy in Settings; when disabled, incoming calls only work while the app is in the foreground.

2.3 Apple Push Notification service (APNs)

When an incoming call arrives while the app is suspended, the push proxy instructs Apple APNs to send a VoIP push to your device. The push payload contains the caller's phone number so Callmar can display it on the CallKit screen.

2.6 Server-side SIP registration (only for accounts you enable)

Some SIP providers stop sending calls if the app has not re-registered recently, so a backgrounded phone can miss calls after a while. To keep calls arriving for 12+ hours in the background, you can let the relay hold the SIP registration on your behalf. When you enable this for an account:

• The app sends that account's upstream SIP username, password, and AoR (and the APNs VoIP token) to the relay over TLS.
• The password is stored encrypted at rest (AES-256-GCM); the only cleartext copy lives in the relay's RAM (tmpfs) and is never written to a persistent disk. We use it solely to register to your SIP provider for you.
• Before enrollment the relay verifies the request comes from a genuine, unmodified copy of the Callmar app using Apple's App Attest (an anonymous anti-fraud check that contains no hardware identifiers).
• Your StoreKit originalTransactionId is sent so the relay can confirm an active subscription.

This is off unless you turn on the push relay for an account in a supported region. You can remove the stored credentials at any time by disabling the relay for the account, deleting the account, or emailing [email protected]. We do not store your call audio, recordings, transcripts, or summaries on the relay — only the registration data above.

2.4 Optional Webhook (user-configured)

If you configure a webhook URL in Settings, Callmar sends call metadata (phone number, direction, duration, transcript) to that URL when a call ends. This URL is set by you; Callmar has no visibility into it.

2.5 Apple App Store / StoreKit (subscriptions)

Callmar offers an auto-renewable subscription ("Callmar Pro") with a 14-day free trial. All subscription purchases, renewals, and trial management are handled by Apple's App Store. Specifically:

• We use StoreKit 2 to fetch product information, initiate purchases, and verify entitlement. Apple's servers receive your purchase request, process payment via your Apple ID, and return a signed transaction back to the app.
• Callmar never sees your Apple ID, payment method, billing address, or any other Apple account detail. We only see the cryptographically signed transaction (product ID, original purchase date, expiration date) that Apple issues.
• Subscription state is verified on-device by the iOS StoreKit framework. If you enable server-side SIP registration (§2.6), the app also sends the subscription's originalTransactionId to the relay so it can confirm an active subscription before registering on your behalf; we never receive your payment details or Apple ID.
• You can review, change, or cancel your subscription at any time: Settings (iOS) → your Apple ID → Subscriptions, or directly from the Manage Subscription link inside Callmar (Settings → Subscription → Manage Subscription).
• For Apple's own privacy practices regarding App Store purchases, see <https://www.apple.com/legal/privacy/data/en/app-store/>.

2.7 Anonymous activation funnel (self-hosted)

To understand where new users get stuck during setup (so we can improve onboarding), Callmar records a small number of anonymous product-interaction events — for example: app opened, an onboarding step completed or skipped, a SIP account saved, SIP registration succeeded or failed, a call was attempted, blocked, started, failed to start, connected, or ended, the subscription screen was shown and became ready or unavailable, and a user-initiated purchase or restore completed with a coarse outcome (such as activated, pending, cancelled, failed, or no active subscription).

• Events are sent to our own server (callmar.online/events), not to any third-party analytics, advertising, or attribution provider.
• The only persistent analytics identifier is a random ID generated on your device when you first open the app. It is not your advertising identifier (IDFA), not the device vendor identifier (IDFV), and is not linked to your Apple ID, phone number, contacts, recordings, or SIP credentials. It exists only to count distinct installs in the funnel and is reset if you reinstall the app. Each event and user-initiated operation also receives a fresh random UUID for delivery de-duplication and short-lived flow correlation; those UUIDs are not persistent user or device identifiers.
• The payload carries the event name, timestamp, app version/build, platform, distribution, and strictly coarse categorical properties. Examples include call direction, a duration range, a SIP response code, paywall origin, requested monthly/yearly plan, and typed purchase/restore result. It contains no phone numbers, names, SIP accounts or credentials, StoreKit product or transaction IDs, prices, raw errors, message content, recordings, or transcripts.
• When you accept and save a tagged in-app QR code or import link, an optional fixed coarse provisioning-channel label (for example a pilot or owned-site channel) may be attached to later funnel events for that anonymous install. It does not identify a SIP provider, customer, campaign, or click, and it is not App Store or advertising attribution.
• This data is not used to track you across other apps or websites.
• Debug and TestFlight builds do not send these events — only App Store installs do.
• App Store builds first place each pending event in a bounded local outbox (at most 200 events). Items older than seven days are discarded the next time the app processes that queue; if the app remains unopened, its dormant queue file may remain until that next processing. Items are also removed after successful delivery or dropped after the retry limit or a permanent server rejection. Telemetry never blocks a call, purchase, or other app action.

2.8 Optional Contact Support chat

Settings → Contact Support lets you message our support team directly from the app, and optionally attach screenshots or your on-device diagnostic log to help us understand an issue.

• Nothing is sent until you type a message and tap Send. Attaching a screenshot or the diagnostic log is your choice — the diagnostic-log toggle can be switched off before sending.
• Your message, any screenshots (up to 3, resized/compressed on your device), and the diagnostic log (already redacted — see below) are sent to our own server, which forwards them to a private support channel we operate on Telegram. Replies from our support team come back the same way and appear in the app; when you have allowed notifications, we also send an alert push so you know a reply is waiting.
• The diagnostic log is the same on-screen event log available in Settings → Diagnostics — recent app activity such as registration and call-state events. It is redacted before it is ever written to the log (phone numbers and SIP addresses are stripped) and never includes call audio, recordings, transcripts, or contacts.
• You are identified only by a second random per-install ID, generated separately from the activation-funnel ID in §2.7, so the two features cannot be correlated. There is no login or account. If you allow notifications, the same install ID is paired with your device's APNs token on our server solely so we can deliver a support-reply alert; the token is not shared with Telegram or any third party.
• If our support backend is briefly unreachable, the screen shows "Support Chat Unavailable" instead of sending anything.

2A. What we declare on the App Store privacy card

The App Store shows a short "App Privacy" card next to every app, based on the developer's submission to Apple. Apple's official definition of "collected data" is data that leaves your device and is held by us (or by partners we work with) for longer than is needed to fulfil a real-time request. Data that is processed only on your iPhone, or that is routed by you to a destination you configured, is not counted as collection.

By that definition, Callmar declares these data types on the App Store privacy card:

We deliberately do not declare contacts, audio recordings, transcripts, AI summaries, location, health/finance/sensitive data, browsing or search history, or any of the other categories Apple lists. The reasons:

• Contacts — read on-device only via CNContactStore. Never sent to a Callmar server.
• Audio recordings — saved to your device only, encrypted with NSFileProtectionComplete. Never uploaded.
• Transcripts and AI summaries — generated on your device via WhisperKit and Apple Foundation Models. If you configure a CRM webhook (Bitrix24 / amoCRM / Alfa CRM / a custom URL), the transcript is delivered to the endpoint you chose; Callmar acts only as a routing helper. Under Apple's definition, user-routed data of this kind is not the app developer's collection.
• App Attest — when you enable §2.6, the relay verifies the request with Apple's App Attest. Apple designs these attestations to be anonymous with no hardware identifiers, used only for fraud prevention, so it is exempt from disclosure and not declared as an identifier.
• Ad data / location / health / financial data — the app does not request, generate, or send any of these.

You can independently verify this card on the App Store ("App Privacy" section of the Callmar listing) or via Apple's documentation at <https://developer.apple.com/app-store/app-privacy-details/>.

3. Call Recording and Transcription

• Recording is OFF by default. You must explicitly enable it in Settings and acknowledge a legal consent screen.
• You are solely responsible for complying with applicable call-recording laws in your jurisdiction and the other party's jurisdiction. Some regions (e.g. EU/GDPR, US states of California, Florida, Massachusetts, Washington, Illinois, Maryland, Pennsylvania, Montana, New Hampshire, Nevada) require consent from all parties; in some countries, recording without consent is a criminal offence.
• Callmar is not responsible for any legal consequences arising from recordings that you make.
• Recordings are stored on your device only. We do not upload, back up, monitor, or access them.
• Transcription is performed entirely on-device, using Apple's on-device Speech framework by default on iOS 26+ (for supported languages) or WhisperKit (Apple Core ML) otherwise. No cloud service is involved in transcription.
• You can delete individual recordings or all recordings at any time in Settings → Storage.

4. Third-Party Services

Callmar does not integrate any third-party analytics, tracking, or advertising SDKs. The anonymous activation analytics described in §2.7 are first-party — collected by our own server with no SDK and shared with no one. The only third-party code included is:

• WhisperKit — on-device speech recognition. No network calls.
• KeychainAccess — Keychain wrapper. No network calls.
• PJSIP and OpenSSL — SIP/TLS/SRTP libraries. Talk only to the SIP provider you configure and to sip.callmar.online (if push proxy enabled).
• Telegram Bot API — only if you use the optional Contact Support chat (§2.8). Our server forwards your message and any attachments you choose to send to a private Telegram channel operated by us, so our support team can reply. Telegram is not used anywhere else in the app and never receives call audio, recordings, transcripts, or contacts.

5. Tracking

Callmar does not track you across apps or websites. We do not collect an advertising identifier.

5A. Website Analytics (callmar.online)

This section is about our website, not the app.

We count visits to callmar.online with GoatCounter, which runs on our own server rather than at a third-party analytics company. It sets no cookies and stores no IP addresses. Each visit records the page, the site that linked to it, the browser and operating system family, the country, the screen width and the browser language — enough to tell which guides are worth writing, and not enough to identify you. Because nothing is stored on your device, this needs no consent banner and applies to every visitor.

Requests that identify themselves as bots or crawlers are kept separately, with their user-agent string, for 30 days, and are excluded from the statistics.

Separately, and only if you accept cookies, we also use Google Analytics 4 to measure which pages are useful and which channels send visitors. Google sets the ga and gid cookies on your device. Those cookies identify your browser across visits to callmar.online; they are not used for advertising and we do not turn on Google Signals or ad personalization. Google LLC processes this data as our processor under the EU–US Data Privacy Framework. You can decline the banner and keep browsing: GoatCounter counting continues either way, and no Google code is loaded until you accept.

6. Data Retention

• Data you create (recordings, transcripts, call history) stays on your device until you delete it or uninstall the app.
• Ordinary push proxy registration state is kept on the server only while the app is actively registered; it is erased when the registration expires.
• For accounts you enable for 24/7 background calls (§2.6), the encrypted SIP credentials are retained on the relay until you disable the relay for that account, delete the account, or request deletion. They are then removed from the encrypted store and the in-RAM copy.
• Anonymous funnel events (§2.7) are retained on our self-hosted server. Because the install ID is random and not linked to any other identifier, we cannot look up or delete a specific install's events on request; reinstalling the app starts a fresh, unrelated ID.
• Pending funnel delivery is retained on-device only in the bounded outbox described in §2.7 (maximum 200 events; entries older than seven days are discarded the next time the app processes the queue).
• Contact Support conversations (§2.8) are retained on our server and in Telegram for as long as needed to resolve your request, and afterwards for a reasonable support-history period. You can request deletion at [email protected] — include the approximate date you contacted support, since we have no login to look you up by.
• Webhook deliveries depend on your webhook provider's retention policy.

7. Children

Callmar is not directed at children under 13. We do not knowingly collect any personal data from children.

8. Your Rights

Because Callmar stores your data on your device, you have full control:

• Access / Portability: your data is in the app's local database and Documents/Recordings folder, accessible via iOS Files.
• Erasure: delete individual items in the app, or uninstall the app to remove everything. For credentials held by the relay for 24/7 background calls (§2.6), disable the relay for the account or delete the account to remove them server-side.
• Restriction: disable recording, transcription, webhook, or the push proxy at any time in Settings. Simply don't use Settings → Contact Support if you'd rather not send us a message, screenshot, or log.

For the push proxy, you can request deletion of any residual SIP registration state at [email protected].

9. Security

• SIP credentials and webhook secrets are stored in the iOS Keychain.
• For accounts you enable for 24/7 background calls (§2.6), the upstream SIP password held by the relay is encrypted at rest with AES-256-GCM; the only cleartext copy lives in server RAM (tmpfs) and is never written to persistent disk. Enrollment is gated by Apple App Attest (genuine-app verification).
• Call recordings are protected with NSFileProtectionComplete — they cannot be read when the device is locked.
• The push proxy terminates TLS using a Let's Encrypt certificate rotated automatically every 60 days.

10. Changes

We may update this policy to reflect new features or legal requirements. Changes are announced in-app and take effect on the "Last updated" date.

11. Contact

[email protected]