Legal
Privacy policy
ShadyCall is built to know as little about you as possible. There are no accounts, your IP address is never stored, and we don't sell personal information.
This policy explains how XTO Pty Ltd (ACN 702 801 410) ("ShadyCall", "we") handles information on shadycall.com.
What we collect
- Reports you post: the phone number, your verdict and category, whether it was a call or text, who the caller claimed to be, your message, and optionally your state and a display name. These are published on the site.
- Lookups: that a number was looked up, counted per day. We don't record who looked it up.
- A one-way visitor code: a keyed hash (HMAC) of your IP address, cut short, stored with reports and votes so we can stop floods, duplicates and double votes. It can't be turned back into your IP address. The IP address itself is never stored.
- Contact messages: what you send through the contact form, including your email address if you give it.
- Server logs kept by our hosting provider for security, for a limited time.
What we never collect
No accounts, passwords, phone contacts or call logs, and no "people search" data. We don't look up or publish who owns a number. The scam text checker runs entirely in your browser; the text you paste into it is never sent to us.
Public data we publish
- FTC and FCC complaints: the Federal Trade Commission and the Federal Communications Commission publish consumer complaints about unwanted calls as open data. We show what they publish: the number complained about, dates, the subject, whether it was a robocall or a text, and the consumer's city and state. The agencies publish no names, and neither do we.
- Numbering data: the carrier and rate center each exchange was assigned to, from the North American Numbering Plan Administrator.
Personal information inside reports
Reports are about phone numbers, not people. Please don't include anyone's full name, address or other personal details. Our software masks email addresses, card, bank and Social Security numbers automatically. If a report contains personal information about you, ask us to remove it.
Cookies, analytics and advertising
ShadyCall itself sets no tracking cookies (it remembers your light/dark choice in your browser's local storage). If analytics or advertising are switched on, Google Analytics and Google AdSense may set cookies to measure visits and show ads; see how Google uses information from sites that use its services. You can control ad personalization at adssettings.google.com.
How long we keep things
- Published reports: until they are removed, or the number's page is.
- Reports held back by the spam filter: deleted after 30 days.
- Daily lookup counts: about 13 months.
- Contact messages: as long as needed to deal with them.
Sale and sharing
We don't sell or "share" personal information as those words are used in US state privacy laws, including the California Consumer Privacy Act. Published reports are public by design and are available through our API and feed. We may disclose information if the law requires it.
Your rights
Depending on where you live (for example California, Colorado, Connecticut, Virginia and other states with privacy laws), you may have the right to know what personal information we hold about you, to have it corrected or deleted, and not to be discriminated against for asking. Because we hold so little and have no accounts, we usually can't link a report to you, so tell us which report you mean through the contact form, and we'll respond within the time the law requires.
Children
ShadyCall is not directed at children under 13 and we don't knowingly collect their personal information.
Where information is processed
ShadyCall is operated from Australia, and service providers we use (for example hosting, analytics or advertising) may process information in the United States and other countries.
XTO Pty Ltd (ACN 702 801 410), L1 457 Elizabeth Street, Surry Hills, NSW 2010, Australia.