Privacy Policy

This Privacy Policy explains what PhoneLess collects, why, and your choices. PhoneLess is operated by [Company legal name], which is responsible for your data. We aim to collect as little as possible.

1. What we collect

• Your card: a first name, the names, phone numbers, and relationships of the contacts you add, an optional short note, and an optional medical note.
• Access details: your phone number, your PIN in a scrambled (hashed) form we cannot reverse, and your recovery email.
• Records of consent: when you agreed to receive texts, accepted these policies, confirmed you are 18 or older, verified your phone number, and, if you added one, consented to storing a medical note.
• Security records: each attempt to open a card, including whether it succeeded, the time, and a scrambled form of the phone number and IP address used. We do not keep readable IP addresses in these records.
• Card+ only, when offered: the shipping address for your physical card, and limited billing details from Stripe, such as the last four digits of your card. We never receive full card numbers.

2. How we use it

To show your card when the correct phone number and PIN are entered, verify your phone number, send you sign-in codes, alert you to lookups and lockouts, protect cards from guessing and abuse, and, for Card+, process payments and ship your card. We do not sell your personal information, share it for advertising, or use it to target ads.

3. Medical notes and other people’s details

A medical note is sensitive health information. We store one only if you add it and give explicit consent at the time, and you can remove it anytime. The contacts on your card are other people’s personal data, and you confirm you may share them. If someone listed on a card asks us to remove their details, we will. [Counsel to confirm GDPR Article 9 and Article 14 handling.]

4. Security

Data is encrypted in transit. Your card contents, contact details, and phone number are encrypted before they are stored. Your PIN is never stored in readable form. Shipping and billing details are kept separately from your emergency card and never appear on it. No system is perfectly secure, and we will notify you of a breach affecting your data as required by law.

5. How long we keep it

• Your card and account: while your account is active. When you delete your account, your card and its contacts are deleted at the same time, and any remaining copies, such as backups, are removed within [30] days.
• Security records: deleted automatically after [90] days.
• Payment records: kept as long as the law requires.

6. Who we share with

Only service providers who help run PhoneLess, under contract and only for that purpose: Supabase (database and sign-in), Vercel (website hosting), Cloudflare (bot protection on the lookup page), Twilio (text messages), Resend (email alerts and sign-in codes), Stripe (payments, for Card+), and [Lob] (printing and mailing physical cards, for Card+). We may disclose information if the law requires it.

7. Text messages (SMS)

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

You give consent to receive texts from PhoneLess by ticking a separate checkbox during setup, which is unchecked by default. We record when you gave consent. Verifying your number by text is how setup confirms the number is yours, so this consent is required to create a card. We text only the number you verified, and only about your own card: a verification code at setup, and security alerts when your card is opened, when someone enters a wrong PIN, and when your card locks. PhoneLess never sends marketing or promotional texts. Your number is shared only with our messaging provider, Twilio, so that it can deliver these messages on our behalf.

Message frequency varies and depends on activity on your own card. Message and data rates may apply. Reply STOP to any text to stop receiving them, or HELP for help. Stopping texts does not close your account: email alerts continue, and your dashboard will show that text alerts are off. You can turn texts back on by replying START.

8. Cookies

We use only the cookies needed to keep you signed in when you manage your card. We do not use advertising or tracking cookies. [Update if analytics are added.]

9. Your rights

Depending on where you live, including under the GDPR and the CCPA/CPRA, you may have the right to access, correct, delete, or export your data, and to withdraw consent. Use your settings or email [privacy@phonelesscard.com]. You may also have the right to complain to a data protection authority.

10. Children

PhoneLess is for adults 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has created a card, contact us and we will delete it.

11. International transfers and changes

Our service providers may process data in the United States and other countries, using appropriate safeguards. We will post changes to this policy here and update the date above. Contact: [privacy@phonelesscard.com].