WhoCaller Privacy Policy

App: WhoCaller – Caller ID, Spam Blocker, Dialer & Messages (Android, package com.rskusum.whocaller)
Developer: RS Apps Studio (www.rsappsstudio.com)
Effective date: 3 October 2026  |  Last updated: 6 October 2026

1. Who we are

WhoCaller is developed and published by RS Apps Studio, India (“RS Apps Studio”, “we”, “us”, “our”). For the personal data described in this policy, RS Apps Studio is the data controller (called “Data Fiduciary” under India’s Digital Personal Data Protection Act, 2023). You can reach us using the details in section 24.

2. What this policy covers

This policy explains what information the WhoCaller Android app (“WhoCaller” or “the app”) and its online services collect, how we use it, who we share it with, how long we keep it, how we protect it and what rights you have. It applies to the app, to WhoCaller’s servers and to pages on www.rsappsstudio.com that are about WhoCaller. It does not cover other apps or websites, even if WhoCaller links to them (for example WhatsApp, your bank, or a government reporting website); please read their own privacy policies.

By installing or using WhoCaller you agree to this policy. If you do not agree, please do not use the app.

3. Our privacy principles

• Phone first. Wherever possible WhoCaller does its work on your phone: contact matching, call history, SMS spam checks, link scanning, scam warnings and number location are all calculated on the device.
• No contact-book upload. Unlike some caller ID apps, WhoCaller does not upload your address book to build a database of other people’s names.
• Your name is yours. Your name is shown to other people only if you switch on “Show my name to people I call” (or similar) in your WhoCaller ID settings.
• Minimum data. We collect only what a feature needs, and features that need extra data are switched off until you turn them on.
• No selling. We do not sell, rent or trade personal data.

4. Information we collect and why

4.1 Information you give us

4.2 Information created when you use WhoCaller’s online features

4.3 Information we do not collect

• We do not upload your contact list.
• We do not upload your call history (call log).
• We do not upload your SMS messages or read them on our servers.
• We do not collect your GPS location. The “location” shown for a number (state, city or country) is worked out on your phone from the number itself.
• We do not receive your card or bank details when you pay; Google Play handles payments.
• We do not record or store video calls.
• We do not receive your call recordings; they are saved only on your phone.

5. Information that stays on your phone

WhoCaller needs to read some private information to work as your phone, caller ID and SMS app. This information is processed only on your device and is not sent to us:

• Contacts – to show the names you saved, recognise your contacts on incoming calls, and offer people to chat or video call.
• Call log – to show Recents, missed-call counts, the automatic spam check and history in number details.
• SMS and MMS – to show, send and receive messages when WhoCaller is your SMS app, to sort spam into a Spam folder, to scan links, to explain scam messages, and for OTP Shield (see 6.8).
• Blocked numbers and blocking rules – your block list, blocked series (for example 140 or 0303) and settings.
• Chat history – your decrypted chats are stored only in WhoCaller’s private storage on your phone.
• Video call history – the Video tab list is stored only on your phone.
• Call recordings – saved only in WhoCaller’s private storage on your phone.
• Family Guard list – the family members you add are stored on your phone.
• Search history, profile details, theme and app settings.

Uninstalling WhoCaller, or clearing its storage in Android settings, removes this on-device data. Android’s own call log, contacts and SMS store are not deleted by WhoCaller.

6. Feature-by-feature details

6.1 Caller ID and spam detection

When a call or message comes from a number that is not in your contacts, WhoCaller checks it against data on your phone (a downloaded spam list, your blocked numbers and rules, and national number-series rules) and may ask our servers about that number. The server answer can include a name, business information, a spam category, the number of user reports and the current operator. Results are cached on your phone for a while to save data and time.

6.2 Blocking and the automatic spam check

If you give permission, WhoCaller checks the call history and messages on your phone once a day for spam and telemarketing numbers, blocks those numbers automatically and lists unknown numbers for you to review. Nothing from this check is uploaded. You can unblock any number at any time. Advanced rules (blocking international calls or a number series) work on your phone too.

6.3 Your WhoCaller ID

Your verified WhoCaller ID links your account to your mobile number. If you choose to show your name, other WhoCaller users see that name when you call them or when they search your number, with a blue tick to show the number was verified by its owner. You can hide your name or delete your WhoCaller ID at any time.

6.4 WhoCaller chat (end-to-end encrypted)

• Each phone creates its own encryption keys. The private key never leaves your phone and is protected by the Android Keystore. Only the public key is uploaded.
• Messages are encrypted on the sender’s phone. Our servers only store the encrypted message, the sender’s account ID and the time, until the receiving phone downloads it; then it is deleted from the server. Delivery and read ticks are handled the same way.
• To show a notification even when WhoCaller is closed, the encrypted message is also carried inside the push notification; only your phone can decrypt it.
• We cannot read your messages and cannot hand them to anyone.
• Blocking stops a person from sending you messages. Reporting sends us the last five messages that person sent you, decrypted on your phone, together with their account ID, so we can review abuse. This happens only when you tap Report.
• Contact requests (“Ask who this is”) use the same encrypted chat. Your name and number are shared with the other person only if you tap “Share my name”.
• WhoCaller Support is different: the support assistant answers on your phone, and questions it could not answer (without your name or account) help us add better answers. If you choose “Talk to a person”, your support messages, any screenshots you attach, your earlier questions to the assistant, your WhoCaller name and number, and your app version, phone model, Android version and language are stored on our servers (encrypted in transit and at rest, not end-to-end) so that only you and the WhoCaller support team can read them. Before the first support chat you accept the chat terms: support chats (with Riva, the WhoCaller assistant, and with the team) are stored and may be reviewed for quality and training, to improve answers and the service. Support never uses voice or video calls.

6.5 WhoCaller video calls

• Video and voice are encrypted by the WebRTC standard (DTLS-SRTP) between the phones in the call.
• Calls travel directly phone-to-phone where possible. If a network blocks that, encrypted data passes through a relay (TURN) server, which cannot see the video or hear the voice. Network-discovery (STUN) servers may see your phone’s IP address, as with any internet call.
• Our servers hold the call set-up record listed in 4.2 only while the call is being connected and running; the app deletes it a few seconds after the call ends. The video and audio never reach our servers and are never recorded by WhoCaller.
• Group video calls (up to four people) connect each pair of phones separately, with the same encryption.
• When you use video calls, WhoCaller uses your camera and microphone only during the call.
• Separately, we keep a minimal record of WhoCaller video calls and chats – who contacted whom, when, whether a call was answered and how long it lasted – for 180 days, only to respond to lawful requests (see 4.2 and 12).
• If “Show when I’m on a call” is on, other WhoCaller users can see whether you are on a call (not with whom). You can turn this off in More.

6.6 Who searched for me and Incognito mode

See 4.2. Only you can read who searched for you. You can clear the list at any time. With Incognito mode on, your own searches leave no note for other users.

6.7 Family Guard

Family Guard is something you switch on for your own phone by adding trusted family members. If your phone gets a call from a reported scam number, an OTP during a call with an unknown number, or a screen-sharing app is installed around such a call, WhoCaller sends those family members a short alert through end-to-end encrypted chat (for example “got an OTP during a call with an unknown number”, with the caller’s name or number). Your family members can’t see your calls, messages or location. You can remove them at any time.

6.8 Scam Shield (OTP Shield, screen-share guard, link scanner, scam explainer, UPI QR check)

• OTP Shield looks at incoming SMS on your phone only to recognise a one-time password (OTP) that arrives while you are on a call with an unknown number, or just after. It then shows a warning. The SMS and the code are not sent to us.
• Screen-share guard checks on your phone whether known remote-control apps (such as AnyDesk or TeamViewer) are installed or get installed around a call from an unknown number, and warns you. We do not receive a list of your apps.
• Dangerous link scanner and scam explainer work on your phone using built-in rules; links and messages are not uploaded.
• UPI QR check uses Google Play services’ code scanner. WhoCaller only receives the text inside the QR code to explain it, and does not keep it.
• Senior mode uses your phone’s text-to-speech to read warnings aloud.

6.9 Phone (dialer), SMS app and call screen

If you make WhoCaller your default phone app and/or SMS app, it handles your calls and messages like any phone or messaging app: placing and receiving calls, showing the in-call screen, storing and sending SMS through your mobile operator, and showing notifications. This happens on your phone; calls and SMS go through your mobile operator, not through WhoCaller’s servers.

6.10 Ghost call

A Ghost call is a pretend incoming call that you schedule. Nothing is dialled and nothing is sent to us.

6.11 Invites

When you invite someone, WhoCaller opens WhatsApp or your SMS app with a ready-made invite and picture. You decide whether to send it. We do not store the people you invite.

7. Android permissions we ask for

Android asks you before WhoCaller can use these. You can refuse or withdraw most of them in Android settings; the related feature will then stop working.

8. Where caller ID information comes from

Names and spam information shown by WhoCaller come from these sources only:

1. Names that WhoCaller users publish themselves for their own verified number.
2. Reports from WhoCaller users (spam category and number of reports; the identity of reporters is never shown).
3. Public and official sources, such as government and regulator data (for example official helpline numbers, and public complaint data published by the US FCC and FTC), and openly licensed business directories (for example OpenStreetMap and Wikidata).
4. National number-series rules, such as India’s 140 (telemarketing) and 1600 (banks and financial services) series and Brazil’s 0303 (telemarketing) prefix.
5. Offline numbering data on your phone for the location and original operator of a number.

WhoCaller does not build its database from users’ address books.

9. Why we are allowed to process your data

• Your consent – for example verifying and publishing your name, permissions you grant, the automatic spam check, Family Guard, analytics and crash reports (if you switch them on). You can withdraw consent at any time; this does not affect processing already done.
• To provide the service you asked for (contract) – for example your account, chat, video calls, Premium.
• Legitimate interests – protecting users from spam, scams and fraud, keeping the service secure, preventing abuse and improving the app, balanced against your rights.
• Legal obligations – where a law requires us to keep or disclose information.

Under India’s Digital Personal Data Protection Act, 2023, we process personal data on the basis of your consent or for legitimate uses permitted by that Act.

10. Who we share data with

We do not sell personal data. We share it only as follows:

• Other WhoCaller users – your published name, verified tick, operator and Premium crown (if you have them); spam categories and report counts for numbers; “Who searched for me” notes (not in Incognito); and whatever you send in chat or video calls.
• Service providers who work for us, under contracts that require them to protect the data:
  • Google Firebase / Google Cloud – sign-in (Firebase Authentication), database (Cloud Firestore), server code (Cloud Functions), push notifications (Firebase Cloud Messaging), app protection (App Check), and – only if you switch them on – Analytics and Crashlytics.
  • Google Play services – payments (Google Play Billing), Play Integrity, in-app updates and reviews, install referrer, sign-in with Google, and the QR code scanner.
  • Network servers for video calls – STUN servers (for example Google’s public STUN servers) and TURN relay servers, which see technical connection data such as IP addresses but not the encrypted video or voice.
• WhatsApp, your SMS app or other apps – only when you choose to open them from WhoCaller (for example to send an invite or open a WhatsApp chat).
• Authorities – when required by law, court order or valid government request, or to protect the safety of a person, our users or the public. Only the minimal call and chat records (who contacted whom, when, call answered and duration) can be provided; because chats are end-to-end encrypted and calls are never recorded, we cannot provide message content, video or voice.
• Business transfer – if RS Apps Studio is merged or sold, data may pass to the new owner, who must keep this policy’s promises or tell you first.

11. Where your data is stored

Our servers are provided by Google Cloud / Firebase. Server code runs in Google’s Mumbai, India region where possible, but Google may store or process data in other countries where it operates. When data leaves your country, we rely on the protections required by the applicable law (for example standard contractual clauses for the European Economic Area and the UK).

12. How long we keep data

13. How we protect your data

• All connections between the app and our servers use encryption (HTTPS/TLS).
• Chats are end-to-end encrypted (HPKE: X25519, ChaCha20-Poly1305, using Google Tink). Video calls use DTLS-SRTP encryption.
• Secret keys are protected by the Android Keystore on your phone.
• Strict server access rules make sure each user can only read and change what belongs to them.
• Google Play Integrity and Firebase App Check help block fake and modified apps.
• Access to server data is limited to the developer, and only for running and protecting the service.

No system is 100% secure. If a data breach affects you, we will notify you and the relevant authorities as the law requires (for example the Data Protection Board of India).

14. Your rights and choices

Depending on where you live, you have the right to:

• Access – ask for a summary or a copy of the personal data we hold about you.
• Correction – correct or update inaccurate data (most of it you can edit in the app).
• Deletion / erasure – ask us to delete your account and data (see section 15).
• Withdraw consent – for example hide your name, turn off the automatic spam check, Family Guard, analytics or crash reports, or revoke Android permissions.
• Object or restrict – object to processing based on legitimate interests, or ask us to restrict it.
• Data portability – receive your data in a commonly used format.
• Grievance redressal – complain to our Grievance Officer (section 24), and, if not satisfied, to your data protection authority.
• Nominate (India) – nominate another person to exercise your rights in case of death or incapacity.
• Not be discriminated against for using your privacy rights.

In-app choices: Show or hide your name to callers · Incognito mode · Analytics and crash reports (off by default) · Search history on/off · Spam protection settings · Automatic spam check · Family Guard members · Block or unblock numbers · Delete account.

To use a right that isn’t available in the app, email us from the email address of your WhoCaller account (or tell us your verified number). We may ask you to prove the account is yours. We reply within 30 days (or sooner where the law requires).

15. Deleting your account and data

In the app: open WhoCaller > Settings > Privacy > Delete account and fill in the short request form (the reason you are leaving, optional comments and an optional email for the confirmation), then tick that you understand the deletion is permanent and send it. Your reason helps us improve WhoCaller.

We then permanently delete, within 7 days of your request:

• your sign-in account;
• your WhoCaller ID (name, verified number, operator and Premium crown);
• the spam reports you made;
• your push notification address and chat public key;
• chat messages and receipts waiting for you on the server, and your chat block list;
• your “Who searched for me” notes, and the notes you left on other users’ lists;
• any video call set-up records and group call memberships still linked to you.

The minimal call and chat records described in 4.2 are kept until their 180-day period ends, so that lawful requests (for example a police complaint) can still be answered, and are then deleted automatically.

Until the deletion is done you can keep using WhoCaller, see that your request is pending, and withdraw it from the same screen. After deletion we keep only a minimal record (an internal account ID, the dates and the reason you picked, without your name, number, email or comments) to show that your request was completed and to understand why people leave.

Data on your phone (chats, recordings, history, settings) is removed when you clear WhoCaller’s storage or uninstall the app. Messages you already sent remain on the phones of the people you sent them to. An active Premium subscription is managed by Google Play: cancel it in the Play Store > Payments & subscriptions, because deleting your account does not cancel billing.

Without the app: email us at the address in section 24 with the subject “Delete my WhoCaller account” from your account email, or include your verified number. We will verify the request and delete your data within 7 days.

16. Removing your number or name from WhoCaller

If you are not a WhoCaller user and want your number’s name or spam information removed or corrected (for example if your number was wrongly reported as spam, or a business listing is wrong), email us with the number and the reason. We will check the request and, where appropriate, remove or correct the information within 30 days. If you are a WhoCaller user, you can hide your own name in the app at any time.

17. Children

WhoCaller is not meant for children. You must be at least 13 years old to use WhoCaller (or older if your country requires it). In India, users under 18 may use WhoCaller only with the verifiable consent of a parent or lawful guardian, as required by the Digital Personal Data Protection Act, 2023. We do not knowingly collect data from children without such consent; if you believe a child has given us personal data, contact us and we will delete it. We do not track children or show them targeted advertising.

18. Call recording: your responsibility

Call recording is a Premium feature that starts only when you press Record. Recordings are saved only on your phone. Laws on recording calls differ between countries and states; in many places you must tell the other person, or get their consent, before recording. You are responsible for following the law where you and the other person are. WhoCaller shows a reminder before your first recording.

19. Purchases and WhoCaller Premium

Premium is sold through Google Play Billing. Google processes your payment; we never see your card, UPI or bank details. We receive a purchase confirmation (which product, its status and a purchase token) so the app can unlock Premium and show your Premium crown. Refunds and cancellations follow Google Play’s policies. Google’s privacy policy applies to your payment: policies.google.com/privacy.

20. Advertising

WhoCaller currently shows no advertisements. If we add ads in the future (for example through Google AdMob for free users), we will update this policy first, ask for any consent the law requires, and explain how to limit ad personalisation. We will never use your contacts, call history, SMS or chats for advertising.

21. Analytics and crash reports

Usage analytics (Firebase Analytics) and crash reports (Firebase Crashlytics) are off by default. If you switch them on in Settings > Privacy, the app sends information such as which screens and features are used, app and device information, and crash details, to help us fix problems and improve WhoCaller. They do not include your contacts, call history, SMS or chat content. You can switch them off at any time.

22. Country-specific information

India

We process personal data under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its rules. You may contact our Grievance Officer (section 24); if your grievance is not resolved, you may approach the Data Protection Board of India. Scam-help features point you to official services such as the 1930 cyber-fraud helpline, cybercrime.gov.in and Chakshu (Sanchar Saathi); those are run by the Government of India, not by WhoCaller.

European Economic Area, United Kingdom and Switzerland

You have the rights described in section 14 under the GDPR / UK GDPR, including the right to complain to your local data protection authority. Our legal bases are described in section 9.

United States (including California)

We do not sell personal information and do not “share” it for cross-context behavioural advertising. California residents may request to know, delete and correct their personal information and will not be discriminated against for doing so. We honour these requests as described in section 14.

Brazil

Under the Lei Geral de Proteção de Dados (LGPD), you can confirm whether we process your data, access, correct, anonymise, delete or port it, learn who we share it with, and withdraw consent, by contacting us (section 24). You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

Indonesia

Under Law No. 27 of 2022 on Personal Data Protection, you have the right to information, access, correction, deletion, withdrawal of consent and objection, which you can exercise by contacting us (section 24).

Other countries

We respect the privacy laws of the countries where WhoCaller is offered. Contact us to use any right your local law gives you.

23. Changes to this policy

We may update this policy when WhoCaller changes or when laws change. The “Last updated” date at the top will change. If a change is important (for example a new type of data or a new use), we will tell you in the app before it takes effect and, where the law requires, ask for your consent again. Older versions are available on request.

24. Contact us and grievance officer

RS Apps Studio, India
Website: www.rsappsstudio.com
Email (privacy, data requests and grievances): rskusum@rsappsstudio.com

Grievance Officer (Digital Personal Data Protection Act, 2023 and Information Technology Rules, 2011): Grievance Officer, RS Apps Studio – email rskusum@rsappsstudio.com. We acknowledge grievances within 72 hours and aim to resolve them within 30 days.

In the app you can also use More > Chat with WhoCaller support.

© 2026 RS Apps Studio. WhoCaller is not affiliated with Truecaller, Google, WhatsApp, or any bank, payment app or government body named in the app or on this page.