Privacy Policy

Callmata is a private family video-calling service. This policy explains how we collect, use, and protect your information.

Who we are

Callmata lets a family set up a private calling space, enter with a name and PIN, and ring each other for browser-based video calls. It is intended for use by families and caregivers — not as a public social network.

What we collect

We collect and store only what is needed to run the service:

• Family information — your family code, family display name, and member display names.
• Contact details — phone numbers you provide for members (including the head-of-household recovery number), so we can send verification codes and call alerts.
• Member credentials— member PINs used to enter your family's space.
• Call room details — the private Daily video room associated with your family.
• Push subscriptions — browser Web Push endpoints and keys when you turn on alerts on a device.
• Technical signals — limited request data such as IP address, used for rate limiting, abuse prevention, and bot checks (Cloudflare Turnstile).

We do not create public profiles, show ads, or sell your data. Video and audio from a call are carried by our video provider during the call; we do not keep a Callmata recording of your calls.

How we use it

We use your information to:

• Create and maintain your family's private calling space
• Authenticate members (family code, name, and PIN)
• Send SMS verification codes and call-ring texts
• Deliver browser push notifications when someone calls
• Protect the service from abuse and automated bots

Service providers

We use trusted third parties to run Callmata. They process data only to provide their part of the service:

• Daily — private WebRTC video and audio for calls (camera and microphone streams during a call).
• Textbelt — one-time codes, call alerts, and related texts to numbers you provide.
• Cloudflare Turnstile — bot protection on registration and recovery.
• Vercel — hosting the website and APIs.
• Upstash / Vercel KV (Redis) — storing family records, push subscriptions, and short-lived rate-limit / flow state.
• Browser push services(e.g. your browser vendor's push network) — delivering call alerts when you opt in.

These providers have their own privacy policies. Data may be processed in the United States or other countries where they operate.

Where it's stored

Family records (code, names, phones, PINs, room URL) and push subscriptions are stored in Redis keyed by your family. Session and flow state also live in signed httpOnly cookies on your device (see our Cookie Policy).

On your device we may also keep a last-used name in local storage and short-lived call session details in session storage so the app feels familiar between visits.

Data retention

Family data remains stored while your family uses the service. Push subscriptions stay until you disable alerts or a device subscription becomes invalid. Short-lived cookies for registration, recovery, and OTP steps expire within minutes. Session cookies last for a limited period (see the Cookie Policy).

Your rights

You can leave a family space and manage alerts from within the app. To request deletion of a family's stored data (roster, phones, PINs, push subscriptions), have the person who registered the family contact us via callmata.com, and we will respond as soon as we can.

Children

Callmatais designed for families. Parents and caregivers decide who is on the roster. We do not knowingly collect personal information from children for marketing or advertising. If you believe a child's data was provided without appropriate consent, contact us and we will help remove it.

Cookies

We use cookies only as needed to run the service (for example, to remember which family you entered and keep your session). We do not use marketing or advertising cookies. For more detail, see our Cookie Policy.

Changes

We may update this privacy policy from time to time. We will post the current version on this page and update the "Last updated" date below when we make material changes.

Last updated: July 2026