Privacy Policy

There is no account to create, no analytics, and no server of ours for your calls to pass through.

Gerany Phone is a client for a phone line that you hold yourself, at Telnyx or Twilio. It turns credentials you already have into a working phone on your iPhone or iPad. We do not sell telephony, we do not carry your calls, and we never see them. The app is unlocked by a subscription that Apple bills; we never see your payment details.

What stays on your device

• SIP credentials. Held in the iOS Keychain. If you have iCloud Keychain switched on, Apple syncs them between your own devices — that is between you and Apple, and they are end-to-end encrypted.
• Contacts. Read on the device so a call can show a name instead of a number. Never uploaded, never copied off the phone.
• Call history. Stored locally. Deleting the app deletes it.
• A diagnostic log. Written on the device, holding the numbers you called and were called by, the times, how each call ended, and the signalling from the calling library — with passwords and tokens redacted before anything is written. It contains no contacts, no messages and no audio. You can read it in the app under Settings ▸ Help ▸ Send a support request, and it is shared with nobody unless you attach it to a message you send us.

Voicemail, recordings and transcripts

Voicemail and call recording are features of a Telnyx line. A recording is made by Telnyx on your line and kept on your Telnyx account; the copy the app downloads lives only on this iPhone. Laws in many places require telling the other person a call is recorded — the app reminds you at the start of every call on a recording line.

Transcripts are made on the device: the recording is downloaded from Telnyx to this iPhone, and Apple's speech recognition turns it into text here. Nothing is uploaded anywhere to do it — if your language has no on-device model, the message simply stays untranscribed. The notifications that tell your phone a message or recording exists are described below.

What a Twilio line's key can reach

A Twilio line signs in with an API key held on your phone. Twilio issues that key as a Standard key, and a Standard key reaches everything on your Twilio account except the account settings and the keys themselves. Tested against a live account, it can read:

• your call recordings
• your call log
• your transcriptions
• your text messages

Gerany Phone does none of that. The key is used for one thing — signing the short-lived token that registers your phone so calls can reach it — and the app makes no other request with it. But the capability is real, and you should know it is there rather than discover it later.

There is no narrower key that would work: Twilio's Restricted keys cannot sign the token a phone registers with, so a Standard key is the only kind that can. If you would rather not have such a key on a phone, a Telnyx line is the alternative — its SIP password only registers and places calls, and can read nothing.

It is your key, on your account. Deleting it in the Twilio console stops it working immediately, and removing the line in Gerany Phone tells you which key to delete.

Guided setup — the one server we run

Guided setup in the app opens a page at gerany.com/phone. It exists so that two things never have to sit on your phone: the account-wide credential that configures a line, and the certificate that lets incoming calls wake the app.

If you set your line up by hand instead, none of this runs and nothing of yours ever reaches us. Here is everything that happens when it does run:

• The credential you paste — a Telnyx API key, or a Twilio Account SID and Auth Token — is sent to that page over HTTPS and used for the length of one request: to list the numbers on your account, and to configure the one you pick. It is never written to storage, never logged, and is gone when the request ends. We cannot use it again, because we no longer have it.
• The line the setup produces — its label, your phone number, and the newly created sign-in credential — is held for ten minutes behind a single-use code, then handed to your phone. It is deleted the moment your app claims it, and expires by itself if it never does. This detour exists so that a password or a key secret never travels inside a link, where a browser would keep it in history.
• For a Twilio line only, one record is kept for as long as the line exists: your Twilio account identifier, your phone number, and the client name your phone registers under. Calls to a Twilio number are routed by a request from Twilio to our server, and that request has to be answered with the name of the phone to ring. No credential of yours is in that record — not your Auth Token, not the API key secret — and it holds nothing about who called or when. Telnyx lines need no such record.
• Request metadata is recorded by the server hosting these pages: IP address, timestamp, and the path requested. That is ordinary web-server logging, not something we add to or analyse. We put no analytics, cookies or fingerprinting on these pages, and they load no fonts, scripts or trackers from anywhere.
• Nothing else survives the setup — apart from the Twilio routing record above, and, if you use it, the voicemail notification record below. There is no account and no other record on our side that you ran it.

Voicemail and recording notifications — the second thing we run

If you turn voicemail notifications on for a line, Telnyx tells the same server when a message is left — and, if the line records calls, when a recording is ready — and the server forwards a notification to your phone. Here is exactly what that involves:

• What we hold: one record per line — your phone number, the push token that identifies your phone to Apple, and a random token that names the line. Nothing else, and no history. It is deleted when you turn notifications off for that line, or when you delete the line.
• What passes through: for each message or recording, the numbers involved where Telnyx supplies them, the time, and a link to the audio on Telnyx. That is forwarded to your phone and not stored. The audio itself never passes through us — your phone downloads it from Telnyx directly.
• Call recording is your decision and your responsibility. It is turned on per line from the app, the recording is made and kept by Telnyx under your account, and the app keeps a copy on your phone only if you switch that on. The app shows a recording notice at the start of every call on such a line; obtaining any consent the law where you or the other person are requires is yours to do.
• The transcript is produced on your iPhone by Apple's on-device speech recognition. Gerany Phone requires on-device processing and never relaxes it: if your language has no on-device model, the message stays untranscribed rather than being sent to any server, Apple's or ours.
• Apple delivers the notification over its push service and sees what any push notification carries: the device token and the notification text, which names the caller.

Lines set up by hand without turning this on are exactly as before: no server of ours is involved at all.

Who your data does reach

Two other parties, neither of them us:

• Your provider — Telnyx or Twilio, whichever carries the line. The credentials you enter are sent to them, because that is how the app registers your line and places calls. Your calls, their content, and the records of them are held by that company and governed by their privacy policy (Telnyx, Twilio) and your agreement with them. Gerany Phone also registers a push token there so incoming calls can reach your device while the app is closed.
• Apple. Push notifications for incoming calls are delivered over Apple's Push Notification service. The subscription that unlocks the app is sold and billed by Apple, under your Apple ID; the app receives only whether the subscription is active, and no payment data of any kind reaches us.

Tracking

None. Gerany Phone contains no analytics, no advertising identifiers, and no third-party tracking software. It does not track you across other apps or websites, and there is nothing for us to sell because we collect nothing.

Permissions the app asks for

• Microphone — required to speak on a call.
• Contacts — optional. Declining it leaves the app fully able to place and receive calls; you will see numbers rather than names.
• Notifications — optional, asked for when you turn on voicemail notifications for a line. Calls do not need it: they arrive by a separate mechanism that needs no permission.
• Speech recognition — optional, asked for before the first voicemail is transcribed. Processing is on-device only.

The app also declares a camera purpose string. Gerany Phone has no video calling and never opens the camera; the calling library it is built on includes video support that this app keeps switched off, and iOS requires the string to be present regardless.

Children

Gerany Phone is not directed at children and we do not knowingly collect information from anyone. Since the app collects nothing at all, there is nothing held about a child or an adult.

Deleting your data

Delete the app. Everything it stored — credentials, contacts cache, call history, logs — goes with it. If iCloud Keychain synced your credentials, remove them in iOS Settings under Passwords. There is nothing on our side to delete: guided setup keeps nothing once your phone has claimed the line, and we hold no account for you.

Your provider account, your phone number and your call records belong to your provider and are yours to delete there.

If you set up a Twilio line, the routing record described above outlives the app, because it belongs to the number rather than the phone. Deleting the TwiML app in your Twilio console stops it being used; write to [email protected] with the number and we will delete it outright.

Changes

If this policy changes materially, the date at the top changes with it and the updated version appears here.

Contact

Privacy questions: [email protected]
Anything else: [email protected]