CALLOUT

Privacy Policy

Last updated October 9, 2026

Callout is built and operated by Dreamers and Doers IT Solutions Private Limited (“Callout,” “we,” “us”). This page explains what we collect when you use the Callout app and our website, including shared Callout links, why, and who we share it with. Third-party services you choose to use also have their own privacy policies.

The short version

Callout is a self-custodial app. Your wallet's private key is protected through our wallet provider, Privy. Callout does not receive your wallet's private key; transactions from your personal wallet require your authenticated authorization. Unclaimed token gifts use separate escrow wallets, as explained below. We store account info, trading and sharing activity, and public wallet addresses. We don't sell your data, and we don't use it for advertising.

Scout and OpenAI

Scout is optional. Before your first Scout message, we ask permission to send OpenAI your message, photos you choose to attach, the current Scout conversation, attached trade details, and available balances, positions, orders and recent activity from your verified accounts. This information is used to answer your questions and explain trades. Scout conversations are private to your Callout account and are not shared with other Callout users.

You can stop future sharing through Scout privacy, and delete individual Scout conversations in the app. Conversations are stored in Callout until you delete them or your account. We disable OpenAI response storage; provider retention rules may still apply. Revoking permission does not retract information already sent. Scout does not receive wallet private keys or seed phrases and cannot authorize trades or transfers from a chat message.

What we collect

  • Account info: the email address you sign up with, authentication identifiers, and a display name/avatar you choose. If you connect X, we also receive your verified X account ID, handle and profile-image URL through Privy to show your linked profile.
  • Wallets and balances: public addresses for your Solana and supported EVM wallets, wallet-provider identifiers, balances, holdings and portfolio-value history. We obtain this information from your wallet provider, blockchain networks and trading venues to display and reconcile your funds.
  • Trading activity: the Callouts you send and receive, orders, fills, amounts, entry/exit prices, leverage, profit and loss, fees, funding, transaction identifiers and timestamps. This includes deposits, withdrawals, cross-chain transfers, token gifts, profit-share promises and payment status. Shared Callout details are visible to their recipients and relevant chat or group participants; your entire portfolio is not shared simply by joining a group.
  • Messages: text messages in direct conversations and groups, visible to the participants in those conversations. Replies may include context from an earlier shared Callout. When you mention or reply to an AI asset participant, your question and a bounded portion of recent messages in that conversation are sent to OpenAI to generate the reply. AI replies, market sources, timestamps and helpfulness feedback are stored with the conversation.
  • Friend graph: who you're connected to inside the app, group memberships, invite links, and conversation preferences such as pinned chats and notification settings.
  • Contact you choose: if you use the system contact picker, your device gives Callout only the name and phone number or email address you select, long enough to address your invite. Callout does not request your whole address book, upload the selected contact to our servers, store it after the composer closes, or include it in analytics.
  • Product usage and technical data: invitation views, app/store-link taps, claims and related feature events, associated with an invite, Callout or account where applicable. We use these events to understand onboarding, troubleshoot delivery and improve the product. Our hosting and network providers also process IP addresses, request and device/browser information to deliver and secure the service. This is not cross-app advertising tracking.
  • Safety reports: if you report another user, we keep the selected reason, any detail you provide, the two account IDs, report status, and timestamps so we can investigate and respond. Reporting also blocks that relationship from new Callouts.
  • Device push token: only if you allow notifications, so we know where to deliver them. You can revoke this at any time in your device settings.
  • Crash diagnostics: in release builds, Firebase Crashlytics automatically receives fatal crash stack traces, relevant app and device state, the app version, and random installation/session identifiers so we can find and fix crashes. We do not attach your Callout account ID, email, wallet address, invite token, balance, trade value, custom logs, or Analytics breadcrumbs to a crash report.
  • Fiat funding details: if you choose to buy USDC through MoonPay, we provide MoonPay with the email address already associated with your account, your public wallet address, your IP address, and the purchase details needed to start and track the transaction. Callout does not receive or store your full payment-card details, identity documents, or MoonPay account credentials.

We do not request your physical address or upload your address book. A destination you explicitly choose through the system contact picker remains on your device as described above.

Shared links and notifications

People who receive or are forwarded a Callout link may see its preview, including the sender's profile and the trade or gift details you chose to share. Messaging apps may fetch and cache link previews. Notification services process delivery tokens and notification content, which may include names, assets and shared payment amounts. These can appear on your lock screen, depending on your device settings.

Who we share it with

We use the providers below to operate the features you use. We require providers processing personal data on our behalf to protect it to the same or a greater standard described in this policy and to use it only for the services they provide to us. Independent sign-in, payment and trading services also process data under their own privacy policies.

  • Supabase: hosts our database, authentication, and backend logic.
  • Privy: provides embedded wallets, authentication integration and optional X account linking, using your account identifiers and public wallet addresses; see “Self-custody” below.
  • Firebase Cloud Messaging (Google) and Apple Push Notification service: deliver push notifications using device tokens and notification content.
  • Firebase Crashlytics (Google): processes fatal crash and technical diagnostic information on our behalf so we can identify and fix stability problems. It is not used for advertising or cross-app tracking.
  • OpenAI: generates AI asset replies from your question, recent conversation context and public market information. Ordinary messages do not independently trigger an AI request. Model requests disable response storage through the API; OpenAI may retain data under its applicable API data policies. Public market/news research uses asset identifiers and topics rather than private wallet or account details.
  • Jupiter: public Solana market-data and swap-execution APIs. Requests can include token addresses, amounts, public wallet addresses and signed transactions to quote or execute trades. We do not send your email or Callout profile to Jupiter.
  • Hyperliquid: processes public wallet addresses, signed trading instructions, orders, positions and funding or payment information when you use Perps.
  • Relay: processes source and destination wallet addresses, assets, amounts and transaction identifiers when you route funds between supported networks.
  • Blockchain and market-data providers: Solana, supported EVM-network RPC services, Jupiter, CoinGecko, DEX Screener and GeckoTerminal receive the address, token, market or search query needed to retrieve balances, prices and history or submit transactions. Direct requests from your device also expose ordinary network information such as your IP address.
  • Derive: if you have access to the restricted Options test feature, it processes wallet/account identifiers, authenticated requests, quotes and trading instructions for that feature.
  • Vercel: hosts our website and shared-link pages and processes requests and technical logs to deliver and secure them.
  • Apple, Google and X: process information when you choose their sign-in or account-linking services. We receive the identifiers and profile information authorized for that connection.
  • MoonPay: where the Buy USDC feature is available, MoonPay provides fiat payment processing, identity verification, fraud screening, regional eligibility checks, and delivery of USDC to your wallet. MoonPay processes the information it collects under its own terms and privacy policy.

Transactions on public blockchains, including Solana and the supported EVM networks, expose wallet addresses and transaction details publicly and permanently. Trading venues may also make wallet-linked trading activity public. Callout cannot make those external records private or remove them. Providers may process data outside your country.

Self-custody

Callout does not receive your personal wallet's private key. Your wallet is created and controlled through Privy's embedded wallet infrastructure. In Callout's client-side configuration, the authenticated user owns the wallet and must authorize wallet transactions. We may sponsor network fees and account activation. This does not give us authority to spend from your personal wallet. Unclaimed token airdrops and funded cash payout links are different: they use separate escrow wallets for which Callout can authorize eligible claims and refunds. After a completed claim, the recipient controls the received assets in their own wallet.

What we don't do

  • We don't sell your data to anyone.
  • We don't use your data for third-party advertising.
  • We don't track you across other apps or websites.

How long we keep it

We keep your account and trading data for as long as your account is active. Messages and historical reply context remain in their conversations while the account is active. Posts shared through the retired Tape feature are no longer shown in the app; historical records may remain until account deletion. Safety reports may be retained after account deletion when reasonably needed to investigate abuse, enforce our Terms, protect users, or comply with law. If you want your account deleted, you can use Delete account in the Wallet screen or email us below. We'll delete your account data, other than records we're required or permitted to keep or that already exist permanently on public blockchains (which we cannot delete). Deleting your Callout account does not close external trading positions or transfer funds. Export your wallet recovery information and withdraw funds or close positions as appropriate before deleting your account.

Firebase generally keeps Crashlytics crash traces and their associated installation identifiers for 90 days before it starts removing them from live and backup systems. Those diagnostics are not connected to your Callout account by our implementation.

Your choices

You can change notification permissions and lock-screen previews in your device settings, disconnect X from your profile, and choose not to use optional contact, funding or sharing features. To request access, correction or deletion of personal data, or withdraw consent for a consent-based use, contact us at abhilashi.iiith@gmail.com. We may need to verify account ownership. Withdrawal does not undo processing already completed or remove public blockchain records.

Children

Callout involves real financial transactions and isn't directed at or intended for anyone under 18. We don't knowingly collect data from children.

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.

Contact

Questions about this policy or your data, email abhilashi.iiith@gmail.com.