CALLOUT

Privacy Policy

Last updated August 30, 2026

Callout is built and operated by Dreamers and Doers IT Solutions Private Limited (“Callout,” “we,” “us”). This page explains what we collect when you use the Callout app, why, and who we share it with. It doesn't cover any other site or service.

The short version

Callout is a self-custodial app. Your wallet's private key is protected through our wallet provider, Privy. Neither Callout nor Privy sees the key, and wallet transactions require your authenticated authorization. What we do store is your account info, your trading activity within the app, and your public wallet address. We don't sell your data, and we don't use it for advertising.

What we collect

  • Account info: the email address you sign up with, and a display name/avatar you choose.
  • Wallet address: your Solana wallet's public address, created for you by Privy when you sign up. This is public information on the Solana blockchain itself, independent of Callout.
  • Trading activity: the Callouts you send and receive, amounts, entry/exit prices, and timestamps. This is the core data the app is built around, and it's visible to the other person on each Callout by design.
  • Tape and messages: an optional Callout catalyst you choose to share with accepted friends on Tape, plus text replies and direct messages between accepted friends. A Tape post shows only your display identity, ticker, catalyst, and approximate time; it does not show the recipient, amount, wallet, entry price, or P&L.
  • Friend graph: who you're connected to inside the app, and pending invite links you've sent.
  • Contact you choose: if you use the system contact picker, your device gives Callout only the name and phone number or email address you select, long enough to address your invite. Callout does not request your whole address book, upload the selected contact to our servers, store it after the composer closes, or include it in analytics.
  • Safety reports: if you report another user, we keep the selected reason, any detail you provide, the two account IDs, report status, and timestamps so we can investigate and respond. Reporting also blocks that relationship from new Callouts.
  • Device push token: only if you allow notifications, so we know where to deliver them. You can revoke this at any time in your device settings.
  • Crash diagnostics: in release builds, Firebase Crashlytics automatically receives fatal crash stack traces, relevant app and device state, the app version, and random installation/session identifiers so we can find and fix crashes. We do not attach your Callout account ID, email, wallet address, invite token, balance, trade value, custom logs, or Analytics breadcrumbs to a crash report.
  • Fiat funding details: if you choose to buy USDC through MoonPay, we provide MoonPay with the email address already associated with your account, your public wallet address, your IP address, and the purchase details needed to start and track the transaction. Callout does not receive or store your full payment-card details, identity documents, or MoonPay account credentials.

We don't collect your real name, phone number, or physical address unless you choose to put that information in your display name. A destination you explicitly choose through the system contact picker remains on your device as described above.

Who we share it with

We use a small number of infrastructure providers to run Callout. None of them are permitted to use your data for their own purposes.

  • Supabase: hosts our database, authentication, and backend logic.
  • Privy: generates and secures your embedded wallet. Privy cannot access your funds, and neither can we; see “Self-custody” below.
  • Firebase Cloud Messaging (Google): delivers push notifications, using your device's push token.
  • Firebase Crashlytics (Google): processes fatal crash and technical diagnostic information on our behalf so we can identify and fix stability problems. It is not used for advertising or cross-app tracking.
  • Jupiter: public Solana market-data and swap-execution APIs. We send Jupiter a token/mint address and amount to get a price or execute a trade; we don't send your identity or account info.
  • MoonPay: where the Buy USDC feature is available, MoonPay provides fiat payment processing, identity verification, fraud screening, regional eligibility checks, and delivery of USDC to your wallet. MoonPay processes the information it collects under its own terms and privacy policy.

Separately, every trade you make is a real transaction on the Solana blockchain, a public, permanent ledger anyone can read, the same as any other Solana wallet. That visibility comes from how Solana itself works, not from Callout.

Self-custody

Neither Callout nor Privy sees your private key. Your wallet is created and controlled through Privy's embedded wallet infrastructure. In Callout's client-side configuration, the authenticated user owns the wallet and must authorize wallet transactions. Our backend does pay the Solana network's gas fees for sponsored transactions (so you don't need to hold SOL to trade). That fee-paying wallet only ever pays its own gas, and a real, automated check rejects any transaction that would try to move funds out of it beyond that.

What we don't do

  • We don't sell your data to anyone.
  • We don't use your data for third-party advertising.
  • We don't track you across other apps or websites.

How long we keep it

We keep your account and trading data for as long as your account is active. Tape posts stop appearing to friends after 24 hours; direct replies remain in the bilateral relationship thread while the account is active. Safety reports may be retained after account deletion when reasonably needed to investigate abuse, enforce our Terms, protect users, or comply with law. If you want your account deleted, you can use Delete account in the Wallet screen or email us below. We'll delete your account data, other than records we're required or permitted to keep or that already exist permanently on the Solana blockchain itself (which no one, including us, can delete).

Firebase generally keeps Crashlytics crash traces and their associated installation identifiers for 90 days before it starts removing them from live and backup systems. Those diagnostics are not connected to your Callout account by our implementation.

Children

Callout involves real financial transactions and isn't directed at or intended for anyone under 18. We don't knowingly collect data from children.

Changes to this policy

If this policy changes in a material way, we'll update the date at the top of this page.

Contact

Questions about this policy or your data, email abhilashi.iiith@gmail.com.