Privacy

VicPhone consists of two applications, one for Windows and one for Android, which run on your computer and your phone. Your SIP access details, your contacts and your call history are stored there only: on Windows in the application folder under your Windows user, on Android in the protected storage of the app. Passwords and sign-in keys are encrypted, on Windows with the Windows Data Protection API and tied to your user account, on Android with a key from the system key store (Android Keystore). On Windows your contacts are encrypted in the same way, your call history and the other details of the lines are not. If you uninstall the application for Windows, this data is deleted from the computer.

The calls themselves run between your device and the SIP provider that provides your line. Which data your provider processes in doing so is governed by its own privacy policy. Both applications currently transmit phone numbers, the other details of the SIP connection and the voice unencrypted to your provider, without TLS and SRTP.

The Android app only asks for what it needs to make calls: the microphone for the call, the contacts to show names instead of numbers, and notifications to show calls. If you wish, it also uses full-screen display and display over other apps, so that a call appears over the lock screen as well, the exemption from battery optimisation, so that the app stays reachable, and the call screening role, if mobile calls are to be turned away during a call. If you make VicPhone your default phone app, it also handles the calls over the SIM card. For this it receives access to the phone state, to placing calls and to the call log of the phone, which it shows in the history and adds new calls to. You then manage blocked numbers through the list of Android, which VicPhone opens. From Android 12 it also asks for the connection to Bluetooth devices, so that calls can run through a headset.

The app reads the contacts from the address book of your phone, that is from the accounts your phone already syncs. The only things it changes there are the default number and the favourite of a contact, and only when you set them yourself with the check mark or the star, for which the app asks once for permission to change contacts. Your phone then syncs them with the account of the contact. The app does not transmit contacts on its own. Incoming mobile calls are also checked on the phone only. Every permission can be withdrawn at any time in the Android settings. The call log and the SIM calls stay on the phone, the app sends them nowhere.

If you switch on recording the log in the settings, the app writes what it does to files on the phone, up to five of 10 MB each. They can also contain the SIP traffic, phone numbers and details of your lines. The files stay on the phone until new ones replace them. If you switch recording off or uninstall the app, they are deleted. They only leave the phone if you pass them on yourself through the share menu of Android, for example to us for troubleshooting.

If you connect an account with Apple iCloud or another CardDAV service in the app, it fetches the contacts directly from there and stores them encrypted in its protected storage. They are only in VicPhone and not in the address book of the phone. If you remove the account or uninstall the app, these contacts and the password are deleted.

There are no statistics, no identifier for your installation and no reporting of when or how often you use the application. Neither personal data nor access details, phone numbers, call content or contacts are transmitted to us. This applies to the application itself. If you install the app for Android from Google Play, Google processes its own data in doing so, see the section on Google Play.

Which permissions

VicPhone uses the Google People API with the contacts permission, which covers reading and writing, and the email permission to label the account in the list with its address. The only things written are the default number and the favourite of a contact, when you set them yourself: with the check mark the application puts the number first in the contact and marks it, with the star it adds the contact to the favourites group or removes it from there. No contacts are created or deleted, and no other details are changed.

Which data

The data fetched consists of names, phone numbers with their type, email addresses, contact pictures, nicknames, companies and job titles, postal addresses, websites, birthdays and other dates, messenger and SIP addresses, relations, notes, the groups of your contacts and membership of the favourites group, plus the email address of your Google account.

Purpose

This information is used solely to show names instead of numbers in VicPhone, to recognise callers, to call from the contact list, to show all details of a contact and to set the default number and the favourites you choose.

Signing in

After you sign in, Google redirects to a short-lived address on your own computer (127.0.0.1), our server is not involved. The access keys the application fetches from Google in the process are stored encrypted on your computer.

Protection and storage

The connection to Google runs encrypted over HTTPS. Your contacts and the access keys are stored encrypted on your computer and tied to your Windows user account. They stay there until you remove the account in the application or uninstall the application, both delete them.

Google API Services User Data Policy

VicPhone's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The data retrieved from your Google account is not transferred to third parties, not used for advertising, not sold, not used to train artificial intelligence models and not read by us. It only leaves your computer when you yourself open a link from a contact, see below.

Revoking access

You can remove the account in the application settings at any time, which deletes its contacts and access keys. You can also revoke access in your Google account under the connections to third-party apps.

Which permissions

VicPhone uses Microsoft Graph with the permissions Contacts.Read, User.Read and offline_access. Contacts are only read, never changed.

Which data

The data fetched consists of names, nicknames, phone numbers with their type, email addresses, contact pictures, categories, companies, job titles, departments and offices, postal addresses, websites, birthdays, messenger addresses, the names of partners, children, managers and assistants, and notes of your contacts, as well as the email address or sign-in name of your account. It is used solely for display in VicPhone and is stored only on your computer.

Revoking access

You can remove the account in the application at any time and also revoke access in your Microsoft account under app permissions.

For Apple iCloud and other CardDAV address books, you enter your user name and a password in the Windows application or the Android app, for Apple an app-specific password. The application uses these to connect directly to the service and read your contacts. If you set a default number with the check mark, the application writes this mark into the card of the contact and changes no other details. The password is stored encrypted on your device and is only transmitted to the respective service.

If you open a link from a contact, VicPhone passes the detail to the program or service you choose with it: an email address to your mail program, a postal address to Google Maps, a website to your browser, a date to your calendar, on the computer to Google Calendar or Outlook in the browser, and a phone number to your messaging app or to WhatsApp, on the computer through the address wa.me in the browser. This only happens when you click, and nothing is sent on its own. These services have their own privacy policies. On the computer a link can also open the contact page of Google or Microsoft and the iCloud calendar, again only when you click.

When you visit this site, our hosting provider processes the usual server data, including your IP address, the time of access, the address requested and your browser's identifier. This data is used to operate and secure the site. The server rotates these logs automatically and deletes older versions, currently after up to about one year. The legal basis is Article 6(1)(f) GDPR.

The fonts, images and scripts of this site are stored on our own server. Which cookies the site sets and what is measured only with your consent is described in the following sections.

Only the administration of this site sets a cookie for signing in, and only for us when we sign in there. It does not concern visitors of the site or buyers.

(1) Data collected

When you write to us through the form, we collect your name, your email address and the message. All three details are required so that we can answer your enquiry.

(2) Purpose of processing

We use the data collected solely to answer your enquiry. No evaluation for advertising purposes takes place.

(3) Disclosure of data

Your personal data is not sold to third parties or passed on for advertising purposes. The message is sent as an email to our mailbox, involving only the hosting provider and the email service provider.

(4) Storage

The enquiry is not stored in a database of this site, only as a message in our mailbox.

(5) Legal basis

The processing takes place in order to carry out pre-contractual measures pursuant to Article 6(1)(b) GDPR and on the basis of our legitimate interest in answering enquiries pursuant to Article 6(1)(f) GDPR.

(6) Storage period

We delete the message as soon as your enquiry has been dealt with and no statutory retention obligation applies.

(7) Data security

We use technical and organisational security measures to protect your data against manipulation, loss, destruction or unauthorised access. Your data is transmitted in encrypted form via HTTPS.

(1) Payment with Stripe

VicPhone is paid for through Stripe. For the purchase, Stripe acts as the merchant itself with its service Link and takes care of payment, VAT, invoice and refunds. The checkout is on Stripe's pages: what you enter there, such as name, email address, address and your card details, goes directly to Stripe and is processed there under Stripe's own responsibility. We do not see your card details. Stripe's privacy policy and cookies apply on the checkout pages.

(2) What we receive from your order

After the payment, Stripe reports the order to us. From it we store your name, your email address, the language in which you bought, the amount with its currency, the time of payment, any refund and the identifiers of the payment at Stripe. We also assign an order number and a random key for your customer page.

(3) Purpose and legal basis

We use this information to provide VicPhone to you: for the confirmation by email, for your customer page with the downloads, the updates and the source code that the GNU General Public License guarantees you, and for questions about your order and for refunds. The legal basis is Article 6(1)(b) GDPR, the performance of the contract, and where statutory retention obligations apply, Article 6(1)(c) GDPR.

(4) Your customer page

You reach your customer page through the link in the confirmation or through the source code page with your order number and email address. Anyone who knows the link sees the order number, date and email address, so do not pass it on. The customer page sets no cookies and needs no account. We count how often each file is downloaded through your customer page and through the source page of the app. Only this number is stored, without an IP address, time or browser, for a customer page together with the order. This gives us an overview of what we offer and helps to spot misuse of a link, the legal basis is Article 6(1)(f) GDPR.

(5) Storage period

We store your order for as long as we provide VicPhone and its updates to you, and beyond that where statutory retention obligations apply. On request we delete it earlier. After that the customer page can no longer be reached.

(6) Withdrawal through the form

If you withdraw through the form "Withdraw from contract", we process your name, your email address, the order number, your message and the time of receipt in order to handle the withdrawal and confirm its receipt to you. The legal basis is Article 6(1)(c) GDPR in conjunction with Section 356a of the German Civil Code (BGB). The information is sent by email to you and to us, it is not stored in a database. We keep it for as long as statutory retention obligations apply.

(7) Recipients and transfers to third countries

The confirmation is sent to you through our email service provider. Stripe also processes data in the USA. For the USA there is an adequacy decision of the EU Commission, the EU-US Data Privacy Framework, under which Stripe, Inc. is certified. Stripe's privacy policy is at https://stripe.com/privacy, Link's at https://link.com/privacy.

(8) Buying as a company

If you buy directly from us as a company, we set up the order ourselves, with the name of the company, the email address, the language, the number of workstations and the amount. We use this information for the quote, the invoice and the customer page, Stripe is not involved. The legal basis is Article 6(1)(b) GDPR and, for keeping the invoice, point (c). The invoice is kept as a file with the order on our server and is sent to you by email.

(1) Purchase and installation

You buy and install the app for Android on Google Play. Google handles purchase, payment, refunds and updates under its own responsibility, and in doing so Google also processes data on installation, updates and crashes. The privacy policy of Google at https://policies.google.com/privacy applies. We do not create an order on this site for this, the section on the purchase through Stripe does not apply here.

(2) What we receive from Google

In the Play Console, Google provides us with reports on orders and revenue as well as statistics, for example on installations, crashes and ratings. We use them for accounting, for refunds and questions about a purchase, and to fix errors. The legal basis is Article 6(1)(b) GDPR, the performance of the contract, and Article 6(1)(f) GDPR, our legitimate interest in an error-free app, as well as point (c), where statutory retention obligations apply. We do not see the data of your card.

(3) Link and QR code on this page

The link and the QR code on this page lead to Google Play. The QR code is on our server, nothing goes to Google in doing so. Only when you follow the link do you reach Google, and then the terms of Google apply.

(1) Purpose of processing

To protect our contact form, the source code lookup and the withdrawal form against automated enquiries and advertising messages, we use Turnstile from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Turnstile checks whether a request comes from a human being. As a rule this happens in the background without you having to do anything, only in case of doubt does a field to confirm appear in the form.

(2) Data collected

During the check, your IP address, details about your browser and device, the address requested and your behaviour on the page, such as mouse movements, keyboard input and time spent, are transmitted to Cloudflare. For this purpose, Turnstile may store information in your browser's storage and read it. According to Cloudflare, no profile is created from this and none of it is used to display advertising.

(3) Point in time

The Cloudflare script is only loaded when you open the contact form or the source code lookup or withdrawal page. Anyone who only reads our pages does not establish a connection to Cloudflare.

(4) Legal basis

The legal basis is Article 6(1)(f) GDPR, our legitimate interest in protecting our forms against misuse. Insofar as information is stored in or read from your browser's storage in the process, this is strictly necessary for the use of the form you have requested, § 25 Absatz 2 Nummer 2 TDDDG. No consent is required for this.

(5) Categories of recipients and transfer to third countries

The recipient is Cloudflare, Inc., which processes the data on our behalf. A transfer to the USA cannot be ruled out. For the USA there is an adequacy decision of the EU Commission, the EU-US Data Privacy Framework, under which Cloudflare, Inc. is certified.

(6) Storage period

According to its own information, Cloudflare does not store the data collected for the check for longer than protection against misuse requires. Nothing of it remains with us, the result of the check alone decides whether your message is sent or your lookup is processed.

(7) Further information

You can find Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/ and the separate information on Turnstile at https://www.cloudflare.com/turnstile-privacy-policy/.

(1) Purpose of processing

This website uses cookies and similar storage technologies. Technically necessary cookies are required to ensure the basic operation of the website, for example to store your consent decision. Beyond that, we only use cookies for analytics purposes if you have expressly consented to this. Before any processing that requires consent, you receive a notice when you first visit the website, the cookie banner, through which you can allow or refuse their use.

(2) Legal basis

The legal basis for processing by means of technically necessary cookies is Article 6(1)(f) GDPR in conjunction with § 25 Absatz 2 Nummer 2 TDDDG. The legal basis for processing by means of cookies that require consent is your consent pursuant to Article 6(1)(a) GDPR in conjunction with § 25 Absatz 1 TDDDG.

(3) Storage period

The storage period of the individual cookies depends on the provider and the purpose. You can find information on this in the cookie banner and in the following sections on the respective services.

(4) Withdrawal

You can withdraw or adjust your consent at any time with effect for the future. To do so, click the "Cookie settings" button. The withdrawal does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.

(1) Purpose of processing

To manage your consent to cookies and similar technologies, we use the open source solution "vanilla-cookieconsent". When you visit the website, a banner is shown through which you can consent to or refuse individual categories of cookies. Your choice is stored in a technically necessary cookie and in your browser's local storage, so that the banner does not appear again on future visits and your settings are respected.

(2) Legal basis

The legal basis for storing your consent decision is Article 6(1)(c) GDPR, the fulfilment of a legal obligation to document consent, and Article 6(1)(f) GDPR, our legitimate interest in managing consent in a user-friendly way.

(3) Categories of recipients

No data is transferred to third parties. The data is stored exclusively locally in your browser.

(4) Storage period

Your consent decision is stored for a period of six months. After that, the banner is shown again so that you can confirm or adjust your consent.

(1) Purpose of processing

On this website we use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is a solution for managing website tags, for example for integrating tracking or analytics services, through an interface. Google Tag Manager itself does not create user profiles, does not store cookies and does not carry out any analyses of its own. It serves solely to manage and deliver the services integrated through it.

(2) How it works with consent

We use Google Tag Manager in conjunction with Google Consent Mode v2. Before you give your consent, all tags that require consent are blocked and no personal data is transmitted to the respective services. Only after you have given your consent via the cookie banner are the respective tags executed, for example Google Analytics.

(3) Legal basis

The legal basis for the use of Google Tag Manager is Article 6(1)(f) GDPR, our legitimate interest in managing the website tags effectively.

(4) Categories of recipients and transfer to third countries

The provider is Google Ireland Limited. When Google Tag Manager is loaded, a connection to Google servers is established, in the course of which your IP address may be transmitted to Google. A transfer to third countries, in particular the USA, cannot be ruled out. For the USA there is an adequacy decision of the EU Commission, the EU-US Data Privacy Framework, under which Google LLC is certified.

(5) Further information

You can find Google's privacy policy at https://policies.google.com/privacy.

(1) Purpose of processing

If you have given your consent, we use Google Analytics 4 on this website, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse the use of the website. Among other things, information about the pages visited, the time spent on them, the device and the country of origin is collected. We use this information to evaluate the use of the website, to compile reports on activity and to improve the website.

(2) IP anonymisation

Google Analytics 4 truncates the IP address by default before it is stored. This rules out any direct attribution to you as a person.

(3) Legal basis

The legal basis for the processing is your express consent pursuant to Article 6(1)(a) GDPR in conjunction with § 25 Absatz 1 TDDDG. You can withdraw your consent at any time with effect for the future using the "Cookie settings" button.

(4) Categories of recipients and transfer to third countries

The recipient of the data is Google Ireland Limited as the controller within the EU. A transfer to third countries, in particular the USA, cannot be ruled out. For the USA there is an adequacy decision of the EU Commission, the EU-US Data Privacy Framework, under which Google LLC is certified. In addition, we have concluded a data processing agreement with Google pursuant to Article 28 GDPR.

(5) Storage period

The data collected by Google Analytics 4 is stored for 14 months by default and then deleted automatically.

(6) Further information

You can find Google's privacy policy at https://policies.google.com/privacy. Information on the Google Analytics terms of service can be found at https://marketingplatform.google.com/about/analytics/terms/de/.

You have the right of access, rectification, erasure and restriction of processing, the right to data portability and the right to object. All application data can be deleted completely from your computer and your phone by removing the accounts and uninstalling the application. We delete the data of your order on request, unless a retention obligation prevents this. You can also lodge a complaint with a data protection supervisory authority.

This policy will be updated when the application or the site changes. The version published here at the time applies.