What we collect when you call
When you dial our number, Twilio (our telephony provider) processes the call. We receive: the raw audio recording, a timestamp, and a Twilio call SID (an internal identifier). We immediately hash your phone number using bcrypt and discard the original. The hash, the audio, and the timestamp are the only things we store. The Twilio call SID is used to retrieve the recording and then discarded.
What we don't collect
Your name, email address, IP address (callers connect via telephone, not the web), carrier, device type, physical location, or any identifying metadata beyond what's described above. We are not building a profile on you. There is no profile.
How we handle the audio
The raw audio is uploaded to Cloudflare R2 object storage immediately after the call ends. It is transcribed by Deepgram and run through a classification model to assist with moderation. If approved for publication, a masked version is published to the archive; the raw version is retained for 90 days to allow retraction, then permanently deleted. After 90 days, the raw audio is gone. Cloudflare and Deepgram have access to the audio as part of normal processing. We do not share audio with any other third parties.
The caller hash
Your phone number is hashed using bcrypt (cost factor 12) with a pepper stored separately from our main database. The hash is used only to enforce rate limiting — so one person can't flood the archive with hundreds of messages. Neither we nor anyone with access only to our database can recover your phone number from the hash. The pepper is stored in a separate system with its own access controls. Without the pepper, the hash is useless for identification.
Website visitors
This policy primarily addresses callers. For people who visit psa.xyz in a browser: we use Cloudflare for CDN and basic traffic analytics. Cloudflare may log IP addresses as part of normal traffic routing. We do not run Google Analytics, Facebook Pixel, or any other behavioral tracking tools. We do not use cookies except for functional purposes — for example, session state if you are a Supporter subscriber. We are not tracking what you listen to.
Third-party services
- Twilio — processes the telephone call. Your call connects through Twilio's infrastructure before reaching us. Subject to Twilio's privacy policy.
- Deepgram — transcribes audio to support human moderation. Audio is sent to Deepgram's API and is subject to their data processing terms. We use transcripts internally; they are not published without editorial review.
- Cloudflare — hosts the site, stores audio files (R2), and hosts the database (D1). Subject to Cloudflare's privacy policy.
- ElevenLabs — will be used for AI character voice masking in a future feature. When enabled, audio will be processed per ElevenLabs' API terms. We'll update this policy when that feature ships.
Data retention
- Raw audio — permanently deleted 90 days after the call.
- Published masked audio — retained indefinitely as part of the public archive. If you retract your message, the published version is also removed.
- Caller hash — retained indefinitely for rate limiting purposes.
- Transcripts — retained as part of message records indefinitely for published messages.
Your rights
You have the right to request deletion of your published message. Use your retraction code within 90 days of calling, or contact us after the 90-day window and we'll handle it manually. Because we cannot identify callers by phone number, we cannot fulfill deletion requests tied to a number — only to a message ID or retraction code. If you're a Supporter subscriber (paying member), you can request account deletion by emailing us at any time.
If you are in the EU or another jurisdiction with specific data rights (GDPR, PIPEDA, etc.), you may have additional rights. We take these requests seriously. Contact us and we'll work through it with you.
Contact
Privacy questions go to hello@psa.xyz. We'll respond within 5 business days. For law enforcement and legal process inquiries, see the legal requests page.