Effective Date: October 01, 2026

1. Introduction
Welcome to CallFlow. We built this application to help you automate USSD requests and manage call forwarding seamlessly. This Privacy Policy explains how CallFlow operates, what data is processed, how permissions are used, and your rights regarding your information.

2. Data Handling & Remote Features
CallFlow is designed with privacy in mind. Most core automation features run locally on your device. However, to support optional features such as Remote Execution and Advertisements, certain data is transmitted over secure network connections:

• Device Identifiers: We process a unique generated Device ID, Device Model Name (e.g., "Galaxy S23"), IP address, and Push Notification tokens to route commands between your linked devices.

• Account Data: If you sign in to link devices, we store your basic account identifier via Firebase Authentication.

• Masked Logs: Any phone numbers contained inside text execution responses are automatically masked locally before transmission.

• Advertising Data: AdMob collects Android Advertising ID (GAID) and interaction data to display advertisements.

3. Why We Request Specific Permissions
To provide its core automation and telecommunication functionality, CallFlow requires specific sensitive Android permissions. Here is how they are used locally on your device:

• Phone / Make and Manage Calls (CALL_PHONE): Required to automatically dial scheduled USSD codes and call-forwarding commands in Auto Mode without manual user intervention.

• Phone State (READ_PHONE_STATE): Required to detect Dual SIM configurations and route USSD codes through your selected SIM card.

• Contacts (READ_CONTACTS): Used strictly on-device to filter incoming calls against your address book and pick destination numbers; contact data is never collected, stored, or transmitted off your device.

• Alarms & Reminders (SCHEDULE_EXACT_ALARM): Ensures that your scheduled tasks execute precisely at the time you specified, even if your phone is asleep.

• Notifications (POST_NOTIFICATIONS): Used to deliver local alerts about execution status, error reports, and manual execution prompts.

4. Advertising & Privacy Choices
CallFlow uses Google AdMob to display advertisements (such as rewarded ads to unlock remote features).

• Ad Collection: AdMob and its partners may collect device identifiers, IP addresses, and interaction metrics to serve ads, prevent fraud, and measure performance.

• Consent Management: In applicable regions (such as the EEA and UK under GDPR), we use Google's User Messaging Platform (UMP) to request your explicit consent before loading ads. You can adjust or revoke your privacy choices at any time in the app Settings.

5. Data Storage and Management

• Local Storage: All scheduled tasks, custom codes, and execution logs are saved locally on your device's internal protected storage.

• Backups: You can manually export and import your tasks via CSV files stored locally on your device.

6. Third-Party Services
CallFlow integrates the following third-party services, each governed by its respective privacy policy:

• Google AdMob & User Messaging Platform (Google LLC): Used for advertisement serving and privacy consent management.

• Google Firebase (Google LLC):

  • Firebase Analytics & Crashlytics: Used for anonymized crash reports and app usage analytics.

  • Firebase Authentication: Used for secure user login to link your devices.

  • Firebase Realtime Database & Cloud Messaging (FCM): Used for real-time device-to-device command routing.

• Google Play Billing: Used by the OS to securely process in-app purchases (e.g., CallFlow Pro). We do not have access to your payment or credit card details.

7. Data Retention and Deletion

• In-App Control: You can clear execution history, delete scheduled tasks, unlink devices, or sign out directly in the app at any time. Unlinking or signing out permanently removes your device mapping and synced tasks from our servers.

• Account & Data Deletion Request: To permanently delete your account and all associated cloud data (Google ID, FCM device tokens, and cloud favorites), send an email to qazirolabs@gmail.com with the subject "Delete My Account" from the email address linked to your account.

• Retention & Processing: All associated personal data and cloud records will be permanently deleted within 30 days of receiving your request. No user data is retained after deletion.

8. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We advise you to review this page periodically for any changes.

9. Contact Us
If you have any questions or suggestions regarding this Privacy Policy, please contact us at: qazirolabs@gmail.com