We can't read your messages

Last updated 11 October 2026. Most privacy policies explain what a company does with your data. The interesting thing here is structural: your messages, calls and contacts are on a server you own, and we have no copy and no access. This page is mostly about the short list of exceptions.

What we never see

Your texts, voicemail recordings and transcripts, call history, contacts, and the contents of any call. All of it lives in a database on your own server. There is no sync to us, no analytics pipeline, and no support tool that reaches into it. This is not a policy we have chosen to follow and could quietly change — it is how the software is built. If we wanted to read your messages we would have to ship you different software and hope you did not notice. The one place your data passes through something we run is our relay: it wakes your phones, and it introduces two RingReplacer servers when their users choose to pair. The next two sections say exactly what it can see.

Contact photos imported from a phone's address book are cached on that phone only and are never uploaded anywhere, including to your own server.

What our push relay can see

Only Apple and Google can wake a phone, and only with the app publisher's signing key, which we cannot give to every customer. So your server hands each notification to a small relay we run, which signs it and passes it on to Apple or Google. The relay never logs or stores what a notification says. It keeps a daily count of notifications per server, and a list of devices kept as one-way hashes, so we can count them but not contact them.

Every notification about your messages, voicemail and calls is sealed for a phone that holds a sealing key, which every current iPhone app does. Your server encrypts it with a key that only your server and the receiving phone hold, and the phone decrypts it. For a sealed notification, the relay can see:

• which server sent it, and that server's internet address;
• the device token, which is Apple's or Google's address for the phone;
• the time, and the notification's size;
• whether the phone is an iPhone or an Android phone, and the delivery type Apple or Google needs (alert, background or call) and its priority;
• for an alert, the text it carries outside the seal, which is the same for every sealed alert, whether it is a text message, a voicemail or a scheduled text that could not be sent: "RingReplacer" and "New message".

Nothing else is readable. Who a notification is from, which line it is for, the message text, the caller's number and name, whether a call is a phone call or a call from another RingReplacer line, whether it is video or voice, the call's id, and your unread count are all sealed, and so is the kind of alert. A phone that has restarted cannot open the seal until it is first unlocked. Until then, a sealed alert shows only "New message", and any incoming call, phone calls included, rings as "RingReplacer call" and shows the caller once the phone is unlocked.

Background refresh signals, which tell the app to refresh a list after something changed on your server, are not sealed: they carry only what to refresh (your lines and their sign-in details, your line settings, your contacts, or your message and call history), and nothing else.

Phones without a sealing key. A phone whose app predates sealing, or an Android phone whose update has not shipped yet, cannot open a seal. It is never sent a sealed notification; it is sent the notification unsealed, as before sealing. These pass through the relay readable, but are never logged or stored:

• text message alerts (the sender's number and saved name, the line, the message's number on your server, and the start of the message);
• voicemail alerts (the caller's number and saved name, the line, and the voicemail's number on your server);
• alerts that a scheduled text could not be sent (the recipient's number and saved name, and the line);
• wake-ups for incoming phone calls (the caller's number and name, whether the call was flagged as spam, the line called, and the call's id);
• wake-ups for incoming video calls (the caller's number and name, the line called, the call's id and time, and whether the caller is on another RingReplacer server).

The three kinds of alert above (text message, voicemail and unsent scheduled text) also carry your unread count. A message between two RingReplacer lines never reaches such a phone this way: the phone is sent it as an ordinary text message instead.

Calls between RingReplacer apps

Where your server offers internet calls, a call to you from someone who can reach you app to app (a RingReplacer user on your server who has your number saved, whether or not you have saved them, or someone you paired with for internet calls) may go over the internet instead of by phone. If your phone is switched off or offline, their call waits about 15 seconds for it before it continues as an ordinary phone call, while a number that has no RingReplacer app rings by phone at once. So such a caller can tell from that pause that your phone is off, rather than that you do not use the app.

Pairing with someone on another RingReplacer server

Two people on different RingReplacer servers can pair their apps: after a phone call between them, or, where the server offers it, from a texting thread once they have texted each other both ways. Both have to tap to pair. Each tap sends our relay one half of the introduction, and the relay can see:

• which server sent it, that server's address (its web address and its internet address), and a public key for the pairing;
• a one-way code computed (with scrypt) from the two phone numbers, never the numbers themselves, and which of the two sides is posting;
• a time bucket: the 10-minute bucket of the call, or, for a tap in a texting thread, the calendar day of the tap. Because the two kinds differ, the relay can tell that a pairing followed texts rather than a call.

So the relay can learn that two numbers it cannot read had a call, or texted each other both ways, around that time, including when the other person never uses RingReplacer and never taps. Someone who already knows both numbers could check a guess against the code; nobody can read the numbers back out of it in bulk. Each half is kept for up to 24 hours, then deleted. No message, call content or address book is ever sent, and the relay keeps no directory of who uses RingReplacer: nothing can be looked up there. Once two halves match, the two servers talk to each other directly, and the safety code both phones show lets the two of you check that the relay did not put another server in between.

Where both of you turn messages on for a pairing and confirm the safety code, your texts to each other (with any photos or files) go from your server straight to theirs, signed with that pairing's key. They never pass through our relay or any other server of ours, and we hold no copy. The other person's server keeps its copy as their messages, under their operator's own policy, and sends their phone its own sealed notification. If you also turn on Send typing for that person, your server tells theirs, the same direct way, when you start and stop typing to them (their phone shows it only while your conversation is open there). Neither server's RingReplacer software stores or logs that, and it never passes through our relay; the web server in front of theirs may note the time a request came from your server, with no number and nothing you wrote.

Where both of you turn on internet calls for a pairing and confirm the safety code, and both servers offer them, a call between you can go app to app instead of by phone. Your server and theirs set it up directly, signed with that pairing's key; the sound goes from phone to phone, encrypted (DTLS-SRTP), always relayed through each person's own server's relay (TURN) so that neither phone learns the other's internet address. None of it passes through any server of ours. Their server wakes their phone with the same sealed notification as any internet call, which our relay passes on without being able to read who is calling. Each server keeps its own user's call history, as for any call.

Encrypted conversations

Where your server offers it, a conversation between two RingReplacer apps can be end-to-end encrypted: you and the other person each turn on Encrypt this thread, and it is encrypted only once you both have. Each phone makes its own key and keeps the private part on the phone; only the public part goes to its own server. Messages and attachments are then encrypted on the sending phone for every phone of both of you, and your server (and theirs, if they are on another server) stores only what it cannot read. Not even your server's administrator can read them, and neither can we. Each phone opens the notification for such a message itself; our relay sees what it sees for any notification.

What stays visible to the servers: who wrote to whom and when, on which number, how large a message or an attachment is, and the reactions you add. If your number posts notices to a chat channel, the channel is still told that a message arrived, on which number and from which number, never what it says. Inside an encrypted conversation, server search cannot find the messages, scheduled messages cannot be sent, files too large for a text message, such as videos, cannot be sent, and if a number is given to someone else they cannot read its earlier messages. An encrypted message is never sent as a text message. A new phone can read earlier messages only when the phone that sent them re-sends them to it. Each conversation shows a 30-digit safety number: read it to each other, and if it matches, no other phone was added to your conversation. A phone shows a message only when it was encrypted by a phone of the person you are talking to. Ordinary messages and internet calls are not end-to-end encrypted.

What we do hold

Only what is needed to sell you something and support it:

• Your contact details — name, business name, email address, and any phone number you give us — so we can answer you and send you an invoice.
• Billing records. Payments are handled by our payment processor. We see the amount, the date, and the last four digits of the card. We never see or store the full card number.
• Emails you send us, and our replies, so a conversation makes sense the second time you write.
• Anything you deliberately send for support — a log file, a screenshot, a database copy. Used only for that problem, and deleted when it is closed.

This website

No advertising trackers, no third-party analytics, no cookie banner, because there is nothing to consent to. Our web host keeps ordinary access logs — IP address, page, time — for security and troubleshooting, discarded on its normal schedule. If you email us, you are emailing us.

The company you will actually be sending data to

Your calls and texts travel over Telnyx, under an account in your own name. They are the telecommunications provider and they necessarily handle your call and message traffic in order to carry it — their privacy policy governs that, not ours, and your relationship with them is direct.

We mention this plainly because "self-hosted" can be oversold: your data is not on our servers, but a carrier still carries your calls, exactly as one does for every phone system. The difference is that you chose the carrier, the account is yours, and you can leave either of us independently.

Voicemails are transcribed, and by default your server does the work itself, using a speech model that runs on that machine — in which case no company beyond your carrier receives the recording. Note the wording: the carrier recorded the voicemail and holds it before your server ever downloads it, so "on your own machine" means no second processor, not none at all. You can instead choose a transcription service, in which case the recording is sent to that service to be turned into text. The setting in the admin console says which is which.

The app's permissions

• Contacts — only if you use "Import All Contacts". "Choose Contacts to Import" needs no permission at all: you pick names inside Apple's own screen and the app only ever receives what you tapped.
• Microphone — for calls, which is the product.
• Camera — only when you attach a photo to a message.
• Notifications — so the phone rings.

The app talks to your server and to your carrier. It sends nothing to us. Your server's notifications to it pass through our push relay, as described above.

Keeping and deleting

We keep your account and billing records while you are a customer and for as long afterwards as tax and accounting rules require. Support emails are kept for two years and then deleted.

Your operational data is not ours to keep or delete — it is on your server, and you decide. Ask us to delete what we hold and we will, apart from records we are legally required to retain; email support@ringreplacer.com.

Your rights

Depending on where you live you may have the right to see the personal data we hold about you, correct it, delete it, or receive a copy. Ask and we will do it — there is no form, and the honest answer is usually that the list is short.

Children

This is a business phone system. It is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this in a way that matters, we will email customers before it takes effect. The date at the top always reflects the current version.

Getting in touch

Any privacy question, including a request to see or delete what we hold: support@ringreplacer.com.