Privacy Policy
Last updated: September 6, 2026
SussOut is a personal security app. Privacy is central to how it is built: we collect the minimum information needed to provide the service, and nothing more.
Information we collect
- Phone number and email address: provided by you when you create an account, used to operate and secure your account.
- First name: provided by you, shown to people you interact with in the app.
- Basic device information: used to keep your account secure.
Information we do not collect
- We do not upload your contacts. Your address book stays on your device. To tell you who else uses SussOut, we send scrambled (hashed) versions of phone numbers, which we check and discard. We never receive names.
- We do not record, listen to, or read your calls or messages.
- We do not store IP addresses. We do not keep a record of where you were when you used the app.
- We do not sell or share personal information with advertisers or data brokers.
- This website sets no cookies and uses no analytics or trackers.
Who sends your verification text
To prove a phone number belongs to you, we have to hand it to a company that can send a text message. Depending on the route, that is Google (Firebase) or Twilio, and sometimes both, if the first one cannot get through. Whichever company sends it receives your number and keeps it under their own policies, which we do not control. We delete our own copy of the Google sign-in record within seconds of the check passing.
We also use Google for push notifications, which means Google holds an anonymous token for your copy of the app, and Apple's App Attest to confirm the app is genuine and not a copy someone has tampered with. Neither of those carries your number, your email, or your name.
Other companies that help us run SussOut
- Resend sends our account email, so it receives your email address.
- Sentry receives crash reports. Personal information is stripped out before anything is sent: no phone numbers, no email addresses, no names, no screenshots.
- Railway hosts our service and its database.
What we record about who you verify with
We keep each verification request for 30 days, then delete it. We also keep a shorter note that the two of you have verified with each other, and when it last happened, and that one lasts longer. It is what lets us show you their name when they ask you to confirm, instead of just "Someone". If the two of you stop verifying, it is deleted 400 days after the last time. We never share who you verify with, and your family plan owner does not see it either.
Your history, safe words, and saved questions
Your verification history stays on your phone. With Premium you can also back it up so it follows you to a new phone. The backup records what happened and when, plus a scrambled version of the other person's number, never their name from your address book.
Safe words and saved questions are yours. They stay on your phone unless you turn on backup. If you do turn it on, we store them encrypted, with the key kept separately from the database, so a stolen copy of the database cannot read them. We hold that key, so this is not end-to-end encryption: we could read them, and we do not. We never generate, suggest, or check them, and we never show them to the other person. Deleting your backup or your account deletes them.
Family plans
If someone covers you on a family plan, they see only what you agree to, and only these events. They never see who you verify with, or anything you have written. You can turn this off, or leave the plan, at any time.
- You decline a verification from an unknown number
- Someone repeatedly tries to verify against your account
- Your phone number, name, or email is changed
- A new device tries to register on your account
- You sign in after a long time away
- An account reset is started on your account
They are also told if you leave the plan, because it is a seat they are paying for. That tells them nothing about you except that you left.
How we use your information
We use the information above to create and secure your account, to provide the app's features, and to send transactional messages related to your account, such as confirming your email address, confirming a new sign-in, or notifying you when your account details change. We do not send marketing email.
How long we keep it
We keep account information for as long as your account is active. Records of verification requests are deleted after 30 days, and so are the security records that point at them. The note that you and another person have verified is deleted 400 days after the last time you did. Deleting your account deletes all of it straight away, including anything you have backed up.
Companies that send our texts and email keep their own records under their own policies, and deleting your account here does not reach those.
You can contact us at any time to ask about or request deletion of your information.
Children
SussOut is not directed at children under 13, and we do not knowingly collect information from them.
Changes
If this policy changes, we will update this page and the date above.
Contact
Questions about privacy: hello@sussout.app