JunkMute

Privacy Policy

Last updated: November 6, 2026

1. Controller

Controller: JunkMute, an independent app developer ("we"). Contact: support@junkmute.app.

2. Summary

  • Classification of messages and calls happens only on your phone. Message text, senders and numbers do not leave your device by default.
  • Usage statistics are optional and off by default.
  • Sending a spam report is optional; each report needs your separate, explicit consent.
  • We use no advertising or analytics SDKs. We do not track you, sell your data or share it for advertising.

3. Data processed on your device (not sent to us)

On Android the app reads notifications from supported messaging apps (via the Notification access permission) and screens incoming calls (via the call screening role) to decide whether they are spam. On iOS it uses the system message filter and call directory extensions. This happens on your device. The app does not collect your contacts, call history, location or advertising ID. Your message stays in your messaging app; on Android only its notification may be hidden.

Stored on the device: your settings, your own allow/block lists and (Android) an encrypted 30-day log of blocked items. None of it is sent to our servers. It is deleted when you uninstall the app or clear its data, and you can delete the log in the app.

4. Optional: usage statistics (Class A)

  • When: Only if you explicitly enable it during setup or in settings. You can turn it off at any time.
  • What is sent: Once a day, one aggregate counter pack: country, platform, engine/rules/manifest versions, package type (stable/candidate), day; and counts per decision, rule ID, text completeness, profile closure and feedback.
  • What is not sent: Message text, sender, phone number, a persistent device or install ID, session chains. IP addresses are not stored.
  • Verification: To limit fake data, device attestation (section 6) may be attached; packs that fail verification are excluded from aggregate results and rollout decisions.
  • Purpose: Measuring the safety of rules and staged rollouts, detecting false positives.
  • Retention: Raw daily rows are deleted within 14 days after aggregation; aggregate counters are kept for 400 days. Totals from fewer than 5 devices are never shown in any report.
  • Legal basis: Consent (GDPR Art. 6(1)(a); KVKK basis to be assessed by counsel). Withdrawing consent does not affect past processing.

5. Optional: spam reports

  • When: Only when you choose to send one: (a) in the app's Test screen with "Report to JunkMute", after a preview that shows exactly what will be sent; or (b) on iPhone, when JunkMute is chosen under Settings → Apps → Phone → SMS/Call Reporting and you tap Report on JunkMute's sheet after "Delete and Report Junk". The sheet says what is sent before you confirm.
  • What is sent: whether it is a message or a call; the sender (name or number); for messages, the message text masked on your device and again on our server: every run of 4 or more digits (codes, phone, card, account and ID numbers), e-mail addresses and the path and query of links are removed, at most 500 characters; the host names of links; country, platform, app and rules version; for reports from the Test screen, the app's own decision. Names and other words in the text are not removed; please don't report messages that contain personal details about you.
  • What is not sent or stored: no device ID, account, reporter ID or pseudonym. Reports cannot be linked to you or to each other. Your IP address is used by our hosting provider to deliver the request and is not stored by us.
  • Purpose: improving the spam rules. A sender that several people report is reviewed by a person before it is added to any list.
  • Retention: reports are deleted automatically after 30 days.
  • Legal basis: your consent, given for each report.
  • Deletion: because reports carry nothing that identifies you, we cannot find "your" reports; they are deleted automatically after 30 days.

6. Device attestation (App Attest / Play Integrity)

To verify that statistics packs (section 4) come from a genuine, unmodified app we use Apple App Attest on iOS and Google Play Integrity on Android. The purpose is to prevent fraud and bulk fake submissions, not to profile you. On iOS the attestation key ID is stored on the server for verification; the report database stores only the pass/fail result, and raw attestation tokens are discarded. For statistics the key ID is not stored; a day-salted digest is used only to prevent duplicate submissions on the same day. Apple or Google may be contacted during verification and are subject to their own privacy policies.

7. Subscriptions (RevenueCat)

We use RevenueCat, Inc. (processor) to manage purchases and subscription status. RevenueCat receives an anonymous app user ID and purchase/subscription status. Your payment details stay with the App Store or Google Play and do not reach us. Legal basis: performance of a contract.

8. Third parties and international transfers

Server-side we use Cloudflare, Inc. (Workers, D1, Pages); RevenueCat, Apple and Google are involved as described above. These providers may process data outside your country. Transfers rely on standard contractual clauses or equivalent safeguards and, for Turkey, KVKK Art. 9. We do not sell your data or share it for advertising. We may disclose information to authorities where legally required.

9. Security

Data in transit is protected with TLS. Data classes are held in separate databases; the report database does not contain your reporter ID; access is restricted. No system is perfectly secure.

10. Your rights (GDPR and KVKK)

You may ask whether we process your data, request access, rectification and erasure, restrict or object to processing, request portability, withdraw consent at any time, and complain to a supervisory authority (in Turkey: the Personal Data Protection Board). Under KVKK Art. 11 you may also learn the purpose of processing and the recipients, and claim compensation for damage.

Contact: support@junkmute.app. We respond within 30 days. We may need to verify your identity; for pseudonymous data we may ask for information showing the data is yours (for example the report date and content).

11. Deleting your data

  • On-device data: uninstall the app or clear its data; the activity log can also be cleared in the app.
  • Usage statistics: turn them off in settings; retention periods in section 4 apply to packs already sent.
  • Report data: the process in section 5.
  • Subscription records: RevenueCat and store records are subject to legal retention duties; you manage the subscription in the store.

12. Children

The app is not directed to children under 13 (or the age required in your country), and we do not knowingly collect data from children. If you believe a child has sent data, contact support@junkmute.app.

13. Changes

We may update this policy. We will announce material changes in the app or on this page, and ask for renewed consent for new processing that requires it. The date at the top shows the current version.

14. Contact

JunkMute — support@junkmute.app