Privacy Policy
This page describes what the Fronic Android app and the signaling server it talks to collect, why, and for how long. Fronic is built around one goal: the two people on a call or in a conversation are the only ones who can read it — not Fronic, not the signaling server, and not a network in between. That goal shapes what follows: this policy is short because there genuinely isn't much to collect.
For the legal terms governing use of the app itself, see the End User License Agreement, also shown in full on first launch and in Settings → Info → EULA.
What the signaling server holds
The signaling server's job is routing: helping two phones find each other to set up a call, the same job a phone book or a SIP registrar does. Its registration table holds, only for as long as a number stays registered:
| Data | Purpose | Retention |
|---|---|---|
| Phone number | Identifies the line being registered | Until the number is unregistered or replaced |
| Alias (optional) | A display name shown to callers instead of a raw number | Until changed or removed |
| Push address | Where to deliver a ring (UnifiedPush endpoint, self-hosted — no Google/Firebase involved) | Until the number is unregistered or replaced |
| Device public key | Verifying that call setup requests really come from that device (see Cryptography) | Until the number is unregistered or replaced |
| SIM-confirmed or hand-typed | Whether the registered number was read from a SIM on the device during setup or typed in by hand — operator visibility into that only, not shown to callers | Until the number is unregistered or replaced |
| Prekey bundle (public keys only) | Lets another device start an encrypted conversation with yours without either device needing to be online at the same moment — the same purpose a public key server serves for any end-to-end encrypted messenger. Contains only public signing and key-exchange material; no private key ever leaves your device. | Until the number is unregistered or replaced (removed immediately on delete-account, not left behind); one-time prekeys are consumed and replaced as conversations are started |
Who is calling whom is tracked only for the few minutes a call takes to connect, held in memory only, never written to disk, and discarded the moment the call connects or times out.
Fronic's operator can block a specific phone number or alias from registering or placing calls, solely to stop abuse of the service (for example, a number used to harass others); this affects only whether that number or alias can use the service, and involves no additional data collection.
Text messages, photos, videos, and voice messages are end-to-end encrypted on your device before they ever reach the signaling server, which cannot read them. A text message or a small photo is held in the recipient's mailbox, in memory only, until their device fetches and acknowledges it (a message is capped at 640 KB; a mailbox holds at most 16 MB per number and 256 MB across every number, oldest and heaviest senders trimmed first if that fills up, and anything unclaimed for 14 days is dropped regardless); nothing here is written to disk, and a server restart clears every pending message. A video, voice message, or larger photo instead goes to a short-lived relay: still fully encrypted ciphertext, written to disk only until the recipient downloads it (capped at 64 MB per file, 256 MB per sender, 1 GB in total, deleted on download, after 7 days at the latest, or immediately on a server restart). Deleting an account also immediately clears whatever was still sitting in that number's own mailbox — a message queued there before a deletion is dropped at that moment, not left to expire on its own.
What is never collected
Fronic keeps no call history on the server, uploads no contacts, runs no analytics or crash-reporting SDKs, and cannot access the content of a call, a message, or a photo, video, or voice message at any point — every handshake and every message is end-to-end encrypted on your device, so the signaling server (and anyone who compromised it) never holds a key that could decrypt any of it.
On-device data
Call history, the speed-dial list, any alias you set for a contact, and your conversations — including photos, videos, and voice messages you send or receive — stay only on your device, in Android's own app-private storage, encrypted at rest with a key held in the device's own hardware-backed Keystore. Fronic has no cloud backup of any of it (backups are explicitly disabled in the app's manifest), and a photo or video cannot be copied or shared out of the app once received. You can delete this at any time from within the app: Settings → Privacy has an auto-clear timer for call and message history and a panic-wipe option that instantly and irreversibly destroys the encryption key protecting your messages and attachments (and tries to erase the same conversation from the other person's device too, where reachable), and uninstalling the app removes everything else.
Android permissions
| Permission | Why Fronic asks |
|---|---|
| Microphone | Call audio. Only active during a call. |
| Notifications | Showing an incoming call and call-status updates. |
| Contacts (optional) | Showing your own contact's name instead of a raw number for an incoming/outgoing call. Calling works fully without granting this. |
| Phone state / phone numbers (required) | Reading the number(s) on a SIM already in the device, to fill in the setup screen's country/number field and lock it to that number. Required to get past setup — Fronic uses this to tell a SIM-confirmed number apart from one typed by hand, which matters for whether an already-registered number can be reclaimed on a new device. A device with no SIM, or one Android can't read a number from, still gets a manual-entry fallback once the permission itself is granted. Whether the number came from a SIM or was typed is sent once at registration and kept server-side (see the signaling-server table above); the number itself was always sent either way. |
| Internet / network state | Reaching the signaling server and carrying call media. |
None of these are used to build a profile, serve ads, or share data with a third party. Fronic has no ad network and no analytics SDK in it at all.
Optional: routing over Tor
Settings → Network has an option to route signaling traffic through Orbot (Tor). This is off by default and entirely your choice; enabling it does not change what the signaling server stores, only how your device's traffic reaches it.
Link previews
If you type a link into a message, your own device fetches that page directly to build the preview card (title, description, a small image) before the message sends — Fronic's servers are never involved in this and never see the link. That means the site you linked to sees a request from your device's own IP address, the same as opening it in a browser, and receives nothing about who you're sending it to. The person you're messaging never fetches anything themselves; they only see the preview card you already built. Nothing about the fetch — the URL, whether it succeeded, or why it failed — is logged anywhere.
Third parties
Fronic does not use Google Play Services, Firebase, or any other push provider for call delivery — push wake-ups run over UnifiedPush, self-hosted by Fronic. Registering a phone number for the first time, and deleting an account, are verified by Google Play Integrity wherever the device supports it: Google briefly attests that the request comes from a genuine, unmodified copy of Fronic. No phone number or call content is included in that check.
On a device Play Integrity cannot verify, Fronic offers a choice of fallback verification channels instead, each used only if you pick it:
- WhatsApp. Your device opens WhatsApp with a one-time code pre-filled and lets you send it to Fronic's own WhatsApp number; Fronic never messages you first. WhatsApp (Meta) sees that your number sent that one message to that number, the same as messaging any other WhatsApp contact.
- Telegram. Fronic asks Telegram's official Gateway API to deliver a verification code to your number over Telegram. Telegram sees the phone number for the purpose of that one delivery.
- Email. An email address you type in is used once, to send that code, and is not otherwise stored or linked to your Fronic registration.
If you install Fronic from Google Play, Google's own standard Play Store data (e.g. install/update delivery) is covered by Google's own privacy policy, not this one.
The fronic.net website
This website sets no cookies and runs no analytics or tracking. Web server logs retain IP address and request metadata briefly for security and are not used for tracking. See the Cookies page for the full statement.
Data deletion
Settings → Account has a Delete account button: confirm, and it's gone immediately (verified either by Play Integrity, or, on a device Play Integrity cannot check, by a code delivered over WhatsApp, Telegram, or email as described above). Your number, alias, push address, device verification key, and prekey bundle are all removed from the signaling server's registration table immediately, with no retention period afterward. Any photo, video, or voice-message ciphertext of yours still waiting in the attachment relay at that moment is unaffected by the deletion itself, but is still deleted automatically, at the latest, once the seven-day limit described above passes. Simply letting a number go unused removes the same things, just without you asking for it first. There is no account to delete beyond that, because there is no account — a phone number is the only identifier Fronic ever holds, and only while actively registered. See Delete Your Data for the full breakdown, including a fallback if you no longer have the app or device to do this from.
Deleting the app, or using the in-app panic-wipe feature, separately destroys your on-device messages, photos, videos, and voice messages: see On-device data above. Neither of those is something Fronic's servers can do for you, because the servers never hold your conversations to begin with.
Changes to this policy
If this policy changes in a way that affects what's collected, the "Last updated" date above changes with it. Material changes will also be reflected in the app's own EULA version prompt, the same mechanism used for legal-term changes today.
Contact
Questions about this policy: contact@fronic.net