Privacy

Last updated 30 September 2026

Doorman holds calls, texts and app notifications you did not invite, and tells you afterwards what it held. This page says exactly what that involves, which parts reach our server, who else handles them, and for how long. It includes the part we cannot make a comfortable claim about.

Who is responsible

Operator: [to be confirmed before public launch]. The legal entity that controls this data, and its postal address, will be named here before Doorman is offered to the public. This paragraph is pending counsel review. Until then, write to privacy@mydoorman.app and a person will answer.

Doorman is in a private pilot

Doorman runs today on a handful of Android phones, by invitation. Nothing is for sale. The Live Line is running in that pilot, so everything this page says about it is happening now, not planned.

What stays on your phone

Screening calls on your own number, and the door that holds texts and app notifications, both run on the device. The records they keep are stored on the phone and are not sent to us.

What a record contains

• A one-way fingerprint of the phone number, not the number. Numbers are hashed with SHA-256 and shown to you in a masked form such as +1•••••0142.
• For an app, its package name. That is not a secret and it is what you act on.
• The decision, the rule that produced it, and a plain-English reason.
• The time it arrived.
• For a call, the region an area code belongs to, worked out from a fixed table on the device. This is geography, not caller identity, and it involves no lookup and no network.

How long

You choose: 7, 30 or 90 days. The default is 30. Deletion is real code that runs when the app starts, not a sentence in a policy, and you can also clear the history immediately from Settings.

What Doorman reads, and what it does not

• Your messages. Doorman sees who a notification came from and which app sent it. To show you a held message and let you reply to it, the app reads the message text from the notification, in memory, on the phone. It never stores that text, never writes it to the log, and never sends it anywhere.
• Your contacts. Doorman has no contacts permission. Android puts a saved contact's name on a notification or call before Doorman sees it, so a name means someone you know and a bare number means a stranger.
• Your texts and call log. Doorman holds no SMS, call-log or phone-state permission. Your call log is written by your phone's dialler, not by us.
• Your calls. Doorman never records a call on your phone. The Live Line, which runs on a number we operate, does hear the caller; what it keeps is set out under The Live Line below.
• Your microphone. Used only while you hold the microphone button in Ask Doorman. Your words are recognised on the phone itself, you see the text and can edit it, and only that text is sent — never the audio. Type instead and the permission is never asked for. On a watch, voice input uses the watch's own system recogniser, asked to stay on the watch.

The Live Line, and the claim we will not make

The Live Line is a phone number Doorman operates. Your carrier forwards the calls you decline or miss to it. Doorman answers, says it is Doorman, and asks who is calling and why. What the caller says is written out and sent to your phone, and you choose: Answer, Message, Block, or a follow-up question.

When the Live Line handles a call, our server processes:

• The caller's number, the time, and the reason they gave, in their own words or as a key they pressed.
• The caller's spoken introduction, turned into text so it can be shown to you while they hold. Only the introduction and any follow-up answer are transcribed.
• Doorman does not record or transcribe the conversation after you answer. Answer connects the caller to your phone. We keep that the call happened and how long it lasted.
• A message, if the caller leaves one. It is recorded and transcribed so you can read it. The caller hears a recording notice before being asked to leave the message. When live listening is enabled, capture starts just before the notice so you can hear it too.
• Your own mobile number, so that Answer can connect the caller to you, and an identifier for your device. Your number is never shown to a caller, and it is forgotten when your last line is released.
• A receipt for every call, saying how it ended: connected, sent to messages, blocked, timed out, or the caller hung up.

Doorman deletes the playable message recording from its telephone provider account after transcription if you did not choose to keep audio. If you keep it, the app saves it to your phone and Doorman deletes that provider recording once your phone confirms the save. If the phone never collects it, Doorman deletes it when your retention period ends. The text remains until your chosen retention period. Provider backups, service logs, and speech-processing data may follow separate retention rules; deleting the recording resource does not erase those systems.

Messages the line records itself. When your phone makes the words for your messages, the line records the caller itself instead of asking the telephone provider to: the audio comes straight from the call, uncompressed, and Doorman does not request a separate provider message recording. The recording starts a moment before the caller hears that their message is recorded, so that notice is part of the recording — the app starts playing where the caller does. Our server holds that audio only until your phone collects it, usually within seconds, and deletes it the moment your phone confirms; if your phone never does, it is deleted when your retention period ends. If our recording cannot start, the provider records the message as before, so a caller is never left talking to nothing.

Following a message as it is left. While the line records a caller itself, your phone can follow along: the app shows that someone is leaving a message, can play their voice as they speak, and can show their words, made by your phone's own speech engine. The audio travels from our server to your phone only, over an encrypted connection that only your device's credential can open, and nothing extra is kept: the message itself arrives as usual when they finish. If you pick up, the recording stops before the call is connected, the part they had said is not kept, and Doorman does not record the conversation after connection.

Read aloud. Doorman can read a message's words aloud with your phone's own voice, labelled as Doorman reading and not the caller. It uses only voices that run on the phone, so the words never leave it.

If you turn on on‑phone transcription ("Sharper transcripts"), the app downloads a ~40 MB speech-recognition model, once, from the Vosk project (alphacephei.com). That download is the only time this feature touches any network: your messages are transcribed on the phone itself, and no audio and no words are sent to anyone — not to us, and not to the model's publisher. On phones whose own speech engine can work offline (Android 14 and later), Doorman uses that engine instead: it runs on the phone, needs no download, and sends nothing anywhere. Words it is unsure of are shown greyed, as a guess. When your phone makes the words and you keep the audio, it also stops asking the telephone provider for a transcript, once; the switch in Settings is yours after that.

Clearer playback. A message you keep can play as recorded or “Clearer”. Clearer cleans up how it sounds on your phone: volume, background boom, and the voice tones the phone line dulled. It is a fixed filter with no AI in it, so it changes how a message sounds, never what was said. The original is always kept beside it, untouched, and is what the transcript is made from. Doorman never builds a model of a caller's voice, never identifies anyone by their voice, and never makes a caller appear to say anything.

Doorman uses callers' words to deliver the service to you. Doorman does not train its own models on them or sell them. The telephone and speech providers that process a call have separate terms, described below.

When a caller is holding, we alert your phone through Firebase Cloud Messaging, Google's push service. The alert can carry a one-line summary of the caller. On the lock screen, the caller card hides the words and the number until you unlock.

Our logging filter strips anything shaped like a phone number or a credential before a line is written, and request bodies are not logged.

Ask Doorman, and Doorman's own voice

You can tell the line how to behave in ordinary language, typed or spoken — “only let approved callers ring”. The text (never audio) goes to Doorman's hosted assistant, which proposes a change. Before it goes, names and numbers you have saved on the line are replaced with placeholders, and a request that contains something like a phone number, an email address, a link or a credential is refused rather than sent.

Nothing changes until you confirm. Sensitive changes, such as closing the line or lifting a block, also need your phone's screen lock or fingerprint: the confirmation is signed on your phone and the signature is checked on our server. Your PIN and fingerprint never leave the phone. An applied change can be undone. Proposals are kept for 30 days.

Doorman can also speak in the app, if you turn its voice on. The sentences it reads are its own — a greeting, a proposal, a receipt — and they are rendered into audio by the same hosted service.

Your watch

Doorman's Wear OS app is a companion to the phone. The phone sends it summaries of recent knocks, the door's state and the line's mode over Google's Wearable Data Layer, the channel Android uses between a phone and its watch. Android may also mirror Doorman's notifications to the watch, as it does for any app. Voice input on the watch uses the watch's own system recogniser.

Counts, and diagnostics

The app and the server keep a fixed list of anonymous, named counts — “set-up finished”, “how long an alert took to arrive” — so we can tell whether a feature works. No device, number or words are attached to them. There is no third-party analytics, advertising or crash-reporting code.

Diagnose a problem, under Pilot support in Settings, is something you start. It records which screens opened, which buttons you used, door decisions by code, and whether each request to our server worked. You read the whole report before it is sent, and you can discard it. It never contains phone numbers, names or message text, and it is identified only by a support code. How it works.

Who else handles it

These companies handle data to deliver the features named below. Their own service records and permitted processing may have separate terms and retention periods.

• Telnyx — the Live Line's phone numbers, the calls themselves, and message recordings. Its data-processing terms permit some independent uses of service data and de-identified content. We are seeking written confirmation of the retention and downstream speech-processing terms for this service.
• Deepgram, through Telnyx — turns a Live caller's spoken introduction into text.
• Google, through Telnyx's default transcription engine — turns a recorded message into text. Not used for your messages while "Transcribe messages only on this phone" and "Keep the audio of messages" are both on; your phone then does it, and no company does.
• Firebase Cloud Messaging (Google) — delivers Live Line alerts to your phone. An alert can carry a one-line caller summary.
• Doorman's hosted assistant, built on OpenAI's models — turns the text of an Ask Doorman request into a proposal, and renders Doorman's own spoken lines. OpenAI receives that text; it never receives a caller's words or voice.
• Google's Wearable Data Layer — carries recent-knock summaries from your phone to your watch.

How long each thing is kept

• History on your phone, and Live Line records (calls, receipts, transcripts, messages): 7, 30 or 90 days, as you choose in Settings. 30 by default. One setting governs both.
• Message recordings: Doorman deletes the playable provider recording after transcription — or, if you keep audio, after your phone confirms it holds the copy. A copy your phone never collects is deleted when your retention period ends. This does not set the provider's retention for backups, service logs, or speech-processing data. Audio you keep lives on your phone under the same 7/30/90-day setting, except messages you pin with Keep.
• Ask Doorman proposals: 30 days.
• Your own mobile number: until your last line is released.
• A diagnostic you sent: on the same schedule as Live Line records, or sooner if you email us its code and ask.

To have everything on our side deleted now, see deleting your data.

Payments

Nothing is for sale during the pilot, so no payment is taken. At launch, purchases will be handled by Google Play. Doorman will never see or store your card, your billing address or any payment detail; we will ask Google Play what you own, and keep only that answer.

Permissions, and why each one exists

Five are declared by Doorman itself:

• Internet. The Live Line, Ask Doorman, Doorman's voice, the anonymous counts, and a diagnostic you send.
• Do Not Disturb access (notification policy). Do Not Disturb is the only mechanism Android evaluates before a notification makes a sound, so it is how the door holds a text silently. Doorman registers its own rule and never edits the Do Not Disturb settings you chose for yourself.
• Post notifications. A twice-daily note of what the door held; a caller holding on your Live Line, with Answer, Message and Block; a card for a Live caller you missed; the timer while a verification code is let through; and the knock test you start yourself.
• Microphone. Only for dictating to Ask Doorman, only while you hold the button. See above.
• Biometric. To confirm a sensitive change to your line with your screen lock or fingerprint.

Five more are added by the Google libraries the app is built with:

• Network state, to know whether the phone is online.
• Fingerprint, the older name for the biometric permission, for older versions of Android.
• Wake lock, so a Live Line alert can be handled while the phone is asleep.
• Receive push messages, for Firebase Cloud Messaging.
• Google Play billing. Added by the billing library. Nothing is sold during the pilot.

And two kinds of special access you grant in Android's settings:

• The call screening role, so Doorman can decide which calls ring.
• Notification access, so the door can see what arrived, record what it held, and show you a message to reply to.

Every item above can be taken back by you at any time, in Android's own settings.

Children

Doorman is not directed at children and we do not knowingly collect anything from them.

Changes

If this page changes in a way that affects what we handle, we will say so in the app rather than quietly updating the date at the top.

Contact

Questions, or a request about your data: privacy@mydoorman.app. To delete everything, see deleting your data.