Privacy Policy

At Octagon Lab, a company organized under the laws of the United Arab Emirates and the operator of 2Phon, we take your privacy seriously — it is the whole point of the Service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our iOS application available on the Apple App Store and our website at https://2phon.com (collectively, the "Service").

2Phon gives you a real second phone number that you can use to receive verification codes by SMS and to make and receive voice calls, while keeping your personal number private. The Service does not send text messages on your behalf.

By using the Service, you acknowledge that you have read this Privacy Policy and agree to the collection and use of information in accordance with it. If you do not agree with our policies and practices, please do not use the Service.

We collect several types of information from and about users of the Service:

2.1. Information You Provide to Us:

• Account Information: Your email address, password (stored in hashed form), country, and any other details you provide when you register or manage your account

• Communication Data: Messages and information you send to our support team

2.2. Your Second Number and Communications Metadata:

• The second number assigned to you, including its country and status

• Verification metadata: the time a verification code arrived, and the sender or short code

• Call metadata: the numbers involved in a call, the time, duration, and status, for calls you make or receive on your second number

• The contents of incoming verification messages, which we process only as needed to display them to you in the app

2.3. Device and System Information for Attribution and Security:

• We automatically collect limited technical information from your device, including device model, operating system version, application version, language, IP address, and coarse (IP-based) location

• For marketing attribution, we send the query parameters present on our pages, together with your time zone, screen size, and interface style, to our advertising and attribution endpoint at ads.octagon-lab.com

• We use this information to attribute installs to marketing campaigns, measure performance, prevent fraud and abuse, and keep the Service secure

• Where required by Apple's App Tracking Transparency framework, we request your permission before collecting any identifier used for cross-app tracking

2.4. Usage Data:

• Information about how you use the app, the features you interact with, and diagnostic and crash events

2.5. Information from Third Parties:

• If you sign in with a third-party identity provider (for example, Apple), we receive the limited profile information you authorise that provider to share with us, typically an account identifier and, where you permit it, your email address

3.1. Inbound Only: The Service receives SMS verification messages and one-time codes sent to your second number by third-party services. The Service does not send text messages, and you cannot send SMS or MMS messages from your second number.

3.2. Display to You: When a verification message arrives on your second number, we process its contents only as needed to deliver and display it to you in the app so you can complete your sign-up or sign-in.

3.3. Retention: The contents of incoming verification messages are retained only for a limited period and may be deleted automatically. We do not use the contents of your verification messages to serve you advertising, and we do not use them to train generative artificial-intelligence models. See Section 7 (Data Retention) for more detail.

We use the information we collect for the following purposes:

4.1. To Provide and Maintain the Service:

• Assign your second number, deliver incoming verification codes, and connect your calls

• Create, secure, and authenticate your account

• Process subscriptions and manage your access

• Provide customer support and respond to your requests

• Send service communications such as receipts, security alerts, and changes to our terms

4.2. To Secure and Improve the Service:

• Detect, prevent, and investigate fraud, spam, abuse, and security incidents

• Attribute installs and measure the performance of our marketing

• Perform aggregated analytics to understand how the Service is used and to develop new features

4.3. For Legal Purposes:

• Comply with legal obligations and enforce our agreements

We do not sell your personal information. We do not use the contents of your verification messages or your call metadata to serve you advertising, and we do not use your communications content to train generative artificial-intelligence models. Where we process information for marketing, we do so only with your consent or in reliance on a legitimate interest where permitted by law, and you can opt out at any time using the unsubscribe link in any email or by contacting privacy@2phon.com.

We do not sell your personal information, and we do not "share" personal information for cross-context behavioural advertising as defined under the California Consumer Privacy Act. We are not a data broker. We may share your information in the following circumstances:

5.1. Telecom Carriers and Number Providers:

• To provision your second number, deliver verification codes to it, and route your calls, we share the necessary information (such as your number and call metadata) with telecommunications carriers and number providers

5.2. Payment via Apple:

• All purchases are processed by Apple through the Apple App Store. We receive limited transaction information, such as a transaction identifier and subscription status, needed to provision and manage your access. We do not receive your full payment card details

5.3. Service Providers:

• We share personal information with vendors who process it on our behalf under written contracts, including cloud infrastructure providers, attribution and analytics providers, crash reporting and diagnostic tools, and transactional email and customer-support platforms

• These third parties are contractually obligated to keep your information secure and use it only for the purposes we specify

5.4. Affiliates:

• We share certain information with our parent company, Octagon Lab, and its affiliates, including via the advertising and attribution endpoint at ads.octagon-lab.com, for install attribution, analytics, fraud prevention, and the general operation of the Service

5.5. Legal Requirements:

• To comply with applicable law, regulation, court order, or government request, or where necessary to protect the rights, property, or safety of Octagon Lab, our users, or others

5.6. Business Transfers:

• In the event of a merger, acquisition, financing, reorganisation, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any material change in control

5.7. No Sale of Personal Data:

• We do not sell personal data for money, and we have not done so. We do not transfer your personal information to data brokers

6.1. Website Cookies: Our website uses strictly necessary cookies to operate and, only with your consent where required, analytics and preference cookies. You can manage your choices through your browser settings and any cookie controls on the website. Disabling essential cookies may impact website functionality.

6.2. App Analytics: Our app uses SDKs and similar technologies for analytics, attribution, and crash reporting to operate, secure, and improve the Service. As described in Section 2.3, we send page query parameters together with your time zone, screen size, and interface style to ads.octagon-lab.com for marketing attribution.

6.3. App Tracking Transparency: Where required by Apple, we request your permission before collecting any identifier used to track you across other companies' apps and websites. You can review and adjust tracking permissions in your iOS Settings.

We retain your information only for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

• Account Information: Retained while your account is active and for a limited period thereafter to comply with legal, tax, and accounting obligations and to defend legal claims

• Verification Message Contents: Retained for a limited period and may be deleted automatically

• Communications Metadata: Call and verification metadata are retained for the periods required by applicable telecommunications and accounting law and for fraud prevention

• Diagnostic and Crash Logs: Diagnostic logs are retained for up to 90 days and crash logs for up to 180 days

If you close your account, we delete or de-identify your personal information within a reasonable period, subject to any retention we are legally required to maintain. Your second number may be released and re-assigned after your subscription ends. You can request deletion at any time by contacting privacy@2phon.com.

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorised access, alteration, disclosure, or destruction:

• Encryption in Transit: Data transmitted between your device and our servers is encrypted using TLS 1.2 or higher

• Encryption at Rest: Stored data is encrypted

• Access Controls: Least-privilege, role-based access controls and authentication restrict access to data on a need-to-know basis

• Audit Logging: We maintain logs to support monitoring and investigation

• Ongoing Review: We monitor our systems and periodically review our security controls

• Secure Payments: Payment processing is handled by Apple through the Apple App Store

No method of transmission over the Internet or electronic storage is perfectly secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential, enabling device-level protections such as a passcode or biometric lock, and promptly notifying us at support@2phon.com if you suspect unauthorised use of your account or second number.

Depending on where you live, you may have the following rights regarding your personal information:

9.1. Access and Portability:

• Request access to the personal information we hold about you

• Receive a copy of your data in a portable, structured, commonly used, and machine-readable format

9.2. Correction and Update:

• Correct inaccurate or incomplete information and update your account information at any time

9.3. Deletion:

• Request deletion of your personal information and delete your account

9.4. Restriction, Objection, and Consent:

• Restrict or object to certain processing, opt out of marketing communications, and withdraw consent where consent is the legal basis

9.5. How to Exercise Your Rights:

• You can access, correct, and delete your account and associated data from within the 2Phon app under account settings

• You can also email privacy@2phon.com or use our Support page (https://2phon.com/support/) to make a request without re-downloading the app

• We respond to verified requests within the periods required by applicable law (typically within 30 days, extendable for complex requests)

We will not discriminate against you for exercising your privacy rights. We may need to verify your identity before fulfilling a request, and we may be unable to grant a request where an exception under applicable law applies. If you are in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority.

The Service is intended for adults and is not directed to children. The Service is not intended for users under the age of 18, and we do not knowingly collect personal information from minors. Consistent with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe a child has provided us with personal information without your consent, please contact us at privacy@2phon.com and we will promptly delete that information.

Because our team, our affiliates, and our service providers operate from multiple countries, and because numbers and calls are provisioned through carriers in many jurisdictions, your personal information may be transferred to, stored, and processed in countries other than your country of residence, which may have different data protection laws.

When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary technical and organisational measures. A copy of the relevant safeguards is available on request at privacy@2phon.com.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy

• Provide a more prominent notice (such as an in-app message or email) before the changes take effect, where required

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any changes take effect indicates your acceptance of the updated policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Octagon Lab — Privacy Team

Email: privacy@2phon.com

Support: support@2phon.com (https://2phon.com/support/)

Address:

Dubai Silicon Oasis, A1 Building

Dubai, United Arab Emirates

When you contact us about a privacy matter, please include enough detail for us to verify your identity and respond to your request.