Política de privacidad

Effective: October 5, 2026 · Last updated: October 5, 2026 · Version: v1.1

JBX Huddle LLC, a Delaware limited liability company ("JBX Huddle," "Nomer," "we," "us"), operates the Nomer mobile app (the "App") and getnomer.app (the "Site"), together the "Service." The Service is offered to users in the United States only.

1. Plain-English summary

Nomer is a tool for logging spam calls and texts and preparing your own complaint and claim documents. We collect your account details, the spam reports you submit, the information you enter into documents, and basic device and usage data. Service providers host our data, run AI drafting, place callback calls if you turn Callbacks on, process payments, and print and mail letters you buy. We do not sell your personal information, we do not use it for advertising, and we do not track you across other apps or websites. Deleting your account deletes your data, subject to the limited retention rules in Section 11.

2. Scope

This policy covers data collected through the App, the Site, and communications we control. Third-party services you use alongside Nomer, including Apple, government agencies, courts, carriers, and any recipient of a document you send, operate under their own privacy policies and are not covered here. If you do not agree with this policy, do not create an account or use the Service.

3. Information we collect

3.1 Information you provide

• Account data: Sign in with Apple identifiers (which may include a private relay email), email address, and the mobile phone number you verify by sending a text message from it to Nomer. We do not send you sign-in codes.

• Profile data (optional): name, phone number(s) you want to protect, and state of residence.

• Spam reports: the number or sender ID that contacted you, date, time, call or text type, message text, screenshots, voicemail transcripts or recordings you choose to upload, notes, and whether your number was on the National Do Not Call Registry.

• Document data: information you enter so the App can prepare a complaint, demand letter, or claim form, such as legal name, mailing address, county, the defendant's details, and your signature. You decide what to enter, and you review every document before using it.

• Support and feedback: messages you send to [email protected] or through the App.

• Pilot waitlist (Site): if you join the pilot on the Site, your email address, state, whether you use an iPhone and which iOS version, how you heard about Nomer, a record of your consent to pilot emails, and a salted hash of your IP address used to prevent abuse.

3.2 Information collected automatically

• Usage data: features used, named in-app events, and session timing. We do not record screens or sessions.

• Device data: device model, OS version, app version, language, and an anonymous identifier generated by our analytics provider, PostHog, which is not linked to your account. We do not collect the IDFA advertising identifier. Separately, the App registers your device (a device identifier, push token, and app version) with your account so it can deliver notifications and accept reports from iOS.

• Diagnostics: crash logs, error traces, performance data.

• IP address: used for security, rate limiting, and abuse prevention, and kept only in standard hosting logs (Section 11), except the salted hash stored with a pilot waitlist sign-up.

3.3 Information from third parties

• Apple: subscription status and transaction identifiers through StoreKit. We never receive your card details from Apple.

• Apple Push Notification service: a push token, if you enable notifications.

• Stripe: if you buy a mailed letter, Stripe collects your payment details (card or Apple Pay) directly and tells us the payment status and transaction identifiers. We do not receive or store your full card number.

• iOS reporting and sharing (if you use them): when you tap Report on a call or message in the Phone or Messages app and choose Nomer, iOS sends Nomer the sender's number, the time, and, for a message, its text, through our reporting gateway. When you share a voicemail or screenshot to Nomer, we receive that file and, where iOS provides it, the number that called. Nomer's call-blocking list stays on your device, and iOS sends Nomer nothing from it. These features cannot read your contacts, call history, or messages you do not report.

• Spam-intelligence sources: public complaint data, aggregated reports from other Nomer users, number-lookup services, and public business registries, about phone numbers and companies, not about you.

3.4 What we do not collect

We do not collect your contacts, calendar, full call history, full SMS inbox, precise GPS location, microphone or camera data (except media you choose to upload), biometrics, health data, browsing history, social-media data, or government ID numbers. Do not upload Social Security numbers or financial account numbers to the Service; redact them from screenshots and documents.

3.5 Callbacks: AI calls to numbers you report

If you turn on Callbacks, Nomer's AI voice agent (powered by Vapi, with telephone service from Telnyx) calls numbers you report, from a Nomer phone number, to learn which company is behind the call. Nomer may place a callback automatically when our other checks do not identify the company, and may try again up to two more times if no one answers. The agent speaks as an ordinary caller, asks who is behind the offer, may follow a transfer, and does not deny being an automated assistant if asked. Each call lasts up to about five minutes. You are never on the call, and the agent never gives your name or phone number. The agent records and transcribes the call; recordings and transcripts contain the voices, statements, and phone numbers of the people on the call. In states that require every party's consent, and when the location of the number is unknown, the agent announces at the start that the call is recorded. We use recordings and transcripts to identify the company behind the number, fill in your reports, and prepare evidence for documents and submissions you choose to make. Your recordings and transcripts are deleted when you delete your account. The company facts learned on a callback are shown to other users who reported the same number, without identifying you.

4. Information about other people

Spam reports necessarily include information about the caller or sender, such as a phone number, business name, or message content. We use it to identify repeat offenders, compute aggregate spam scores, notify carriers (Section 8), and pre-fill documents you choose to prepare. You may submit only reports about calls or texts you actually received.

5. How we use information

• Create and secure your account.

• Provide, maintain, debug, and improve the Service.

• Identify and score spam numbers across reports.

• Prepare draft documents at your direction.

• Process subscriptions and enforce entitlements.

• Send push notifications (opt-in) and messages required to provide the Service.

• Respond to support requests.

• Detect fraud, false reporting, and abuse, and enforce our Terms.

• Comply with law and protect our rights.

• Produce aggregate, de-identified statistics.

We do not sell personal information, use it for behavioral advertising, or let AI providers train their models on it.

6. AI processing

Nomer uses large language models, accessed through OpenRouter, to summarize reports, read screenshots and voicemails you share, classify messages, and draft documents. AI features that read your reports require your consent in the App. To research the company behind a number, we also use a web-search model (Perplexity, accessed through OpenRouter) that receives only business details, such as a company name, the callback number, and what the caller offered, never your name or phone number. Requests run on our servers. We send only the context needed for the task, such as report details and the fields required for a document. We do not send your password or payment information. We select model providers whose API terms prohibit training on our requests. AI output can be wrong or incomplete, which is why you must review every document before you use it (see Terms, Section 3).

7. Service providers

Provider	Function	Data involved
Supabase (AWS, United States)	Database, authentication, storage, server functions	Account data, reports, documents, recordings, uploads, server logs
Telnyx	Phone numbers, phone-number verification, callback calls, number lookups	Your phone number and the verification text you send, numbers you report, callback call audio and metadata, carrier and line-type results
Vapi (and the speech and language model providers it uses to run calls)	AI voice agent that places callback calls and records and transcribes them	Numbers called, call audio, transcripts, call metadata; never your name or phone number
OpenRouter and the model providers it routes to, including Perplexity for web search	AI summaries, reading screenshots and voicemails, classification, document drafting, company research	Report details, transcripts, screenshots and voicemail audio, and document context needed for the request; business details only for company research; no payment data
Number and business lookup services (Telnyx lookups, Trestle, IPQualityScore) and public business registries (state registries, the SEC, GLEIF, domain registration records)	Identifying the company behind a number	Phone numbers you report, company names and web domains, and your state of residence, used to choose which registries to search
PostHog (US cloud)	Product analytics	Anonymous device ID not linked to your account, named in-app events, app version, OS, device model; not IDFA
Apple App Store / StoreKit	Subscriptions	Apple collects payment data directly; we receive transaction status only
Stripe	Payments for mailed letters (card or Apple Pay)	Payment details collected by Stripe; we receive payment status and transaction identifiers
PostGrid	Printing and mailing letters you buy	The letter and its evidence pages, your name, mailing address, and phone number, and the recipient's address
Resend	Email delivery for carrier notices	Report counts, dates, short excerpts of report text with reporters' names, phone numbers, and emails removed, and callback findings
Cloudflare	Reporting gateway for the iOS Report button, Site hosting, bot protection (Turnstile), support email routing	Reports passing through the gateway, Site requests, messages sent to [email protected]
Apple Push Notification service	Push notifications	Push token and notification content
Businesses you send a letter to	Receiving letters you approve and pay to mail	The letter and attachments you approve

We use no ad networks, attribution SDKs, data brokers, or social-media SDKs. Providers may process data only to perform services for us.

8. How we share information

We share personal information only:

• With the service providers in Section 7.

• With reviewers working for Nomer, who may see your reports and case facts to check them before a letter is prepared.

• At your direction. When you export a document, we give it to you to submit yourself; complaints to the FTC, the FCC, state attorneys general, and public utility commissions are always submitted by you, not by Nomer. When you approve and pay for Nomer to mail a demand letter, we send it and the information in it (which may include transcripts and screenshots) through our mailing provider to the business you choose. You remain the sender and complainant.

• As aggregated or de-identified spam data, such as a number's spam score or report count, or the company facts learned on a callback, which may be shown to other users or shared with partners and does not identify you.

• With telephone carriers. When several users report the same number, Nomer may, on its own initiative, notify the carrier that serves it (using contact details from the FCC's Robocall Mitigation Database). The notice includes report counts and dates, short excerpts of report text with reporters' names, phone numbers, and email addresses removed, and the company facts learned on any callback.

• To comply with a subpoena, court order, warrant, or other valid legal process.

• To protect the rights, property, or safety of users, the public, or JBX Huddle, or to investigate fraud or Terms violations.

• In a merger, acquisition, financing, asset sale, or insolvency. We will notify you before your data becomes subject to a different privacy policy.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the CCPA and other state laws.

9. Cookies and local storage

The Site uses only strictly necessary cookies for sessions and security. The App stores session tokens, settings, and short-lived caches on your device. We use no advertising or cross-site tracking cookies.

10. Security

• TLS 1.2 or higher for all data in transit.

• Encryption at rest through our hosting provider.

• Row-level security so each user can access only their own reports and documents.

• Multi-factor authentication on production systems, limited to named personnel.

No system is perfectly secure, and we cannot guarantee absolute security. You are responsible for securing your device and the email account tied to Nomer. If we learn of a breach affecting your personal information, we will notify you as required by law.

11. Retention and deletion

Data	Retention
Account data	Until you delete your account
Reports, uploads, and documents	Until you delete your account
Callback recordings and transcripts	Until you delete your account
Company facts learned on a callback	Kept after you delete your account, without any link to you
Records of letters we mail for you (a minimal dispatch record)	4 years after mailing, including after you delete your account
Payment records for mailed letters	As long as tax and accounting law requires, including after you delete your account
Exports you request	7 days
Pilot waitlist sign-ups	12 months
Server and security logs	Up to 90 days, then rotated
Subscription transaction records	As needed for reconciliation, tax, and accounting law
Data needed for a legal hold, dispute, or law enforcement request	Until the matter is resolved
Aggregated, de-identified spam data (e.g., a number's report count)	Indefinitely

Delete your account in the App under Settings → Delete Account, or by emailing [email protected]. Deletion is completed within 30 days. Spam reports you submitted remain only in de-identified, aggregated form, and the records listed above as kept after deletion are kept for those periods. Documents you already sent or filed with third parties are held by those recipients and cannot be recalled by us.

12. Your privacy rights

12.1 All users can access, correct, export, and delete their data, and opt out of non-transactional email.

12.2 California (CCPA/CPRA). You have the right to know what personal information we collect, use, and disclose; to delete and correct it; to opt out of sale or sharing; and to limit use of sensitive personal information. We do not sell or share personal information and do not use sensitive personal information for purposes that trigger the right to limit. Categories, sources, purposes, and recipients are described in Sections 3, 5, 7, and 8.

12.3 Other states (including Texas, Virginia, Colorado, Connecticut, Utah, Oregon, and others with comprehensive privacy laws). You have substantially similar rights to access, correct, delete, and port your data, to opt out of targeted advertising, sale, and profiling, and to appeal a denied request by replying to our decision.

12.4 Exercising your rights. Email [email protected] with "Privacy Request" and your state in the subject line. We respond within the period required by law (typically 45 days, extendable once). We will verify your identity before acting. An authorized agent may submit a request with written proof of authorization. We will not discriminate against you for exercising your rights.

12.5 Global Privacy Control and Do Not Track. We honor Global Privacy Control signals as an opt-out of sale and sharing where required by law. Because we do not sell, share, or track across sites, Do Not Track signals do not change how the Service works.

13. Children

The Service is for adults 18 and older and is not directed to children. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, email [email protected] and we will delete it.

14. International users

The Service is offered only in the United States, and data is stored and processed in the United States. If you access it from elsewhere, you do so at your own initiative and consent to processing in the United States.

15. Push notifications and email

Push notifications are opt-in and can be turned off in your device settings. We email you only to answer messages you send us, to send pilot updates you agreed to, or as the law requires. Marketing emails include an unsubscribe link.

16. Changes to this policy

We post updates at getnomer.app/privacy with a new "Last updated" date. For material changes, we also notify you in the App or by email. Continued use after an update takes effect means you accept it.

17. Contact

JBX Huddle LLC Attn: Privacy Wilmington, Delaware Email: [email protected] (subject line "Privacy")

Appendix A: Apple App Privacy label crosswalk

Apple category	Collected	Linked to you	Used for tracking	Purpose
Email address	Yes	Yes	No	App functionality
Name	Yes, optional	Yes	No	App functionality (documents)
Phone number	Yes	Yes	No	App functionality (account verification, reports)
Physical address	Yes, optional	Yes	No	App functionality (documents, mailing)
User ID	Yes	Yes	No	App functionality
Device ID (app device registration and push token, not IDFA)	Yes	Yes	No	App functionality
Device ID (PostHog anonymous ID)	Yes	No	No	Analytics
Emails or text messages (message text you report)	Yes	Yes	No	App functionality
Audio data (voicemails you share, callback recordings)	Yes	Yes	No	App functionality
Photos or videos (screenshots you upload)	Yes	Yes	No	App functionality
Other user content (reports, transcripts, documents, support messages)	Yes	Yes	No	App functionality
Product interaction	Yes	No	No	Analytics
Crash and performance data	Yes	No	No	App functionality
Purchase history	Yes	Yes	No	App functionality
Payment info	Yes, for mailed letters (collected by Stripe or Apple Pay)	Yes	No	App functionality
Precise or coarse location	No	n/a	n/a	n/a
Contacts	No	n/a	n/a	n/a
Health, financial, sensitive info	No	n/a	n/a	n/a
Browsing or search history	No	n/a	n/a	n/a

Nomer does not engage in "tracking" as Apple defines it.